source: postlfs/security/heimdal.xml@ 71e9f62

10.0 10.1 11.0 11.1 11.2 11.3 12.0 12.1 6.3 6.3-rc1 6.3-rc2 6.3-rc3 7.10 7.4 7.5 7.6 7.6-blfs 7.6-systemd 7.7 7.8 7.9 8.0 8.1 8.2 8.3 8.4 9.0 9.1 basic bdubbs/svn elogind gnome kde5-13430 kde5-14269 kde5-14686 kea ken/TL2024 ken/inkscape-core-mods ken/tuningfonts krejzi/svn lazarus lxqt nosym perl-modules plabs/newcss plabs/python-mods python3.11 qt5new rahul/power-profiles-daemon renodr/vulkan-addition systemd-11177 systemd-13485 trunk upgradedb xry111/intltool xry111/llvm18 xry111/soup3 xry111/test-20220226 xry111/xf86-video-removal
Last change on this file since 71e9f62 was ab818289, checked in by Randy McMurchy <randy@…>, 18 years ago

Added a patch to the Heimdal instructions to fix a security vulnerability identified in MIT advisories CVE-2006-3083 and CVE-2006-3084

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@6312 af4574ff-66df-0310-9fd7-8a98e5e911e0
  • Property mode set to 100644
File size: 41.8 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
3 "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY heimdal-download-http "http://ftp.vc-graz.ac.at/mirror/crypto/kerberos/heimdal/heimdal-&heimdal-version;.tar.gz">
8 <!ENTITY heimdal-download-ftp "ftp://ftp.pdc.kth.se/pub/heimdal/src/heimdal-&heimdal-version;.tar.gz">
9 <!ENTITY heimdal-md5sum "c937580d6f8b11bf7f0e540530e1dc18">
10 <!ENTITY heimdal-size "4.5 MB">
11 <!ENTITY heimdal-buildsize "96.9 MB">
12 <!ENTITY heimdal-time "2.5 SBU">
13]>
14
15<sect1 id="heimdal" xreflabel="Heimdal-&heimdal-version;">
16 <?dbhtml filename="heimdal.html"?>
17
18 <sect1info>
19 <othername>$LastChangedBy$</othername>
20 <date>$Date$</date>
21 </sect1info>
22
23 <title>Heimdal-&heimdal-version;</title>
24
25 <indexterm zone="heimdal">
26 <primary sortas="a-Heimdal">Heimdal</primary>
27 </indexterm>
28
29 <sect2 role="package">
30 <title>Introduction to Heimdal</title>
31
32 <para><application>Heimdal</application> is a free implementation
33 of Kerberos 5 that aims to be compatible with MIT krb5 and is
34 backward compatible with krb4. Kerberos is a network authentication
35 protocol. Basically it preserves the integrity of passwords in any
36 untrusted network (like the Internet). Kerberized applications work
37 hand-in-hand with sites that support Kerberos to ensure that passwords
38 cannot be stolen or compromised. A Kerberos installation will make changes
39 to the authentication mechanisms on your network and will overwrite several
40 programs and daemons from the <application>Coreutils</application>,
41 <application>Inetutils</application>, <application>Qpopper</application>
42 and <application>Shadow</application> packages.</para>
43
44 <bridgehead renderas="sect3">Package Information</bridgehead>
45 <itemizedlist spacing="compact">
46 <listitem>
47 <para>Download (HTTP): <ulink url="&heimdal-download-http;"/></para>
48 </listitem>
49 <listitem>
50 <para>Download (FTP): <ulink url="&heimdal-download-ftp;"/></para>
51 </listitem>
52 <listitem>
53 <para>Download MD5 sum: &heimdal-md5sum;</para>
54 </listitem>
55 <listitem>
56 <para>Download size: &heimdal-size;</para>
57 </listitem>
58 <listitem>
59 <para>Estimated disk space required: &heimdal-buildsize;</para>
60 </listitem>
61 <listitem>
62 <para>Estimated build time: &heimdal-time;</para>
63 </listitem>
64 </itemizedlist>
65
66 <bridgehead renderas="sect3">Additional Downloads</bridgehead>
67 <itemizedlist spacing='compact'>
68 <listitem>
69 <para>Required Patch: <ulink
70 url="ftp://ftp.pdc.kth.se/pub/heimdal/src/heimdal-0.7.2-setuid-patch.txt"/></para>
71 </listitem>
72 <listitem>
73 <para>Required Patch: <ulink
74 url="&patch-root;/heimdal-&heimdal-version;-fhs_compliance-1.patch"/></para>
75 </listitem>
76 <listitem>
77 <para>Required patch for <application>CrackLib</application> support: <ulink
78 url="&patch-root;/heimdal-&heimdal-version;-cracklib-1.patch"/></para>
79 </listitem>
80 </itemizedlist>
81
82 <bridgehead renderas="sect3">Heimdal Dependencies</bridgehead>
83
84 <bridgehead renderas="sect4">Required to Build the Server-Side Tools</bridgehead>
85 <para role="required">
86 <!-- <xref linkend="db"/> -->
87 <xref linkend="db"/> is recommended (installed in LFS)
88 or <xref linkend="gdbm"/></para>
89
90 <bridgehead renderas="sect4">Recommended</bridgehead>
91 <para role="recommended"><xref linkend="openssl"/></para>
92
93 <bridgehead renderas="sect4">Optional</bridgehead>
94 <para role="optional"><xref linkend="linux-pam"/>,
95 <xref linkend="openldap"/>,
96 <xref linkend="x-window-system"/>,
97 <xref linkend="cracklib"/> (compiled with the <filename>heimdal</filename>
98 patch), and
99 <ulink url="http://www.pdc.kth.se/kth-krb/">krb4</ulink></para>
100
101 <note>
102 <para>Some sort of time synchronization facility on your system
103 (like <xref linkend="ntp"/>) is required since Kerberos won't
104 authenticate if the time differential between a kerberized client
105 and the KDC server is more than 5 minutes.</para>
106 </note>
107
108 <para condition="html" role="usernotes">User Notes:
109 <ulink url="&blfs-wiki;/heimdal"/></para>
110
111 </sect2>
112
113 <sect2 role="installation">
114 <title>Installation of Heimdal</title>
115
116 <!-- This doesn't appear to be needed any longer as testing has
