source: postlfs/security/heimdal.xml@ 635cb25

10.0 10.1 11.0 11.1 11.2 11.3 12.0 12.1 6.2 6.2.0 6.2.0-rc1 6.2.0-rc2 6.3 6.3-rc1 6.3-rc2 6.3-rc3 7.10 7.4 7.5 7.6 7.6-blfs 7.6-systemd 7.7 7.8 7.9 8.0 8.1 8.2 8.3 8.4 9.0 9.1 basic bdubbs/svn elogind gnome kde5-13430 kde5-14269 kde5-14686 kea ken/TL2024 ken/inkscape-core-mods ken/tuningfonts krejzi/svn lazarus lxqt nosym perl-modules plabs/newcss plabs/python-mods python3.11 qt5new rahul/power-profiles-daemon renodr/vulkan-addition systemd-11177 systemd-13485 trunk upgradedb xry111/intltool xry111/llvm18 xry111/soup3 xry111/test-20220226 xry111/xf86-video-removal
Last change on this file since 635cb25 was 635cb25, checked in by Dan Nichilson <dnicholson@…>, 18 years ago

Updated to openssl-0.9.8a. Added patch for cyrus-sasl-2.1.21 with openssl-0.9.8+

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@5957 af4574ff-66df-0310-9fd7-8a98e5e911e0
  • Property mode set to 100644
File size: 41.8 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
3 "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY heimdal-download-http "http://ftp.vc-graz.ac.at/mirror/crypto/kerberos/heimdal/heimdal-&heimdal-version;.tar.gz">
8 <!ENTITY heimdal-download-ftp "ftp://ftp.pdc.kth.se/pub/heimdal/src/heimdal-&heimdal-version;.tar.gz">
9 <!ENTITY heimdal-md5sum "c937580d6f8b11bf7f0e540530e1dc18">
10 <!ENTITY heimdal-size "4.5 MB">
11 <!ENTITY heimdal-buildsize "96.9 MB">
12 <!ENTITY heimdal-time "2.5 SBU">
13]>
14
15<sect1 id="heimdal" xreflabel="Heimdal-&heimdal-version;">
16 <?dbhtml filename="heimdal.html"?>
17
18 <sect1info>
19 <othername>$LastChangedBy$</othername>
20 <date>$Date$</date>
21 <keywordset>
22 <keyword role="package">heimdal-&heimdal-version;.tar</keyword>
23 <keyword role="ftpdir">heimdal</keyword>
24 </keywordset>
25 </sect1info>
26
27 <title>Heimdal-&heimdal-version;</title>
28
29 <indexterm zone="heimdal">
30 <primary sortas="a-Heimdal">Heimdal</primary>
31 </indexterm>
32
33 <sect2 role="package">
34 <title>Introduction to Heimdal</title>
35
36 <para><application>Heimdal</application> is a free implementation
37 of Kerberos 5 that aims to be compatible with MIT krb5 and is
38 backward compatible with krb4. Kerberos is a network authentication
39 protocol. Basically it preserves the integrity of passwords in any
40 untrusted network (like the Internet). Kerberized applications work
41 hand-in-hand with sites that support Kerberos to ensure that passwords
42 cannot be stolen or compromised. A Kerberos installation will make changes
43 to the authentication mechanisms on your network and will overwrite several
44 programs and daemons from the <application>Coreutils</application>,
45 <application>Inetutils</application>, <application>Qpopper</application>
46 and <application>Shadow</application> packages.</para>
47
48 <bridgehead renderas="sect3">Package Information</bridgehead>
49 <itemizedlist spacing="compact">
50 <listitem>
51 <para>Download (HTTP): <ulink url="&heimdal-download-http;"/></para>
52 </listitem>
53 <listitem>
54 <para>Download (FTP): <ulink url="&heimdal-download-ftp;"/></para>
55 </listitem>
56 <listitem>
57 <para>Download MD5 sum: &heimdal-md5sum;</para>
58 </listitem>
59 <listitem>
60 <para>Download size: &heimdal-size;</para>
61 </listitem>
62 <listitem>
63 <para>Estimated disk space required: &heimdal-buildsize;</para>
64 </listitem>
65 <listitem>
66 <para>Estimated build time: &heimdal-time;</para>
67 </listitem>
68 </itemizedlist>
69
70 <bridgehead renderas="sect3">Additional Downloads</bridgehead>
71 <itemizedlist spacing='compact'>
72 <listitem>
73 <para>Required Patch: <ulink
74 url="&patch-root;/heimdal-&heimdal-version;-fhs_compliance-1.patch"/></para>
75 </listitem>
76 <listitem>
77 <para>Required patch for <application>CrackLib</application> support: <ulink
78 url="&patch-root;/heimdal-&heimdal-version;-cracklib-1.patch"/></para>
79 </listitem>
80 </itemizedlist>
81
82 <bridgehead renderas="sect3">Heimdal Dependencies</bridgehead>
83
84 <bridgehead renderas="sect4">Required to Build the Server-Side Tools</bridgehead>
85 <para role="required">
86 <!-- <xref linkend="db"/> -->
87 <xref linkend="db"/> is recommended (installed in LFS)
88 or <xref linkend="gdbm"/></para>
89
90 <bridgehead renderas="sect4">Recommended</bridgehead>
91 <para role="recommended"><xref linkend="openssl"/></para>
92
93 <bridgehead renderas="sect4">Optional</bridgehead>
94 <para role="optional"><xref linkend="linux-pam"/>,
95 <xref linkend="openldap"/>,
96 <xref linkend="x-window-system"/>,
97 <xref linkend="cracklib"/> (compiled with the <filename>heimdal</filename>
98 patch), and
99 <ulink url="http://www.pdc.kth.se/kth-krb/">krb4</ulink></para>
100
101 <note>
102 <para>Some sort of time synchronization facility on your system
103 (like <xref linkend="ntp"/>) is required since Kerberos won't
104 authenticate if the time differential between a kerberized client
105 and the KDC server is more than 5 minutes.</para>
106 </note>
107
108 <para condition="html" role="usernotes">User Notes:
109 <ulink url="&blfs-wiki;/heimdal"/></para>
110
111 </sect2>
112
113 <sect2 role="installation">
114 <title>Installation of Heimdal</title>
115
116 <!-- This doesn't appear to be needed any longer as testing has
