source: postlfs/security/heimdal.xml@ d8684cbc

10.0 10.1 11.0 11.1 11.2 11.3 12.0 12.1 6.2 6.2.0 6.2.0-rc1 6.2.0-rc2 6.3 6.3-rc1 6.3-rc2 6.3-rc3 7.10 7.4 7.5 7.6 7.6-blfs 7.6-systemd 7.7 7.8 7.9 8.0 8.1 8.2 8.3 8.4 9.0 9.1 basic bdubbs/svn elogind gnome kde5-13430 kde5-14269 kde5-14686 kea ken/TL2024 ken/inkscape-core-mods ken/tuningfonts krejzi/svn lazarus lxqt nosym perl-modules plabs/newcss plabs/python-mods python3.11 qt5new rahul/power-profiles-daemon renodr/vulkan-addition systemd-11177 systemd-13485 trunk upgradedb xry111/intltool xry111/llvm18 xry111/soup3 xry111/test-20220226 xry111/xf86-video-removal
Last change on this file since d8684cbc was 6603f8b, checked in by Randy McMurchy <randy@…>, 18 years ago

Standardized the Linux-PAM package and entity names

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@5319 af4574ff-66df-0310-9fd7-8a98e5e911e0
  • Property mode set to 100644
File size: 40.0 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
3 "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY heimdal-download-http "http://ftp.vc-graz.ac.at/mirror/crypto/kerberos/heimdal/heimdal-&heimdal-version;.tar.gz">
8 <!ENTITY heimdal-download-ftp "ftp://ftp.pdc.kth.se/pub/heimdal/src/heimdal-&heimdal-version;.tar.gz">
9 <!ENTITY heimdal-md5sum "0a8097a8772d5d2de8c5539d3182b82a">
10 <!ENTITY heimdal-size "4.5 MB">
11 <!ENTITY heimdal-buildsize "91 MB">
12 <!ENTITY heimdal-time "2.4 SBU">
13]>
14
15<sect1 id="heimdal" xreflabel="Heimdal-&heimdal-version;">
16 <?dbhtml filename="heimdal.html"?>
17
18 <sect1info>
19 <othername>$LastChangedBy$</othername>
20 <date>$Date$</date>
21 </sect1info>
22
23 <title>Heimdal-&heimdal-version;</title>
24
25 <indexterm zone="heimdal">
26 <primary sortas="a-Heimdal">Heimdal</primary>
27 </indexterm>
28
29 <sect2 role="package">
30 <title>Introduction to Heimdal</title>
31
32 <para><application>Heimdal</application> is a free implementation
33 of Kerberos 5 that aims to be compatible with MIT krb5 and is
34 backward compatible with krb4. Kerberos is a network authentication
35 protocol. Basically it preserves the integrity of passwords in any
36 untrusted network (like the Internet). Kerberized applications work
37 hand-in-hand with sites that support Kerberos to ensure that passwords
38 cannot be stolen or compromised. A Kerberos installation will make changes
39 to the authentication mechanisms on your network and will overwrite several
40 programs and daemons from the <application>Coreutils</application>,
41 <application>Inetutils</application>, <application>Qpopper</application>
42 and <application>Shadow</application> packages.</para>
43
44 <bridgehead renderas="sect3">Package Information</bridgehead>
45 <itemizedlist spacing="compact">
46 <listitem>
47 <para>Download (HTTP): <ulink url="&heimdal-download-http;"/></para>
48 </listitem>
49 <listitem>
50 <para>Download (FTP): <ulink url="&heimdal-download-ftp;"/></para>
51 </listitem>
52 <listitem>
53 <para>Download MD5 sum: &heimdal-md5sum;</para>
54 </listitem>
55 <listitem>
56 <para>Download size: &heimdal-size;</para>
57 </listitem>
58 <listitem>
59 <para>Estimated disk space required: &heimdal-buildsize;</para>
60 </listitem>
61 <listitem>
62 <para>Estimated build time: &heimdal-time;</para>
63 </listitem>
64 </itemizedlist>
65
66 <bridgehead renderas="sect3">Additional Downloads</bridgehead>
67 <itemizedlist spacing='compact'>
68 <listitem>
69 <para>Required Patch: <ulink
70 url="&patch-root;/heimdal-&heimdal-version;-fhs_compliance-1.patch"/></para>
71 </listitem>
72 <listitem>
73 <para>Required patch for <application>CrackLib</application> support: <ulink
74 url="&patch-root;/heimdal-&heimdal-version;-cracklib-1.patch"/></para>
75 </listitem>
76 </itemizedlist>
77
78 <bridgehead renderas="sect3">Heimdal Dependencies</bridgehead>
79
80 <bridgehead renderas="sect4">Required to Build the Server-Side Tools</bridgehead>
81 <para><xref linkend="db"/> (recommended) or <xref linkend="gdbm"/></para>
82
83 <bridgehead renderas="sect4">Recommended</bridgehead>
84 <para><xref linkend="openssl"/></para>
85
86 <bridgehead renderas="sect4">Optional</bridgehead>
87 <para><xref linkend="linux-pam"/>,
88 <xref linkend="openldap"/>,
89 X (<xref linkend="xorg"/> or <xref linkend="xfree86"/>),
90 <xref linkend="cracklib"/> (compiled with the <filename>heimdal</filename>
91 patch) and
92 <ulink url="http://www.pdc.kth.se/kth-krb/">krb4</ulink></para>
93
94 <note>