117 shown that the ftp client now works without issues
118
119 <para>Before installing the package, you may want to preserve the
120 <command>ftp</command> program from the <application>Inetutils</application>
121 package. This is because using the <application>Heimdal</application>
122 <command>ftp</command> program to connect to non-kerberized ftp servers may
123 not work properly. It will allow you to connect (letting you know that
124 transmission of the password is clear text) but will have problems doing
125 puts and gets. Issue the following command as the
126 <systemitem class="username">root</systemitem> user.</para>
127
128<screen role="root"><userinput>mv -v /usr/bin/ftp /usr/bin/ftpn</userinput></screen>
129
130 -->
131
132 <warning>
133 <para>Ensure you really need a Kerberos installation before you decide
134 to install this package. Failure to install and configure the package
135 in accordance with the instructions below can alter your system so that
136 users cannot log in.</para>
137 </warning>
138
139 <para>If you wish the <application>Heimdal</application> package to
140 link against the <application>CrackLib</application> library to provide
141 enforcement of strong passwords (requires <xref linkend="cracklib"/>
142 installed with the <filename>heimdal</filename> patch), you must apply a
143 patch:</para>
144
145<screen><userinput>patch -Np1 -i ../heimdal-&heimdal-version;-cracklib-1.patch</userinput></screen>
146
147 <para>Install <application>Heimdal</application> by running the following
148 commands:</para>
149
150<screen><userinput>patch -Np1 -i ../heimdal-&heimdal-version;-setuid-patch.txt &amp;&amp;
151patch -Np1 -i ../heimdal-&heimdal-version;-fhs_compliance-1.patch &amp;&amp;
152./configure --prefix=/usr \
153 --sysconfdir=/etc/heimdal \
154 --libexecdir=/usr/sbin \
155 --datadir=/var/lib/heimdal \
156 --localstatedir=/var/lib/heimdal \
157 --enable-shared \
158 --with-readline=/usr &amp;&amp;
159make</userinput></screen>
160
161 <para>If you wish to create HTML documentation, issue the following
162 command:</para>
163
164<screen><userinput>make -C doc heimdal.html</userinput></screen>
165
166 <para>If you wish to create a text-based version of the documentation,
167 issue the following commands:</para>
168
169<screen><userinput>cd doc &amp;&amp;
170makeinfo --plaintext -o heimdal.txt heimdal.texi &amp;&amp;
171cd ..</userinput></screen>
172
173 <para>To test the results, issue: <command>make check</command>.</para>
174
175 <para>Now, as the <systemitem class="username">root</systemitem> user:</para>
176
177<screen role="root"><userinput>mv -v /usr/include/fnmatch.h /usr/include/fnmatch.h.glibc &amp;&amp;
178mv -v /usr/include/glob.h /usr/include/glob.h.glibc &amp;&amp;
179mv -v /usr/include/ss/ss.h /usr/include/ss/ss.h.e2fsprogs &amp;&amp;
180mv -v /usr/lib/libss.a /usr/lib/libss.a.e2fsprogs &amp;&amp;
181mv -v /usr/lib/libss.so /usr/lib/libss.so.e2fsprogs &amp;&amp;
182make install &amp;&amp;
183mv -v /usr/include/fnmatch.h /usr/include/fnmatch.h.heimdal &amp;&amp;
184mv -v /usr/include/fnmatch.h.glibc /usr/include/fnmatch.h &amp;&amp;
185mv -v /usr/include/glob.h /usr/include/glob.h.heimdal &amp;&amp;
186mv -v /usr/include/glob.h.glibc /usr/include/glob.h &amp;&amp;
187install -v -m755 -d /usr/share/doc/heimdal-&heimdal-version;/standardisation &amp;&amp;
188install -v -m644 doc/{init-creds,layman.asc} \
189 /usr/share/doc/heimdal-&heimdal-version; &amp;&amp;
190install -v -m644 doc/standardisation/* \
191 /usr/share/doc/heimdal-&heimdal-version;/standardisation &amp;&amp;
192mv -v /bin/login /bin/login.shadow &amp;&amp;
193mv -v /bin/su /bin/su.shadow &amp;&amp;
194mv -v /usr/bin/{login,su} /bin &amp;&amp;
195ln -v -sf ../../bin/login /usr/bin &amp;&amp;
196mv -v /usr/lib/lib{otp,kafs,krb5,asn1,roken,crypto}.so.* \
197 /usr/lib/libdb-4.4.so /lib &amp;&amp;
198ln -v -sf ../../lib/libdb-4.4.so /usr/lib/libdb.so &amp;&amp;
199ln -v -sf ../../lib/libdb-4.4.so /usr/lib/libdb-4.so &amp;&amp;
200for SYMLINK in otp.so.0.1.3 kafs.so.0.4.1 krb5.so.17.4.0 \
201 asn1.so.6.1.0 roken.so.16.1.0 crypto.so.0.9.8
202do
203 ln -v -sf ../../lib/lib$SYMLINK \
204 /usr/lib/lib`echo $SYMLINK | cut -d. -f1`.so
205done
206ldconfig</userinput></screen>
207
208 <para>If you built the HTML or text-based documentation, install it using
209 the following commands as the
210 <systemitem class="username">root</systemitem> user:</para>
211
212<screen role="root"><userinput>install -v -m755 -d /usr/share/doc/heimdal-&heimdal-version;/html &amp;&amp;
213install -v -m644 doc/heimdal.html/* \
214 /usr/share/doc/heimdal-&heimdal-version;/html &amp;&amp;
215install -v -m644 doc/heimdal.txt /usr/share/doc/heimdal-&heimdal-version;</userinput></screen>
216
217 </sect2>
218
219 <sect2 role="commands">
220 <title>Command Explanations</title>
221
222 <para><command>mv -v /usr/include/...</command> and
223 <command>mv -v /usr/lib/libss.*</command>: The
224 <application>Heimdal</application> installation will overwrite two
225 interface headers from the <application>Glibc</application> package and an
226 interface header, static library and library symbolic link from the
227 <application>E2fsprogs</application> package. These commands move the