117 shown that the ftp client now works without issues
118
119 <para>Before installing the package, you may want to preserve the
120 <command>ftp</command> program from the <application>Inetutils</application>
121 package. This is because using the <application>Heimdal</application>
122 <command>ftp</command> program to connect to non-kerberized ftp servers may
123 not work properly. It will allow you to connect (letting you know that
124 transmission of the password is clear text) but will have problems doing
125 puts and gets. Issue the following command as the
126 <systemitem class="username">root</systemitem> user.</para>
127
128<screen role="root"><userinput>mv -v /usr/bin/ftp /usr/bin/ftpn</userinput></screen>
129
130 -->
131
132 <warning>
133 <para>Ensure you really need a Kerberos installation before you decide
134 to install this package. Failure to install and configure the package
135 in accordance with the instructions below can alter your system so that
136 users cannot log in.</para>
137 </warning>
138
139 <para>If you wish the <application>Heimdal</application> package to
140 link against the <application>CrackLib</application> library to provide
141 enforcement of strong passwords (requires <xref linkend="cracklib"/>
142 installed with the <filename>heimdal</filename> patch), you must apply a
143 patch:</para>
144
145<screen><userinput>patch -Np1 -i ../heimdal-&heimdal-version;-cracklib-1.patch</userinput></screen>
146
147 <para>Install <application>Heimdal</application> by running the following
148 commands:</para>
149
150<screen><userinput>patch -Np1 -i ../heimdal-&heimdal-version;-fhs_compliance-1.patch &amp;&amp;
151./configure --prefix=/usr \
152 --sysconfdir=/etc/heimdal \
153 --libexecdir=/usr/sbin \
154 --datadir=/var/lib/heimdal \
155 --localstatedir=/var/lib/heimdal \
156 --enable-shared \
157 --with-readline=/usr &amp;&amp;
158make</userinput></screen>
159
160 <para>If you wish to create HTML documentation, issue the following
161 command:</para>
162
163<screen><userinput>make -C doc heimdal.html</userinput></screen>
164
165 <para>If you wish to create a text-based version of the documentation,
166 issue the following commands:</para>
167
168<screen><userinput>cd doc &amp;&amp;
169makeinfo --plaintext -o heimdal.txt heimdal.texi &amp;&amp;
170cd ..</userinput></screen>
171
172 <para>To test the results, issue: <command>make check</command>.</para>
173
174 <para>Now, as the <systemitem class="username">root</systemitem> user:</para>
175
176<screen role="root"><userinput>mv -v /usr/include/fnmatch.h /usr/include/fnmatch.h.glibc &amp;&amp;
177mv -v /usr/include/glob.h /usr/include/glob.h.glibc &amp;&amp;
178mv -v /usr/include/ss/ss.h /usr/include/ss/ss.h.e2fsprogs &amp;&amp;
179mv -v /usr/lib/libss.a /usr/lib/libss.a.e2fsprogs &amp;&amp;
180mv -v /usr/lib/libss.so /usr/lib/libss.so.e2fsprogs &amp;&amp;
181make install &amp;&amp;
182mv -v /usr/include/fnmatch.h /usr/include/fnmatch.h.heimdal &amp;&amp;
183mv -v /usr/include/fnmatch.h.glibc /usr/include/fnmatch.h &amp;&amp;
184mv -v /usr/include/glob.h /usr/include/glob.h.heimdal &amp;&amp;
185mv -v /usr/include/glob.h.glibc /usr/include/glob.h &amp;&amp;
186install -v -m755 -d /usr/share/doc/heimdal-&heimdal-version;/standardisation &amp;&amp;
187install -v -m644 doc/{init-creds,layman.asc} \
188 /usr/share/doc/heimdal-&heimdal-version; &amp;&amp;
189install -v -m644 doc/standardisation/* \
190 /usr/share/doc/heimdal-&heimdal-version;/standardisation &amp;&amp;
191mv -v /bin/login /bin/login.shadow &amp;&amp;
192mv -v /bin/su /bin/su.shadow &amp;&amp;
193mv -v /usr/bin/{login,su} /bin &amp;&amp;
194ln -v -sf ../../bin/login /usr/bin &amp;&amp;
195mv -v /usr/lib/lib{otp,kafs,krb5,asn1,roken,crypto}.so.* \
196 /usr/lib/libdb-4.4.so /lib &amp;&amp;
197ln -v -sf ../../lib/libdb-4.4.so /usr/lib/libdb.so &amp;&amp;
198ln -v -sf ../../lib/libdb-4.4.so /usr/lib/libdb-4.so &amp;&amp;
199for SYMLINK in otp.so.0.1.3 kafs.so.0.4.1 krb5.so.17.4.0 \
200 asn1.so.6.1.0 roken.so.16.1.0 crypto.so.0.9.8
201do
202 ln -v -sf ../../lib/lib$SYMLINK \
203 /usr/lib/lib`echo $SYMLINK | cut -d. -f1`.so
204done
205ldconfig</userinput></screen>
206
207 <para>If you built the HTML or text-based documentation, install it using
208 the following commands as the
209 <systemitem class="username">root</systemitem> user:</para>
210
211<screen role="root"><userinput>install -v -m755 -d /usr/share/doc/heimdal-&heimdal-version;/html &amp;&amp;
212install -v -m644 doc/heimdal.html/* \
213 /usr/share/doc/heimdal-&heimdal-version;/html &amp;&amp;
214install -v -m644 doc/heimdal.txt /usr/share/doc/heimdal-&heimdal-version;</userinput></screen>
215
216 </sect2>
217
218 <sect2 role="commands">
219 <title>Command Explanations</title>
220
221 <para><command>mv -v /usr/include/...</command> and
222 <command>mv -v /usr/lib/libss.*</command>: The
223 <application>Heimdal</application> installation will overwrite two
224 interface headers from the <application>Glibc</application> package and an
225 interface header, static library and library symbolic link from the
226 <application>E2fsprogs</application> package. These commands move the
227 original files out of the way before the installation, and then restore