95 <para>Some sort of time synchronization facility on your system
96 (like <xref linkend="ntp"/>) is required since Kerberos won't
97 authenticate if the time differential between a kerberized client
98 and the KDC server is more than 5 minutes.</para>
99 </note>
100
101 </sect2>
102
103 <sect2 role="installation">
104 <title>Installation of Heimdal</title>
105
106 <para>Before installing the package, you may want to preserve the
107 <command>ftp</command> program from the <application>Inetutils</application>
108 package. This is because using the <application>Heimdal</application>
109 <command>ftp</command> program to connect to non-kerberized ftp servers may
110 not work properly. It will allow you to connect (letting you know that
111 transmission of the password is clear text) but will have problems doing
112 puts and gets. Issue the following command as the
113 <systemitem class="username">root</systemitem> user.</para>
114
115<screen role="root"><userinput>mv -v /usr/bin/ftp /usr/bin/ftpn</userinput></screen>
116
117 <para>If you wish the <application>Heimdal</application> package to
118 link against the <application>CrackLib</application> library (requires
119 <xref linkend="cracklib"/> installed with the <filename>heimdal</filename>
120 patch), you must apply a patch:</para>
121
122<screen><userinput>patch -Np1 -i ../heimdal-&heimdal-version;-cracklib-1.patch</userinput></screen>
123
124 <para>Install <application>Heimdal</application> by running the following
125 commands:</para>
126
127<screen><userinput>patch -Np1 -i ../heimdal-&heimdal-version;-fhs_compliance-1.patch &amp;&amp;
128./configure --prefix=/usr \
129 --sysconfdir=/etc/heimdal \
130 --libexecdir=/usr/sbin \
131 --datadir=/var/lib/heimdal \
132 --localstatedir=/var/lib/heimdal \
133 --enable-shared \
134 --with-readline=/usr &amp;&amp;
135make</userinput></screen>
136
137 <para>To test the results, issue: <command>make check</command>.</para>
138
139 <para>Now, as the <systemitem class="username">root</systemitem> user:</para>
140
141<screen role="root"><userinput>mv -v /usr/include/fnmatch.h /usr/include/fnmatch.h.glibc &amp;&amp;
142mv -v /usr/include/glob.h /usr/include/glob.h.glibc &amp;&amp;
143mv -v /usr/include/ss/ss.h /usr/include/ss/ss.h.e2fsprogs &amp;&amp;
144mv -v /usr/lib/libss.a /usr/lib/libss.a.e2fsprogs &amp;&amp;
145mv -v /usr/lib/libss.so /usr/lib/libss.so.e2fsprogs &amp;&amp;
146make install &amp;&amp;
147mv -v /usr/include/fnmatch.h /usr/include/fnmatch.h.heimdal &amp;&amp;
148mv -v /usr/include/fnmatch.h.glibc /usr/include/fnmatch.h &amp;&amp;
149mv -v /usr/include/glob.h /usr/include/glob.h.heimdal &amp;&amp;
150mv -v /usr/include/glob.h.glibc /usr/include/glob.h &amp;&amp;
151install -v -m755 -d /usr/share/doc/heimdal-&heimdal-version;/standardisation &amp;&amp;
152install -v -m644 doc/{init-creds,layman.asc} \
153 /usr/share/doc/heimdal-&heimdal-version; &amp;&amp;
154install -v -m644 doc/standardisation/* \
155 /usr/share/doc/heimdal-&heimdal-version;/standardisation &amp;&amp;
156mv -v /bin/login /bin/login.shadow &amp;&amp;
157mv -v /bin/su /bin/su.shadow &amp;&amp;
158mv -v /usr/bin/{login,su} /bin &amp;&amp;
159ln -v -sf ../../bin/login /usr/bin &amp;&amp;
160mv -v /usr/lib/lib{otp,kafs,krb5,asn1,roken,crypto}.so.* \
161 /usr/lib/libdb-4.3.so /lib &amp;&amp;
162ln -v -sf ../../lib/libdb-4.3.so /usr/lib/libdb.so &amp;&amp;
163ln -v -sf ../../lib/libdb-4.3.so /usr/lib/libdb-4.so &amp;&amp;
164for SYMLINK in otp.so.0.1.3 kafs.so.0.4.1 krb5.so.17.4.0 \
165 asn1.so.6.1.0 roken.so.16.1.0 crypto.so.0.9.7
166do
167 ln -v -sf ../../lib/lib$SYMLINK \
168 /usr/lib/lib`echo $SYMLINK | cut -d. -f1`.so
169done
170ldconfig</userinput></screen>
171
172 </sect2>
173
174 <sect2 role="commands">
175 <title>Command Explanations</title>
176
177 <para><command>mv -v /usr/include/...</command> and
178 <command>mv -v /usr/lib/libss.*</command>: The
179 <application>Heimdal</application> installation will overwrite two
180 interface headers from the <application>Glibc</application> package and an
181 interface header, static library and library symbolic link from the
182 <application>E2fsprogs</application> package. These commands move the
183 original files out of the way before the installation, and then restore
184 the original <application>Glibc</application> headers after the
185 installation. The two <application>Heimdal</application> headers are renamed