228 original files out of the way before the installation, and then restore
229 the original <application>Glibc</application> headers after the
230 installation. The two <application>Heimdal</application> headers are renamed
231 and preserved on the system. Testing has shown that the system is stable
232 using the <application>Heimdal</application> version of the
233 <filename>libss</filename> library and interface header.</para>
234
235 <para><parameter>--libexecdir=/usr/sbin</parameter>: This switch
236 puts the daemon programs into
237 <filename class="directory">/usr/sbin</filename>.</para>
238
239 <tip>
240 <para>If you want to preserve all your existing
241 <application>Inetutils</application> package daemons, install the
242 <application>Heimdal</application> daemons into
243 <filename class="directory">/usr/sbin/heimdal</filename> (or wherever
244 you want). Since these programs will be called from
245 <command>(x)inetd</command> or <filename>rc</filename> scripts, it
246 really doesn't matter where they are installed, as long as they are
247 correctly specified in the <filename>/etc/(x)inetd.conf</filename> file
248 and <filename>rc</filename> scripts. If you choose something other than
249 <filename class="directory">/usr/sbin</filename>, you may want to move
250 some of the user programs (such as <command>kadmin</command>) to
251 <filename class="directory">/usr/sbin</filename> manually so they'll be
252 in the privileged user's default <envar>PATH</envar>.</para>
253 </tip>
254
255 <para><command>mv ... .shadow; mv ... /bin; ln -v -sf ../../bin...</command>:
256 The <command>login</command> and <command>su</command> programs installed by
257 <application>Heimdal</application> belong in the
258 <filename class="directory">/bin</filename> directory. The
259 <command>login</command> program is symlinked because
260 <application>Heimdal</application> is expecting to find it in
261 <filename class="directory">/usr/bin</filename>. The old executables are
262 preserved before the move so that they can be restored if you experience
263 problems logging into the system after the
264 <application>Heimdal</application> package is installed and
265 configured.</para>
266
267 <para><command>mv ... /lib; ln -v -sf ../../lib/lib... /usr/lib...</command>:
268 The <command>login</command> and <command>su</command> programs installed
269 by <application>Heimdal</application> link against
270 <application>Heimdal</application> libraries as well as libraries provided
271 by the <application>OpenSSL</application> and
272 <application>Berkeley DB</application> packages. These
273 libraries are moved to <filename class="directory">/lib</filename> to be
274 FHS compliant and also in case
275 <filename class="directory">/usr</filename> is located on a separate
276 partition which may not always be mounted.</para>
277
278 </sect2>
279
280 <sect2 role="configuration">
281 <title>Configuring Heimdal</title>
282
283 <sect3 id="heimdal-config">
284 <title>Config Files</title>
285
286 <para><filename>/etc/heimdal/*</filename></para>
287
288 <indexterm zone="heimdal heimdal-config">
289 <primary sortas="e-etc-heimdal">/etc/heimdal/*</primary>
290 </indexterm>
291
292 </sect3>
293
294 <sect3>
295 <title>Configuration Information</title>
296
297 <note>
298 <para>All the configuration steps shown below must be accomplished
299 by the <systemitem class='username'>root</systemitem> user unless
300 otherwise noted.</para>
301 </note>
302
303 <sect4>
304 <title>Master KDC Server Configuration</title>
305
306 <para>Create the Kerberos configuration file with the
307 following commands:</para>
308
309<screen role="root"><userinput>install -v -m755 -d /etc/heimdal &amp;&amp;
310cat &gt; /etc/heimdal/krb5.conf &lt;&lt; "EOF"
311<literal># Begin /etc/heimdal/krb5.conf
312
313[libdefaults]
314 default_realm = <replaceable>&lt;EXAMPLE.COM&gt;</replaceable>
315 encrypt = true
316
317[realms]
318 <replaceable>&lt;EXAMPLE.COM&gt;</replaceable> = {
319 kdc = <replaceable>&lt;hostname.example.com&gt;</replaceable>
320 admin_server = <replaceable>&lt;hostname.example.com&gt;</replaceable>
321 kpasswd_server = <replaceable>&lt;hostname.example.com&gt;</replaceable>
322 }
323
324[domain_realm]
325 .<replaceable>&lt;example.com&gt;</replaceable> = <replaceable>&lt;EXAMPLE.COM&gt;</replaceable>
326
327[logging]
328 kdc = FILE:/var/log/kdc.log
329 admin_server = FILE:/var/log/kadmin.log
330 default = FILE:/var/log/krb.log
331
332# End /etc/heimdal/krb5.conf</literal>
333EOF
334chmod -v 644 /etc/heimdal/krb5.conf</userinput></screen>
335
336 <para>You will need to substitute your domain and proper hostname
337 for the occurrences of the <replaceable>&lt;hostname&gt;</replaceable>
338 and <replaceable>&lt;EXAMPLE.COM&gt;</replaceable> names.</para>
339
340 <para><option>default_realm</option> should be the name of your
341 domain changed to ALL CAPS. This isn't required, but both
342 <application>Heimdal</application> and <application>MIT
343 krb5</application> recommend it.</para>
344
345 <para><option>encrypt = true</option> provides encryption of all
346 traffic between kerberized clients and servers. It's not necessary
347 and can be left off. If you leave it off, you can encrypt all traffic