228 the original <application>Glibc</application> headers after the
229 installation. The two <application>Heimdal</application> headers are renamed
230 and preserved on the system. Testing has shown that the system is stable
231 using the <application>Heimdal</application> version of the
232 <filename>libss</filename> library and interface header.</para>
233
234 <para><parameter>--libexecdir=/usr/sbin</parameter>: This switch
235 puts the daemon programs into
236 <filename class="directory">/usr/sbin</filename>.</para>
237
238 <tip>
239 <para>If you want to preserve all your existing
240 <application>Inetutils</application> package daemons, install the
241 <application>Heimdal</application> daemons into
242 <filename class="directory">/usr/sbin/heimdal</filename> (or wherever
243 you want). Since these programs will be called from
244 <command>(x)inetd</command> or <filename>rc</filename> scripts, it
245 really doesn't matter where they are installed, as long as they are
246 correctly specified in the <filename>/etc/(x)inetd.conf</filename> file
247 and <filename>rc</filename> scripts. If you choose something other than
248 <filename class="directory">/usr/sbin</filename>, you may want to move
249 some of the user programs (such as <command>kadmin</command>) to
250 <filename class="directory">/usr/sbin</filename> manually so they'll be
251 in the privileged user's default <envar>PATH</envar>.</para>
252 </tip>
253
254 <para><command>mv ... .shadow; mv ... /bin; ln -v -sf ../../bin...</command>:
255 The <command>login</command> and <command>su</command> programs installed by
256 <application>Heimdal</application> belong in the
257 <filename class="directory">/bin</filename> directory. The
258 <command>login</command> program is symlinked because
259 <application>Heimdal</application> is expecting to find it in
260 <filename class="directory">/usr/bin</filename>. The old executables are
261 preserved before the move so that they can be restored if you experience
262 problems logging into the system after the
263 <application>Heimdal</application> package is installed and
264 configured.</para>
265
266 <para><command>mv ... /lib; ln -v -sf ../../lib/lib... /usr/lib...</command>:
267 The <command>login</command> and <command>su</command> programs installed
268 by <application>Heimdal</application> link against
269 <application>Heimdal</application> libraries as well as libraries provided
270 by the <application>OpenSSL</application> and
271 <application>Berkeley DB</application> packages. These
272 libraries are moved to <filename class="directory">/lib</filename> to be
273 FHS compliant and also in case
274 <filename class="directory">/usr</filename> is located on a separate
275 partition which may not always be mounted.</para>
276
277 </sect2>
278
279 <sect2 role="configuration">
280 <title>Configuring Heimdal</title>
281
282 <sect3 id="heimdal-config">
283 <title>Config Files</title>
284
285 <para><filename>/etc/heimdal/*</filename></para>
286
287 <indexterm zone="heimdal heimdal-config">
288 <primary sortas="e-etc-heimdal">/etc/heimdal/*</primary>
289 </indexterm>
290
291 </sect3>
292
293 <sect3>
294 <title>Configuration Information</title>
295
296 <note>
297 <para>All the configuration steps shown below must be accomplished
298 by the <systemitem class='username'>root</systemitem> user unless
299 otherwise noted.</para>
300 </note>
301
302 <sect4>
303 <title>Master KDC Server Configuration</title>
304
305 <para>Create the Kerberos configuration file with the
306 following commands:</para>
307
308<screen role="root"><userinput>install -v -m755 -d /etc/heimdal &amp;&amp;
309cat &gt; /etc/heimdal/krb5.conf &lt;&lt; "EOF"
310<literal># Begin /etc/heimdal/krb5.conf
311
312[libdefaults]
313 default_realm = <replaceable>&lt;EXAMPLE.COM&gt;</replaceable>
314 encrypt = true
315
316[realms]
317 <replaceable>&lt;EXAMPLE.COM&gt;</replaceable> = {
318 kdc = <replaceable>&lt;hostname.example.com&gt;</replaceable>
319 admin_server = <replaceable>&lt;hostname.example.com&gt;</replaceable>
320 kpasswd_server = <replaceable>&lt;hostname.example.com&gt;</replaceable>
321 }
322
323[domain_realm]
324 .<replaceable>&lt;example.com&gt;</replaceable> = <replaceable>&lt;EXAMPLE.COM&gt;</replaceable>
325
326[logging]
327 kdc = FILE:/var/log/kdc.log
328 admin_server = FILE:/var/log/kadmin.log
329 default = FILE:/var/log/krb.log
330
331# End /etc/heimdal/krb5.conf</literal>
332EOF
333chmod -v 644 /etc/heimdal/krb5.conf</userinput></screen>
334
335 <para>You will need to substitute your domain and proper hostname
336 for the occurrences of the <replaceable>&lt;hostname&gt;</replaceable>
337 and <replaceable>&lt;EXAMPLE.COM&gt;</replaceable> names.</para>
338
339 <para><option>default_realm</option> should be the name of your
340 domain changed to ALL CAPS. This isn't required, but both
341 <application>Heimdal</application> and <application>MIT
342 krb5</application> recommend it.</para>
343
344 <para><option>encrypt = true</option> provides encryption of all
345 traffic between kerberized clients and servers. It's not necessary
346 and can be left off. If you leave it off, you can encrypt all traffic
347 from the client to the server using a switch on the client program
348 instead.</para>
349
350 <para>The <option>[realms]</option> parameters tell the client
351 programs where to look for the KDC authentication services.</para>
352
353 <para>The <option>[domain_realm]</option> section maps a domain
354 to a realm.</para>
355
356 <para>Store the master password in a key file using the following
357 commands:</para>
358
359<screen role="root"><userinput>install -v -m755 -d /var/lib/heimdal &amp;&amp;
360kstash</userinput></screen>
361
362 <para>Create the KDC database:</para>
363
364<screen role="root"><userinput>kadmin -l</userinput></screen>
365
366 <para>The commands below will prompt you for information about the
367 principles. Choose the defaults for now unless you know what you are
368 doing and need to specify different values. You can go in later and
369 change the defaults, should you feel the need. You may use the up and
370 down arrow keys to use the history feature of <command>kadmin</command>
371 in a similar manner as the <command>bash</command> history
372 feature.</para>
373
374 <para>At the <prompt>kadmin&gt;</prompt> prompt, issue the following
375 statement:</para>
376
377<screen role="root"><userinput>init <replaceable>&lt;EXAMPLE.COM&gt;</replaceable></userinput></screen>
378
379 <para>The database must now be populated with at least one principle
380 (user). For now, just use your regular login name or root. You may
381 create as few, or as many principles as you wish using the following
382 statement:</para>
383
384<screen role="root"><userinput>add <replaceable>&lt;loginname&gt;</replaceable></userinput></screen>
385
386 <para>The KDC server and any machine running kerberized
387 server daemons must have a host key installed:</para>
388
389<screen role="root"><userinput>add --random-key host/<replaceable>&lt;hostname.example.com&gt;</replaceable></userinput></screen>
390
391 <para>After choosing the defaults when prompted, you will have to
392 export the data to a keytab file:</para>
393
394<screen role="root"><userinput>ext host/<replaceable>&lt;hostname.example.com&gt;</replaceable></userinput></screen>
395
396 <para>This should have created two files in
397 <filename class="directory">/etc/heimdal</filename>:
398 <filename>krb5.keytab</filename> (Kerberos 5) and
399 <filename>srvtab</filename> (Kerberos 4). Both files should have 600
400 (root rw only) permissions. Keeping the keytab files from public access
401 is crucial to the overall security of the Kerberos installation.</para>
402
403 <para>Eventually, you'll want to add server daemon principles to the
404 database and extract them to the keytab file. You do this in the same
405 way you created the host principles. Below is an example:</para>
406
407<screen role="root"><userinput>add --random-key ftp/<replaceable>&lt;hostname.example.com&gt;</replaceable></userinput></screen>
408
409 <para>(choose the defaults)</para>
410
411<screen role="root"><userinput>ext ftp/<replaceable>&lt;hostname.example.com&gt;</replaceable></userinput></screen>
412
413 <para>Exit the <command>kadmin</command> program (use
414 <command>quit</command> or <command>exit</command>) and return back
415 to the shell prompt. Start the KDC daemon manually, just to test out
416 the installation:</para>
417
418<screen role="root"><userinput>/usr/sbin/kdc &amp;</userinput></screen>
419
420 <para>Attempt to get a TGT (ticket granting ticket) with
421 the following command:</para>
422
423<screen><userinput>kinit <replaceable>&lt;loginname&gt;</replaceable></userinput></screen>
424
425 <para>You will be prompted for the password you created. After you get
426 your ticket, you should list it with the following command:</para>
427
428<screen><userinput>klist</userinput></screen>
429
430 <para>Information about the ticket should be displayed on
431 the screen.</para>
432
433 <para>To test the functionality of the <filename>keytab</filename> file,
434 issue the following command:</para>
435
436<screen><userinput>ktutil list</userinput></screen>
437
438 <para>This should dump a list of the host principals, along with the
439 encryption methods used to access the principals.</para>
440
441 <para>At this point, if everything has been successful so far, you
442 can feel fairly confident in the installation, setup and configuration
443 of your new <application>Heimdal</application> Kerberos 5
444 installation.</para>
445
446 <para id="heimdal-init">Install the
447 <filename>/etc/rc.d/init.d/heimdal</filename> init script included
448 in the <xref linkend="bootscripts"/> package:</para>
449
450 <indexterm zone="heimdal heimdal-init">
451 <primary sortas="f-heimdal">heimdal</primary>
452 </indexterm>
453
454<screen role="root"><userinput>make install-heimdal</userinput></screen>
455
456 </sect4>
457
458 <sect4>
459 <title>Using Kerberized Client Programs</title>
460
461 <para>To use the kerberized client programs (<command>telnet</command>,
462 <command>ftp</command>, <command>rsh</command>,
463 <command>rxterm</command>, <command>rxtelnet</command>,
464 <command>rcp</command>, <command>xnlock</command>), you first must get
465 a TGT. Use the <command>kinit</command> program to get the ticket.