348 from the client to the server using a switch on the client program
349 instead.</para>
350
351 <para>The <option>[realms]</option> parameters tell the client
352 programs where to look for the KDC authentication services.</para>
353
354 <para>The <option>[domain_realm]</option> section maps a domain
355 to a realm.</para>
356
357 <para>Store the master password in a key file using the following
358 commands:</para>
359
360<screen role="root"><userinput>install -v -m755 -d /var/lib/heimdal &amp;&amp;
361kstash</userinput></screen>
362
363 <para>Create the KDC database:</para>
364
365<screen role="root"><userinput>kadmin -l</userinput></screen>
366
367 <para>The commands below will prompt you for information about the
368 principles. Choose the defaults for now unless you know what you are
369 doing and need to specify different values. You can go in later and
370 change the defaults, should you feel the need. You may use the up and
371 down arrow keys to use the history feature of <command>kadmin</command>
372 in a similar manner as the <command>bash</command> history
373 feature.</para>
374
375 <para>At the <prompt>kadmin&gt;</prompt> prompt, issue the following
376 statement:</para>
377
378<screen role="root"><userinput>init <replaceable>&lt;EXAMPLE.COM&gt;</replaceable></userinput></screen>
379
380 <para>The database must now be populated with at least one principle
381 (user). For now, just use your regular login name or root. You may
382 create as few, or as many principles as you wish using the following
383 statement:</para>
384
385<screen role="root"><userinput>add <replaceable>&lt;loginname&gt;</replaceable></userinput></screen>
386
387 <para>The KDC server and any machine running kerberized
388 server daemons must have a host key installed:</para>
389
390<screen role="root"><userinput>add --random-key host/<replaceable>&lt;hostname.example.com&gt;</replaceable></userinput></screen>
391
392 <para>After choosing the defaults when prompted, you will have to
393 export the data to a keytab file:</para>
394
395<screen role="root"><userinput>ext host/<replaceable>&lt;hostname.example.com&gt;</replaceable></userinput></screen>
396
397 <para>This should have created two files in
398 <filename class="directory">/etc/heimdal</filename>:
399 <filename>krb5.keytab</filename> (Kerberos 5) and
400 <filename>srvtab</filename> (Kerberos 4). Both files should have 600
401 (root rw only) permissions. Keeping the keytab files from public access
402 is crucial to the overall security of the Kerberos installation.</para>
403
404 <para>Eventually, you'll want to add server daemon principles to the
405 database and extract them to the keytab file. You do this in the same
406 way you created the host principles. Below is an example:</para>
407
408<screen role="root"><userinput>add --random-key ftp/<replaceable>&lt;hostname.example.com&gt;</replaceable></userinput></screen>
409
410 <para>(choose the defaults)</para>
411
412<screen role="root"><userinput>ext ftp/<replaceable>&lt;hostname.example.com&gt;</replaceable></userinput></screen>
413
414 <para>Exit the <command>kadmin</command> program (use
415 <command>quit</command> or <command>exit</command>) and return back
416 to the shell prompt. Start the KDC daemon manually, just to test out
417 the installation:</para>
418
419<screen role="root"><userinput>/usr/sbin/kdc &amp;</userinput></screen>
420
421 <para>Attempt to get a TGT (ticket granting ticket) with
422 the following command:</para>
423
424<screen><userinput>kinit <replaceable>&lt;loginname&gt;</replaceable></userinput></screen>
425
426 <para>You will be prompted for the password you created. After you get
427 your ticket, you should list it with the following command:</para>
428
429<screen><userinput>klist</userinput></screen>
430
431 <para>Information about the ticket should be displayed on
432 the screen.</para>
433
434 <para>To test the functionality of the <filename>keytab</filename> file,
435 issue the following command:</para>
436
437<screen><userinput>ktutil list</userinput></screen>
438
439 <para>This should dump a list of the host principals, along with the
440 encryption methods used to access the principals.</para>
441
442 <para>At this point, if everything has been successful so far, you
443 can feel fairly confident in the installation, setup and configuration
444 of your new <application>Heimdal</application> Kerberos 5
445 installation.</para>
446
447 <para id="heimdal-init">Install the
448 <filename>/etc/rc.d/init.d/heimdal</filename> init script included
449 in the <xref linkend="bootscripts"/> package:</para>
450
451 <indexterm zone="heimdal heimdal-init">
452 <primary sortas="f-heimdal">heimdal</primary>
453 </indexterm>
454
455<screen role="root"><userinput>make install-heimdal</userinput></screen>
456
457 </sect4>
458
459 <sect4>
460 <title>Using Kerberized Client Programs</title>
461
462 <para>To use the kerberized client programs (<command>telnet</command>,
463 <command>ftp</command>, <command>rsh</command>,
464 <command>rxterm</command>, <command>rxtelnet</command>,
465 <command>rcp</command>, <command>xnlock</command>), you first must get
466 a TGT. Use the <command>kinit</command> program to get the ticket.