466 After you've acquired the ticket, you can use the kerberized programs
467 to connect to any kerberized server on the network. You will not be
468 prompted for authentication until your ticket expires (default is one
469 day), unless you specify a different user as a command line argument
470 to the program.</para>
471
472 <para>The kerberized programs will connect to non-kerberized daemons,
473 warning you that authentication is not encrypted.</para>
474
475 <para>In order to use the <application>Heimdal</application>
476 <application>X</application> programs, you'll need to add a service
477 port entry to the <filename>/etc/services</filename> file for the
478 <command>kxd</command> server. There is no 'standardized port number'
479 for the 'kx' service in the IANA database, so you'll have to pick an
480 unused port number. Add an entry to the <filename>services</filename>
481 file similar to the entry below (substitute your chosen port number
482 for <replaceable>&lt;49150&gt;</replaceable>):</para>
483
484<screen><literal>kx <replaceable>&lt;49150&gt;</replaceable>/tcp # Heimdal kerberos X
485kx <replaceable>&lt;49150&gt;</replaceable>/udp # Heimdal kerberos X</literal></screen>
486
487 <para>For additional information consult <ulink
488 url="&hints-root;/downloads/files/heimdal.txt">the
489 Heimdal hint</ulink> on which the above instructions are based.</para>
490
491 </sect4>
492
493 </sect3>
494
495 </sect2>
496
497 <sect2 role="content">
498 <title>Contents</title>
499
500 <segmentedlist>
501 <segtitle>Installed Programs</segtitle>
502 <segtitle>Installed Libraries</segtitle>
503 <segtitle>Installed Directories</segtitle>
504
505 <seglistitem>
506 <seg>afslog, dump_log, ftp, ftpd, hprop, hpropd, ipropd-master,
507 ipropd-slave, kadmin, kadmind, kauth, kcm, kdc, kdestroy, kf, kfd,
508 kgetcred, kinit, klist, kpasswd, kpasswdd, krb5-config, kstash,
509 ktutil, kx, kxd, login, mk_cmds, otp, otpprint, pagsh, pfrom, popper,
510 push, rcp, replay_log, rsh, rshd, rxtelnet, rxterm, string2key, su,
511 telnet, telnetd, tenletxr, truncate-log, verify_krb5_conf
512 and xnlock</seg>
513 <seg>libasn1.{so,a}, libeditline.{so,a}, libgssapi.{so,a},
514 libhdb.{so,a}, libkadm5clnt.{so,a}, libkadm5srv.{so,a}, libkafs.{so,a},
515 libkrb5.{so,a}, libotp.{so,a}, libroken.{so,a}, libsl.{so,a}
516 and libss.{so,a}</seg>
517 <seg>/etc/heimdal, /usr/include/kadm5,
518 /usr/share/doc/heimdal-&heimdal-version; and /var/lib/heimdal</seg>
519 </seglistitem>
520 </segmentedlist>
521
522 <variablelist>
523 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
524 <?dbfo list-presentation="list"?>
525 <?dbhtml list-presentation="table"?>
526
527 <varlistentry id="afslog">
528 <term><command>afslog</command></term>
529 <listitem>
530 <para>obtains AFS tokens for a number of cells.</para>
531 <indexterm zone="heimdal afslog">
532 <primary sortas="b-afslog">afslog</primary>
533 </indexterm>
534 </listitem>
535 </varlistentry>
536
537 <varlistentry id="ftp">
538 <term><command>ftp</command></term>
539 <listitem>
540 <para>is a kerberized FTP client.</para>
541 <indexterm zone="heimdal ftp">
542 <primary sortas="b-ftp">ftp</primary>
543 </indexterm>
544 </listitem>
545 </varlistentry>
546
547 <varlistentry id="ftpd">
548 <term><command>ftpd</command></term>
549 <listitem>
550 <para>is a kerberized FTP daemon.</para>
551 <indexterm zone="heimdal ftpd">
552 <primary sortas="b-ftpd">ftpd</primary>
553 </indexterm>
554 </listitem>
555 </varlistentry>
556
557 <varlistentry id="hprop">
558 <term><command>hprop</command></term>
559 <listitem>
560 <para> takes a principal database in a specified format and converts
561 it into a stream of <application>Heimdal</application> database
562 records.</para>
563 <indexterm zone="heimdal hprop">
564 <primary sortas="b-hprop">hprop</primary>
565 </indexterm>
566 </listitem>
567 </varlistentry>
568
569 <varlistentry id="hpropd">
570 <term><command>hpropd</command></term>
571 <listitem>
572 <para>is a server that receives a database sent by
573 <command>hprop</command> and writes it as a local database.</para>
574 <indexterm zone="heimdal hpropd">
575 <primary sortas="b-hpropd">hpropd</primary>
576 </indexterm>
577 </listitem>
578 </varlistentry>
579
580 <varlistentry id="ipropd-master">
581 <term><command>ipropd-master</command></term>
582 <listitem>
583 <para>is a daemon which runs on the master KDC
584 server which incrementally propagates changes to the KDC
585 database to the slave KDC servers.</para>
586 <indexterm zone="heimdal ipropd-master">
587 <primary sortas="b-ipropd-master">ipropd-master</primary>
588 </indexterm>
589 </listitem>
590 </varlistentry>
591
592 <varlistentry id="ipropd-slave">
593 <term><command>ipropd-slave</command></term>
594 <listitem>
595 <para>is a daemon which runs on the slave KDC
596 servers which incrementally propagates changes to the KDC
597 database from the master KDC server.</para>
598 <indexterm zone="heimdal ipropd-slave">
599 <primary sortas="b-ipropd-slave">ipropd-slave</primary>
600 </indexterm>
601 </listitem>
602 </varlistentry>