467 After you've acquired the ticket, you can use the kerberized programs
468 to connect to any kerberized server on the network. You will not be
469 prompted for authentication until your ticket expires (default is one
470 day), unless you specify a different user as a command line argument
471 to the program.</para>
472
473 <para>The kerberized programs will connect to non-kerberized daemons,
474 warning you that authentication is not encrypted.</para>
475
476 <para>In order to use the <application>Heimdal</application>
477 <application>X</application> programs, you'll need to add a service
478 port entry to the <filename>/etc/services</filename> file for the
479 <command>kxd</command> server. There is no 'standardized port number'
480 for the 'kx' service in the IANA database, so you'll have to pick an
481 unused port number. Add an entry to the <filename>services</filename>
482 file similar to the entry below (substitute your chosen port number
483 for <replaceable>&lt;49150&gt;</replaceable>):</para>
484
485<screen><literal>kx <replaceable>&lt;49150&gt;</replaceable>/tcp # Heimdal kerberos X
486kx <replaceable>&lt;49150&gt;</replaceable>/udp # Heimdal kerberos X</literal></screen>
487
488 <para>For additional information consult <ulink
489 url="&hints-root;/downloads/files/heimdal.txt">the
490 Heimdal hint</ulink> on which the above instructions are based.</para>
491
492 </sect4>
493
494 </sect3>
495
496 </sect2>
497
498 <sect2 role="content">
499 <title>Contents</title>
500
501 <segmentedlist>
502 <segtitle>Installed Programs</segtitle>
503 <segtitle>Installed Libraries</segtitle>
504 <segtitle>Installed Directories</segtitle>
505
506 <seglistitem>
507 <seg>afslog, dump_log, ftp, ftpd, hprop, hpropd, ipropd-master,
508 ipropd-slave, kadmin, kadmind, kauth, kcm, kdc, kdestroy, kf, kfd,
509 kgetcred, kinit, klist, kpasswd, kpasswdd, krb5-config, kstash,
510 ktutil, kx, kxd, login, mk_cmds, otp, otpprint, pagsh, pfrom, popper,
511 push, rcp, replay_log, rsh, rshd, rxtelnet, rxterm, string2key, su,
512 telnet, telnetd, tenletxr, truncate-log, verify_krb5_conf
513 and xnlock</seg>
514 <seg>libasn1.{so,a}, libeditline.{so,a}, libgssapi.{so,a},
515 libhdb.{so,a}, libkadm5clnt.{so,a}, libkadm5srv.{so,a}, libkafs.{so,a},
516 libkrb5.{so,a}, libotp.{so,a}, libroken.{so,a}, libsl.{so,a}
517 and libss.{so,a}</seg>
518 <seg>/etc/heimdal, /usr/include/kadm5,
519 /usr/share/doc/heimdal-&heimdal-version; and /var/lib/heimdal</seg>
520 </seglistitem>
521 </segmentedlist>
522
523 <variablelist>
524 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
525 <?dbfo list-presentation="list"?>
526 <?dbhtml list-presentation="table"?>
527
528 <varlistentry id="afslog">
529 <term><command>afslog</command></term>
530 <listitem>
531 <para>obtains AFS tokens for a number of cells.</para>
532 <indexterm zone="heimdal afslog">
533 <primary sortas="b-afslog">afslog</primary>
534 </indexterm>
535 </listitem>
536 </varlistentry>
537
538 <varlistentry id="ftp">
539 <term><command>ftp</command></term>
540 <listitem>
541 <para>is a kerberized FTP client.</para>
542 <indexterm zone="heimdal ftp">
543 <primary sortas="b-ftp">ftp</primary>
544 </indexterm>
545 </listitem>
546 </varlistentry>
547
548 <varlistentry id="ftpd">
549 <term><command>ftpd</command></term>
550 <listitem>
551 <para>is a kerberized FTP daemon.</para>
552 <indexterm zone="heimdal ftpd">
553 <primary sortas="b-ftpd">ftpd</primary>
554 </indexterm>
555 </listitem>
556 </varlistentry>
557
558 <varlistentry id="hprop">
559 <term><command>hprop</command></term>
560 <listitem>
561 <para> takes a principal database in a specified format and converts
562 it into a stream of <application>Heimdal</application> database
563 records.</para>
564 <indexterm zone="heimdal hprop">
565 <primary sortas="b-hprop">hprop</primary>
566 </indexterm>
567 </listitem>
568 </varlistentry>
569
570 <varlistentry id="hpropd">
571 <term><command>hpropd</command></term>
572 <listitem>
573 <para>is a server that receives a database sent by
574 <command>hprop</command> and writes it as a local database.</para>
575 <indexterm zone="heimdal hpropd">
576 <primary sortas="b-hpropd">hpropd</primary>
577 </indexterm>
578 </listitem>
579 </varlistentry>
580
581 <varlistentry id="ipropd-master">
582 <term><command>ipropd-master</command></term>
583 <listitem>
584 <para>is a daemon which runs on the master KDC
585 server which incrementally propagates changes to the KDC
586 database to the slave KDC servers.</para>
587 <indexterm zone="heimdal ipropd-master">
588 <primary sortas="b-ipropd-master">ipropd-master</primary>
589 </indexterm>
590 </listitem>
591 </varlistentry>
592
593 <varlistentry id="ipropd-slave">
594 <term><command>ipropd-slave</command></term>
595 <listitem>
596 <para>is a daemon which runs on the slave KDC
597 servers which incrementally propagates changes to the KDC
598 database from the master KDC server.</para>
599 <indexterm zone="heimdal ipropd-slave">
600 <primary sortas="b-ipropd-slave">ipropd-slave</primary>
601 </indexterm>
602 </listitem>
603 </varlistentry>
604
605 <varlistentry id="kadmin">
606 <term><command>kadmin</command></term>
607 <listitem>
608 <para>is a utility used to make modifications to the Kerberos
609 database.</para>
610 <indexterm zone="heimdal kadmin">
611 <primary sortas="b-kadmin">kadmin</primary>
612 </indexterm>
613 </listitem>
614 </varlistentry>
615
616 <varlistentry id="kadmind">
617 <term><command>kadmind</command></term>
618 <listitem>
619 <para>is a server for administrative access to the Kerberos
620 database.</para>
621 <indexterm zone="heimdal kadmind">
622 <primary sortas="b-kadmind">kadmind</primary>
623 </indexterm>
624 </listitem>
625 </varlistentry>
626
627 <varlistentry id="kauth">
628 <term><command>kauth</command></term>
629 <listitem>
630 <para>is a symbolic link to the <command>kinit</command>
631 program.</para>
632 <indexterm zone="heimdal kauth">
633 <primary sortas="g-kauth">kauth</primary>
634 </indexterm>
635 </listitem>
636 </varlistentry>
637
638 <varlistentry id="kcm">
639 <term><command>kcm</command></term>
640 <listitem>
641 <para>is a process based credential cache for Kerberos
642 tickets.</para>
643 <indexterm zone="heimdal kcm">
644 <primary sortas="b-kcm">kcm</primary>
645 </indexterm>
646 </listitem>
647 </varlistentry>
648
649 <varlistentry id="kdc">
650 <term><command>kdc</command></term>
651 <listitem>
652 <para>is a Kerberos 5 server.</para>
653 <indexterm zone="heimdal kdc">
654 <primary sortas="b-kdc">kdc</primary>
655 </indexterm>
656 </listitem>
657 </varlistentry>
658
659 <varlistentry id="kdestroy">
660 <term><command>kdestroy</command></term>
661 <listitem>
662 <para>removes a principle's current set of tickets.</para>
663 <indexterm zone="heimdal kdestroy">
664 <primary sortas="b-kdestroy">kdestroy</primary>
665 </indexterm>
666 </listitem>
667 </varlistentry>
668
669 <varlistentry id="kf">
670 <term><command>kf</command></term>
671 <listitem>
672 <para>is a program which forwards tickets to a remote host through
673 an authenticated and encrypted stream.</para>
674 <indexterm zone="heimdal kf">
675 <primary sortas="b-kf">kf</primary>
676 </indexterm>
677 </listitem>
678 </varlistentry>
679
680 <varlistentry id="kfd">
681 <term><command>kfd</command></term>
682 <listitem>
683 <para>is a server used to receive forwarded tickets.</para>
684 <indexterm zone="heimdal kfd">
685 <primary sortas="b-kfd">kfd</primary>
686 </indexterm>
687 </listitem>
688 </varlistentry>
689
690 <varlistentry id="kgetcred">
691 <term><command>kgetcred</command></term>
692 <listitem>
693 <para>obtains a ticket for a service.</para>
694 <indexterm zone="heimdal kgetcred">
695 <primary sortas="b-kgetcred">kgetcred</primary>
696 </indexterm>
697 </listitem>
698 </varlistentry>
699
700 <varlistentry id="kinit">
701 <term><command>kinit</command></term>
702 <listitem>
703 <para>is used to authenticate to the Kerberos server as a principal
704 and acquire a ticket granting ticket that can later be used to obtain
705 tickets for other services.</para>
706 <indexterm zone="heimdal kinit">
707 <primary sortas="b-kinit">kinit</primary>
708 </indexterm>
709 </listitem>
710 </varlistentry>
711
712 <varlistentry id="klist">
713 <term><command>klist</command></term>
714 <listitem>
715 <para>reads and displays the current tickets in the credential
716 cache.</para>
717 <indexterm zone="heimdal klist">
718 <primary sortas="b-klist">klist</primary>
719 </indexterm>
720 </listitem>
721 </varlistentry>
722
723 <varlistentry id="kpasswd">
724 <term><command>kpasswd</command></term>
725 <listitem>
726 <para>is a program for changing Kerberos 5 passwords.</para>
727 <indexterm zone="heimdal kpasswd">
728 <primary sortas="b-kpasswd">kpasswd</primary>
729 </indexterm>
730 </listitem>
731 </varlistentry>
732
733 <varlistentry id="kpasswdd">
734 <term><command>kpasswdd</command></term>
735 <listitem>
736 <para>is a Kerberos 5 password changing server.</para>
737 <indexterm zone="heimdal kpasswdd">
738 <primary sortas="b-kpasswdd">kpasswdd</primary>
739 </indexterm>
740 </listitem>
741 </varlistentry>
742
743 <varlistentry id="krb5-config-prog">
744 <term><command>krb5-config</command></term>
745 <listitem>
746 <para>gives information on how to link programs against
747 <application>Heimdal</application> libraries.</para>
748 <indexterm zone="heimdal krb5-config-prog">
749 <primary sortas="b-krb5-config">krb5-config</primary>
750 </indexterm>
751 </listitem>
752 </varlistentry>
753
754 <varlistentry id="kstash">
755 <term><command>kstash</command></term>
756 <listitem>
757 <para>stores the KDC master password in a file.</para>
758 <indexterm zone="heimdal kstash">
759 <primary sortas="b-kstash">kstash</primary>
760 </indexterm>
761 </listitem>
762 </varlistentry>
763
764 <varlistentry id="ktutil">
765 <term><command>ktutil</command></term>
766 <listitem>
767 <para>is a program for managing Kerberos keytabs.</para>
768 <indexterm zone="heimdal ktutil">
769 <primary sortas="b-ktutil">ktutil</primary>
770 </indexterm>
771 </listitem>
772 </varlistentry>
773
774 <varlistentry id="kx">
775 <term><command>kx</command></term>