603
604 <varlistentry id="kadmin">
605 <term><command>kadmin</command></term>
606 <listitem>
607 <para>is a utility used to make modifications to the Kerberos
608 database.</para>
609 <indexterm zone="heimdal kadmin">
610 <primary sortas="b-kadmin">kadmin</primary>
611 </indexterm>
612 </listitem>
613 </varlistentry>
614
615 <varlistentry id="kadmind">
616 <term><command>kadmind</command></term>
617 <listitem>
618 <para>is a server for administrative access to the Kerberos
619 database.</para>
620 <indexterm zone="heimdal kadmind">
621 <primary sortas="b-kadmind">kadmind</primary>
622 </indexterm>
623 </listitem>
624 </varlistentry>
625
626 <varlistentry id="kauth">
627 <term><command>kauth</command></term>
628 <listitem>
629 <para>is a symbolic link to the <command>kinit</command>
630 program.</para>
631 <indexterm zone="heimdal kauth">
632 <primary sortas="g-kauth">kauth</primary>
633 </indexterm>
634 </listitem>
635 </varlistentry>
636
637 <varlistentry id="kcm">
638 <term><command>kcm</command></term>
639 <listitem>
640 <para>is a process based credential cache for Kerberos
641 tickets.</para>
642 <indexterm zone="heimdal kcm">
643 <primary sortas="b-kcm">kcm</primary>
644 </indexterm>
645 </listitem>
646 </varlistentry>
647
648 <varlistentry id="kdc">
649 <term><command>kdc</command></term>
650 <listitem>
651 <para>is a Kerberos 5 server.</para>
652 <indexterm zone="heimdal kdc">
653 <primary sortas="b-kdc">kdc</primary>
654 </indexterm>
655 </listitem>
656 </varlistentry>
657
658 <varlistentry id="kdestroy">
659 <term><command>kdestroy</command></term>
660 <listitem>
661 <para>removes a principle's current set of tickets.</para>
662 <indexterm zone="heimdal kdestroy">
663 <primary sortas="b-kdestroy">kdestroy</primary>
664 </indexterm>
665 </listitem>
666 </varlistentry>
667
668 <varlistentry id="kf">
669 <term><command>kf</command></term>
670 <listitem>
671 <para>is a program which forwards tickets to a remote host through
672 an authenticated and encrypted stream.</para>
673 <indexterm zone="heimdal kf">
674 <primary sortas="b-kf">kf</primary>
675 </indexterm>
676 </listitem>
677 </varlistentry>
678
679 <varlistentry id="kfd">
680 <term><command>kfd</command></term>
681 <listitem>
682 <para>is a server used to receive forwarded tickets.</para>
683 <indexterm zone="heimdal kfd">
684 <primary sortas="b-kfd">kfd</primary>
685 </indexterm>
686 </listitem>
687 </varlistentry>
688
689 <varlistentry id="kgetcred">
690 <term><command>kgetcred</command></term>
691 <listitem>
692 <para>obtains a ticket for a service.</para>
693 <indexterm zone="heimdal kgetcred">
694 <primary sortas="b-kgetcred">kgetcred</primary>
695 </indexterm>
696 </listitem>
697 </varlistentry>
698
699 <varlistentry id="kinit">
700 <term><command>kinit</command></term>
701 <listitem>
702 <para>is used to authenticate to the Kerberos server as a principal
703 and acquire a ticket granting ticket that can later be used to obtain
704 tickets for other services.</para>
705 <indexterm zone="heimdal kinit">
706 <primary sortas="b-kinit">kinit</primary>
707 </indexterm>
708 </listitem>
709 </varlistentry>
710
711 <varlistentry id="klist">
712 <term><command>klist</command></term>
713 <listitem>
714 <para>reads and displays the current tickets in the credential
715 cache.</para>
716 <indexterm zone="heimdal klist">
717 <primary sortas="b-klist">klist</primary>
718 </indexterm>
719 </listitem>
720 </varlistentry>
721
722 <varlistentry id="kpasswd">
723 <term><command>kpasswd</command></term>
724 <listitem>
725 <para>is a program for changing Kerberos 5 passwords.</para>
726 <indexterm zone="heimdal kpasswd">
727 <primary sortas="b-kpasswd">kpasswd</primary>
728 </indexterm>
729 </listitem>
730 </varlistentry>
731
732 <varlistentry id="kpasswdd">
733 <term><command>kpasswdd</command></term>
734 <listitem>
735 <para>is a Kerberos 5 password changing server.</para>
736 <indexterm zone="heimdal kpasswdd">
737 <primary sortas="b-kpasswdd">kpasswdd</primary>
738 </indexterm>
739 </listitem>
740 </varlistentry>
741
742 <varlistentry id="krb5-config-prog">
743 <term><command>krb5-config</command></term>
744 <listitem>
745 <para>gives information on how to link programs against
746 <application>Heimdal</application> libraries.</para>
747 <indexterm zone="heimdal krb5-config-prog">
748 <primary sortas="b-krb5-config">krb5-config</primary>
749 </indexterm>
750 </listitem>
751 </varlistentry>
752
753 <varlistentry id="kstash">
754 <term><command>kstash</command></term>
755 <listitem>
756 <para>stores the KDC master password in a file.</para>
757 <indexterm zone="heimdal kstash">
758 <primary sortas="b-kstash">kstash</primary>
759 </indexterm>
760 </listitem>
761 </varlistentry>
762
763 <varlistentry id="ktutil">
764 <term><command>ktutil</command></term>
765 <listitem>
766 <para>is a program for managing Kerberos keytabs.</para>
767 <indexterm zone="heimdal ktutil">
768 <primary sortas="b-ktutil">ktutil</primary>
769 </indexterm>
770 </listitem>
771 </varlistentry>
772
773 <varlistentry id="kx">
774 <term><command>kx</command></term>