776 <listitem>
777 <para>is a program which securely forwards
778 <application>X</application> connections.</para>
779 <indexterm zone="heimdal kx">
780 <primary sortas="b-kx">kx</primary>
781 </indexterm>
782 </listitem>
783 </varlistentry>
784
785 <varlistentry id="kxd">
786 <term><command>kxd</command></term>
787 <listitem>
788 <para>is the daemon for <command>kx</command>.</para>
789 <indexterm zone="heimdal kxd">
790 <primary sortas="b-kxd">kxd</primary>
791 </indexterm>
792 </listitem>
793 </varlistentry>
794
795 <varlistentry id="login">
796 <term><command>login</command></term>
797 <listitem>
798 <para>is a kerberized login program.</para>
799 <indexterm zone="heimdal login">
800 <primary sortas="b-login">login</primary>
801 </indexterm>
802 </listitem>
803 </varlistentry>
804
805 <varlistentry id="otp">
806 <term><command>otp</command></term>
807 <listitem>
808 <para>manages one-time passwords.</para>
809 <indexterm zone="heimdal otp">
810 <primary sortas="b-otp">otp</primary>
811 </indexterm>
812 </listitem>
813 </varlistentry>
814
815 <varlistentry id="otpprint">
816 <term><command>otpprint</command></term>
817 <listitem>
818 <para>prints lists of one-time passwords.</para>
819 <indexterm zone="heimdal otpprint">
820 <primary sortas="b-otpprint">otpprint</primary>
821 </indexterm>
822 </listitem>
823 </varlistentry>
824
825 <varlistentry id="pfrom">
826 <term><command>pfrom</command></term>
827 <listitem>
828 <para>is a script that runs <command>push --from</command>.</para>
829 <indexterm zone="heimdal pfrom">
830 <primary sortas="b-pfrom">pfrom</primary>
831 </indexterm>
832 </listitem>
833 </varlistentry>
834
835 <varlistentry id="popper">
836 <term><command>popper</command></term>
837 <listitem>
838 <para>is a kerberized POP-3 server.</para>
839 <indexterm zone="heimdal popper">
840 <primary sortas="b-popper">popper</primary>
841 </indexterm>
842 </listitem>
843 </varlistentry>
844
845 <varlistentry id="push">
846 <term><command>push</command></term>
847 <listitem>
848 <para>is a kerberized POP mail retrieval client.</para>
849 <indexterm zone="heimdal push">
850 <primary sortas="b-push">push</primary>
851 </indexterm>
852 </listitem>
853 </varlistentry>
854
855 <varlistentry id="rcp">
856 <term><command>rcp</command></term>
857 <listitem>
858 <para>is a kerberized rcp client program.</para>
859 <indexterm zone="heimdal rcp">
860 <primary sortas="b-rcp">rcp</primary>
861 </indexterm>
862 </listitem>
863 </varlistentry>
864
865 <varlistentry id="rsh">
866 <term><command>rsh</command></term>
867 <listitem>
868 <para>is a kerberized rsh client program.</para>
869 <indexterm zone="heimdal rsh">
870 <primary sortas="b-rsh">rsh</primary>
871 </indexterm>
872 </listitem>
873 </varlistentry>
874
875 <varlistentry id="rshd">
876 <term><command>rshd</command></term>
877 <listitem>
878 <para>is a kerberized rsh server.</para>
879 <indexterm zone="heimdal rshd">
880 <primary sortas="b-rshd">rshd</primary>
881 </indexterm>
882 </listitem>
883 </varlistentry>
884
885 <varlistentry id="rxtelnet">
886 <term><command>rxtelnet</command></term>
887 <listitem>
888 <para>starts a secure <command>xterm</command> window with a
889 <command>telnet</command> to a given host and forwards
890 <application>X</application> connections.</para>
891 <indexterm zone="heimdal rxtelnet">
892 <primary sortas="b-rxtelnet">rxtelnet</primary>
893 </indexterm>
894 </listitem>
895 </varlistentry>
896
897 <varlistentry id="rxterm">
898 <term><command>rxterm</command></term>
899 <listitem>
900 <para>starts a secure remote <command>xterm</command>.</para>
901 <indexterm zone="heimdal rxterm">
902 <primary sortas="b-rxterm">rxterm</primary>
903 </indexterm>
904 </listitem>
905 </varlistentry>
906
907 <varlistentry id="string2key">
908 <term><command>string2key</command></term>
909 <listitem>
910 <para>maps a password into a key.</para>
911 <indexterm zone="heimdal string2key">
912 <primary sortas="b-string2key">string2key</primary>
913 </indexterm>
914 </listitem>
915 </varlistentry>
916
917 <varlistentry id="su">
918 <term><command>su</command></term>
919 <listitem>
920 <para>is a kerberized su client program.</para>
921 <indexterm zone="heimdal su">
922 <primary sortas="b-su">su</primary>
923 </indexterm>
924 </listitem>
925 </varlistentry>
926
927 <varlistentry id="telnet">
928 <term><command>telnet</command></term>
929 <listitem>
930 <para>is a kerberized telnet client program.</para>
931 <indexterm zone="heimdal telnet">
932 <primary sortas="b-telnet">telnet</primary>
933 </indexterm>
934 </listitem>
935 </varlistentry>
936
937 <varlistentry id="telnetd">
938 <term><command>telnetd</command></term>
939 <listitem>
940 <para>is a kerberized telnet server.</para>
941 <indexterm zone="heimdal telnetd">
942 <primary sortas="b-telnetd">telnetd</primary>
943 </indexterm>
944 </listitem>
945 </varlistentry>
946
947 <varlistentry id="tenletxr">
948 <term><command>tenletxr</command></term>
949 <listitem>
950 <para>forwards <application>X</application> connections
951 backwards.</para>
952 <indexterm zone="heimdal tenletxr">
953 <primary sortas="b-tenletxr">tenletxr</primary>
954 </indexterm>
955 </listitem>
956 </varlistentry>
957
958 <varlistentry id="verify_krb5_conf">
959 <term><command>verify_krb5_conf</command></term>
960 <listitem>
961 <para>checks <filename>krb5.conf</filename> file for obvious
962 errors.</para>
963 <indexterm zone="heimdal verify_krb5_conf">
964 <primary sortas="b-verify_krb5_conf">verify_krb5_conf</primary>
965 </indexterm>
966 </listitem>
967 </varlistentry>
968
969 <varlistentry id="xnlock">
970 <term><command>xnlock</command></term>
971 <listitem>
972 <para>is a program that acts as a secure screen saver for
973 workstations running <application>X</application>.</para>
974 <indexterm zone="heimdal xnlock">
975 <primary sortas="b-xnlock">xnlock</primary>
976 </indexterm>
977 </listitem>
978 </varlistentry>
979
980 <varlistentry id="libasn1">
981 <term><filename class='libraryfile'>libasn1.{so,a}</filename></term>
982 <listitem>
983 <para>provides the ASN.1 and DER functions to encode and decode
984 the Kerberos TGTs.</para>
985 <indexterm zone="heimdal libasn1">
986 <primary sortas="c-libasn1">libasn1.{so,a}</primary>
987 </indexterm>
988 </listitem>
989 </varlistentry>
990
991 <varlistentry id="libeditline">
992 <term><filename class='libraryfile'>libeditline.a</filename></term>
993 <listitem>
994 <para>is a command-line editing library with history.</para>
995 <indexterm zone="heimdal libeditline">
996 <primary sortas="c-libeditline">libeditline.a</primary>
997 </indexterm>
998 </listitem>
999 </varlistentry>
1000
1001 <varlistentry id="libgssapi">
1002 <term><filename class='libraryfile'>libgssapi.{so,a}</filename></term>
1003 <listitem>
1004 <para>contain the Generic Security Service Application Programming
1005 Interface (GSSAPI) functions which provides security
1006 services to callers in a generic fashion, supportable with a range of
1007 underlying mechanisms and technologies and hence allowing source-level
1008 portability of applications to different environments.</para>
1009 <indexterm zone="heimdal libgssapi">
1010 <primary sortas="c-libgssapi">libgssapi.{so,a}</primary>
1011 </indexterm>
1012 </listitem>
1013 </varlistentry>
1014
1015 <varlistentry id="libhdb">
1016 <term><filename class='libraryfile'>libhdb.{so,a}</filename></term>
1017 <listitem>
1018 <para>is a <application>Heimdal</application> Kerberos 5
1019 authentication/authorization database access library.</para>
1020 <indexterm zone="heimdal libhdb">
1021 <primary sortas="c-libhdb">libhdb.{so,a}</primary>
1022 </indexterm>
1023 </listitem>
1024 </varlistentry>
1025
1026 <varlistentry id="libkadm5clnt">
1027 <term><filename class='libraryfile'>libkadm5clnt.{so,a}</filename></term>
1028 <listitem>
1029 <para>contains the administrative authentication and password
1030 checking functions required by Kerberos 5 client-side programs.</para>
1031 <indexterm zone="heimdal libkadm5clnt">
1032 <primary sortas="c-libkadm5clnt">libkadm5clnt.{so,a}</primary>
1033 </indexterm>
1034 </listitem>
1035 </varlistentry>
1036
1037 <varlistentry id="libkadm5srv">
1038 <term><filename class='libraryfile'>libkadm5srv.{so,a}</filename></term>
1039 <listitem>
1040 <para>contain the administrative authentication and password
1041 checking functions required by Kerberos 5 servers.</para>
1042 <indexterm zone="heimdal libkadm5srv">
1043 <primary sortas="c-libkadm5srv">libkadm5srv.{so,a}</primary>
1044 </indexterm>
1045 </listitem>
1046 </varlistentry>
1047
1048 <varlistentry id="libkafs">
1049 <term><filename class='libraryfile'>libkafs.{so,a}</filename></term>
1050 <listitem>
1051 <para>contains the functions required to authenticated to AFS.</para>
1052 <indexterm zone="heimdal libkafs">
1053 <primary sortas="c-libkafs">libkafs.{so,a}</primary>
1054 </indexterm>
1055 </listitem>
1056 </varlistentry>
1057
1058 <varlistentry id="libkrb5">
1059 <term><filename class='libraryfile'>libkrb5.{so,a}</filename></term>
1060 <listitem>
1061 <para>is an all-purpose Kerberos 5 library.</para>
1062 <indexterm zone="heimdal libkrb5">
1063 <primary sortas="c-libkrb5">libkrb5.{so,a}</primary>
1064 </indexterm>
1065 </listitem>
1066 </varlistentry>
1067
1068 <varlistentry id="libotp">
1069 <term><filename class='libraryfile'>libotp.{so,a}</filename></term>
1070 <listitem>
1071 <para>contains the functions required to handle authenticating
1072 one time passwords.</para>
1073 <indexterm zone="heimdal libotp">
1074 <primary sortas="c-libotp">libotp.{so,a}</primary>
1075 </indexterm>
1076 </listitem>
1077 </varlistentry>
1078
1079 <varlistentry id="libroken">
1080 <term><filename class='libraryfile'>libroken.{so,a}</filename></term>
1081 <listitem>
1082 <para>is a library containing Kerberos 5 compatibility
1083 functions.</para>
1084 <indexterm zone="heimdal libroken">
1085 <primary sortas="c-libroken">libroken.{so,a}</primary>
1086 </indexterm>
1087 </listitem>
1088 </varlistentry>
1089
1090 </variablelist>
1091
1092 </sect2>
1093
1094</sect1>
Note: See TracBrowser for help on using the repository browser.