775 <listitem>
776 <para>is a program which securely forwards
777 <application>X</application> connections.</para>
778 <indexterm zone="heimdal kx">
779 <primary sortas="b-kx">kx</primary>
780 </indexterm>
781 </listitem>
782 </varlistentry>
783
784 <varlistentry id="kxd">
785 <term><command>kxd</command></term>
786 <listitem>
787 <para>is the daemon for <command>kx</command>.</para>
788 <indexterm zone="heimdal kxd">
789 <primary sortas="b-kxd">kxd</primary>
790 </indexterm>
791 </listitem>
792 </varlistentry>
793
794 <varlistentry id="login">
795 <term><command>login</command></term>
796 <listitem>
797 <para>is a kerberized login program.</para>
798 <indexterm zone="heimdal login">
799 <primary sortas="b-login">login</primary>
800 </indexterm>
801 </listitem>
802 </varlistentry>
803
804 <varlistentry id="otp">
805 <term><command>otp</command></term>
806 <listitem>
807 <para>manages one-time passwords.</para>
808 <indexterm zone="heimdal otp">
809 <primary sortas="b-otp">otp</primary>
810 </indexterm>
811 </listitem>
812 </varlistentry>
813
814 <varlistentry id="otpprint">
815 <term><command>otpprint</command></term>
816 <listitem>
817 <para>prints lists of one-time passwords.</para>
818 <indexterm zone="heimdal otpprint">
819 <primary sortas="b-otpprint">otpprint</primary>
820 </indexterm>
821 </listitem>
822 </varlistentry>
823
824 <varlistentry id="pfrom">
825 <term><command>pfrom</command></term>
826 <listitem>
827 <para>is a script that runs <command>push --from</command>.</para>
828 <indexterm zone="heimdal pfrom">
829 <primary sortas="b-pfrom">pfrom</primary>
830 </indexterm>
831 </listitem>
832 </varlistentry>
833
834 <varlistentry id="popper">
835 <term><command>popper</command></term>
836 <listitem>
837 <para>is a kerberized POP-3 server.</para>
838 <indexterm zone="heimdal popper">
839 <primary sortas="b-popper">popper</primary>
840 </indexterm>
841 </listitem>
842 </varlistentry>
843
844 <varlistentry id="push">
845 <term><command>push</command></term>
846 <listitem>
847 <para>is a kerberized POP mail retrieval client.</para>
848 <indexterm zone="heimdal push">
849 <primary sortas="b-push">push</primary>
850 </indexterm>
851 </listitem>
852 </varlistentry>
853
854 <varlistentry id="rcp">
855 <term><command>rcp</command></term>
856 <listitem>
857 <para>is a kerberized rcp client program.</para>
858 <indexterm zone="heimdal rcp">
859 <primary sortas="b-rcp">rcp</primary>
860 </indexterm>
861 </listitem>
862 </varlistentry>
863
864 <varlistentry id="rsh">
865 <term><command>rsh</command></term>
866 <listitem>
867 <para>is a kerberized rsh client program.</para>
868 <indexterm zone="heimdal rsh">
869 <primary sortas="b-rsh">rsh</primary>
870 </indexterm>
871 </listitem>
872 </varlistentry>
873
874 <varlistentry id="rshd">
875 <term><command>rshd</command></term>
876 <listitem>
877 <para>is a kerberized rsh server.</para>
878 <indexterm zone="heimdal rshd">
879 <primary sortas="b-rshd">rshd</primary>
880 </indexterm>
881 </listitem>
882 </varlistentry>
883
884 <varlistentry id="rxtelnet">
885 <term><command>rxtelnet</command></term>
886 <listitem>
887 <para>starts a secure <command>xterm</command> window with a
888 <command>telnet</command> to a given host and forwards
889 <application>X</application> connections.</para>
890 <indexterm zone="heimdal rxtelnet">
891 <primary sortas="b-rxtelnet">rxtelnet</primary>
892 </indexterm>
893 </listitem>
894 </varlistentry>
895
896 <varlistentry id="rxterm">
897 <term><command>rxterm</command></term>
898 <listitem>
899 <para>starts a secure remote <command>xterm</command>.</para>
900 <indexterm zone="heimdal rxterm">
901 <primary sortas="b-rxterm">rxterm</primary>
902 </indexterm>
903 </listitem>
904 </varlistentry>
905
906 <varlistentry id="string2key">
907 <term><command>string2key</command></term>
908 <listitem>
909 <para>maps a password into a key.</para>
910 <indexterm zone="heimdal string2key">
911 <primary sortas="b-string2key">string2key</primary>
912 </indexterm>
913 </listitem>
914 </varlistentry>
915
916 <varlistentry id="su">
917 <term><command>su</command></term>
918 <listitem>
919 <para>is a kerberized su client program.</para>
920 <indexterm zone="heimdal su">
921 <primary sortas="b-su">su</primary>
922 </indexterm>
923 </listitem>
924 </varlistentry>
925
926 <varlistentry id="telnet">
927 <term><command>telnet</command></term>
928 <listitem>
929 <para>is a kerberized telnet client program.</para>
930 <indexterm zone="heimdal telnet">
931 <primary sortas="b-telnet">telnet</primary>
932 </indexterm>
933 </listitem>
934 </varlistentry>
935
936 <varlistentry id="telnetd">
937 <term><command>telnetd</command></term>
938 <listitem>
939 <para>is a kerberized telnet server.</para>
940 <indexterm zone="heimdal telnetd">
941 <primary sortas="b-telnetd">telnetd</primary>
942 </indexterm>
943 </listitem>
944 </varlistentry>
945
946 <varlistentry id="tenletxr">
947 <term><command>tenletxr</command></term>
948 <listitem>
949 <para>forwards <application>X</application> connections
950 backwards.</para>
951 <indexterm zone="heimdal tenletxr">
952 <primary sortas="b-tenletxr">tenletxr</primary>
953 </indexterm>
954 </listitem>
955 </varlistentry>
956
957 <varlistentry id="verify_krb5_conf">
958 <term><command>verify_krb5_conf</command></term>
959 <listitem>
960 <para>checks <filename>krb5.conf</filename> file for obvious
961 errors.</para>
962 <indexterm zone="heimdal verify_krb5_conf">
963 <primary sortas="b-verify_krb5_conf">verify_krb5_conf</primary>
964 </indexterm>
965 </listitem>
966 </varlistentry>
967
968 <varlistentry id="xnlock">
969 <term><command>xnlock</command></term>
970 <listitem>
971 <para>is a program that acts as a secure screen saver for
972 workstations running <application>X</application>.</para>
973 <indexterm zone="heimdal xnlock">
974 <primary sortas="b-xnlock">xnlock</primary>
975 </indexterm>
976 </listitem>
977 </varlistentry>
978
979 <varlistentry id="libasn1">
980 <term><filename class='libraryfile'>libasn1.{so,a}</filename></term>
981 <listitem>
982 <para>provides the ASN.1 and DER functions to encode and decode
983 the Kerberos TGTs.</para>
984 <indexterm zone="heimdal libasn1">
985 <primary sortas="c-libasn1">libasn1.{so,a}</primary>
986 </indexterm>
987 </listitem>
988 </varlistentry>
989
990 <varlistentry id="libeditline">
991 <term><filename class='libraryfile'>libeditline.a</filename></term>
992 <listitem>
993 <para>is a command-line editing library with history.</para>
994 <indexterm zone="heimdal libeditline">
995 <primary sortas="c-libeditline">libeditline.a</primary>
996 </indexterm>
997 </listitem>
998 </varlistentry>
999
1000 <varlistentry id="libgssapi">
1001 <term><filename class='libraryfile'>libgssapi.{so,a}</filename></term>
1002 <listitem>
1003 <para>contain the Generic Security Service Application Programming
1004 Interface (GSSAPI) functions which provides security
1005 services to callers in a generic fashion, supportable with a range of
1006 underlying mechanisms and technologies and hence allowing source-level
1007 portability of applications to different environments.</para>
1008 <indexterm zone="heimdal libgssapi">
1009 <primary sortas="c-libgssapi">libgssapi.{so,a}</primary>
1010 </indexterm>
1011 </listitem>
1012 </varlistentry>
1013
1014 <varlistentry id="libhdb">
1015 <term><filename class='libraryfile'>libhdb.{so,a}</filename></term>
1016 <listitem>
1017 <para>is a <application>Heimdal</application> Kerberos 5
1018 authentication/authorization database access library.</para>
1019 <indexterm zone="heimdal libhdb">
1020 <primary sortas="c-libhdb">libhdb.{so,a}</primary>
1021 </indexterm>
1022 </listitem>
1023 </varlistentry>
1024
1025 <varlistentry id="libkadm5clnt">
1026 <term><filename class='libraryfile'>libkadm5clnt.{so,a}</filename></term>
1027 <listitem>
1028 <para>contains the administrative authentication and password
1029 checking functions required by Kerberos 5 client-side programs.</para>
1030 <indexterm zone="heimdal libkadm5clnt">
1031 <primary sortas="c-libkadm5clnt">libkadm5clnt.{so,a}</primary>
1032 </indexterm>
1033 </listitem>
1034 </varlistentry>
1035
1036 <varlistentry id="libkadm5srv">
1037 <term><filename class='libraryfile'>libkadm5srv.{so,a}</filename></term>
1038 <listitem>
1039 <para>contain the administrative authentication and password
1040 checking functions required by Kerberos 5 servers.</para>
1041 <indexterm zone="heimdal libkadm5srv">
1042 <primary sortas="c-libkadm5srv">libkadm5srv.{so,a}</primary>
1043 </indexterm>
1044 </listitem>
1045 </varlistentry>
1046
1047 <varlistentry id="libkafs">
1048 <term><filename class='libraryfile'>libkafs.{so,a}</filename></term>
1049 <listitem>
1050 <para>contains the functions required to authenticated to AFS.</para>
1051 <indexterm zone="heimdal libkafs">
1052 <primary sortas="c-libkafs">libkafs.{so,a}</primary>
1053 </indexterm>
1054 </listitem>
1055 </varlistentry>
1056
1057 <varlistentry id="libkrb5">
1058 <term><filename class='libraryfile'>libkrb5.{so,a}</filename></term>
1059 <listitem>
1060 <para>is an all-purpose Kerberos 5 library.</para>
1061 <indexterm zone="heimdal libkrb5">
1062 <primary sortas="c-libkrb5">libkrb5.{so,a}</primary>
1063 </indexterm>
1064 </listitem>
1065 </varlistentry>
1066
1067 <varlistentry id="libotp">
1068 <term><filename class='libraryfile'>libotp.{so,a}</filename></term>
1069 <listitem>
1070 <para>contains the functions required to handle authenticating
1071 one time passwords.</para>
1072 <indexterm zone="heimdal libotp">
1073 <primary sortas="c-libotp">libotp.{so,a}</primary>
1074 </indexterm>
1075 </listitem>
1076 </varlistentry>
1077
1078 <varlistentry id="libroken">
1079 <term><filename class='libraryfile'>libroken.{so,a}</filename></term>
1080 <listitem>
1081 <para>is a library containing Kerberos 5 compatibility
1082 functions.</para>
1083 <indexterm zone="heimdal libroken">
1084 <primary sortas="c-libroken">libroken.{so,a}</primary>
1085 </indexterm>
1086 </listitem>
1087 </varlistentry>
1088
1089 </variablelist>
1090
1091 </sect2>
1092
1093</sect1>
Note: See TracBrowser for help on using the repository browser.