186 and preserved on the system. Testing has shown that the system is stable
187 using the <application>Heimdal</application> version of the
188 <filename>libss</filename> library and interface header.</para>
189
190 <para><parameter>--libexecdir=/usr/sbin</parameter>: This switch
191 puts the daemon programs into
192 <filename class="directory">/usr/sbin</filename>.</para>
193
194 <tip>
195 <para>If you want to preserve all your existing
196 <application>Inetutils</application> package daemons, install the
197 <application>Heimdal</application> daemons into
198 <filename class="directory">/usr/sbin/heimdal</filename> (or wherever
199 you want). Since these programs will be called from
200 <command>(x)inetd</command> or <filename>rc</filename> scripts, it
201 really doesn't matter where they are installed, as long as they are
202 correctly specified in the <filename>/etc/(x)inetd.conf</filename> file
203 and <filename>rc</filename> scripts. If you choose something other than
204 <filename class="directory">/usr/sbin</filename>, you may want to move
205 some of the user programs (such as <command>kadmin</command>) to
206 <filename class="directory">/usr/sbin</filename> manually so they'll be
207 in the privileged user's default <envar>PATH</envar>.</para>
208 </tip>
209
210 <para><command>mv ... .shadow; mv ... /bin; ln -v -sf ../../bin...</command>:
211 The <command>login</command> and <command>su</command> programs installed by
212 <application>Heimdal</application> belong in the
213 <filename class="directory">/bin</filename> directory. The
214 <command>login</command> program is symlinked because
215 <application>Heimdal</application> is expecting to find it in
216 <filename class="directory">/usr/bin</filename>. The old executables are
217 preserved before the move to keep things sane should breaks occur.</para>
218
219 <para><command>mv ... /lib; ln -v -sf ../../lib/lib... /usr/lib...</command>:
220 The <command>login</command> and <command>su</command> programs installed
221 by <application>Heimdal</application> link against
222 <application>Heimdal</application> libraries as well as libraries provided
223 by the <application>OpenSSL</application> and
224 <application>Berkeley DB</application> packages. These
225 libraries are moved to <filename class="directory">/lib</filename> to be
226 FHS compliant and also in case
227 <filename class="directory">/usr</filename> is located on a separate
228 partition which may not always be mounted.</para>
229
230 </sect2>
231
232 <sect2 role="configuration">
233 <title>Configuring Heimdal</title>
234
235 <sect3 id="heimdal-config">
236 <title>Config Files</title>
237
238 <para><filename>/etc/heimdal/*</filename></para>
239
240 <indexterm zone="heimdal heimdal-config">
241 <primary sortas="e-etc-heimdal">/etc/heimdal/*</primary>
242 </indexterm>
243
244 </sect3>
245
246 <sect3>
247 <title>Configuration Information</title>
248
249 <note>
250 <para>All the configuration steps shown below must be accomplished
251 by the <systemitem class='username'>root</systemitem> user unless
252 otherwise noted.</para>
253 </note>
254
255 <sect4>
256 <title>Master KDC Server Configuration</title>
257
258 <para>Create the Kerberos configuration file with the
259 following commands:</para>
260
261<screen role="root"><userinput>install -v -m755 -d /etc/heimdal &amp;&amp;
262cat &gt; /etc/heimdal/krb5.conf &lt;&lt; "EOF"
263<literal># Begin /etc/heimdal/krb5.conf
264
265[libdefaults]
266 default_realm = <replaceable>[EXAMPLE.COM]</replaceable>
267 encrypt = true
268
269[realms]
270 <replaceable>[EXAMPLE.COM]</replaceable> = {
271 kdc = <replaceable>[hostname.example.com]</replaceable>
272 admin_server = <replaceable>[hostname.example.com]</replaceable>
273 kpasswd_server = <replaceable>[hostname.example.com]</replaceable>
274 }
275
276[domain_realm]
277 .<replaceable>[example.com]</replaceable> = <replaceable>[EXAMPLE.COM]</replaceable>
278
279[logging]
280 kdc = FILE:/var/log/kdc.log
281 admin_server = FILE:/var/log/kadmin.log
282 default = FILE:/var/log/krb.log
283
284# End /etc/heimdal/krb5.conf</literal>
285EOF
286chmod -v 644 /etc/heimdal/krb5.conf</userinput></screen>
287
288 <para>You will need to substitute your domain and proper hostname
289 for the occurrences of the <replaceable>[hostname]</replaceable>
290 and <replaceable>[EXAMPLE.COM]</replaceable> names.</para>
291
292 <para><option>default_realm</option> should be the name of your
293 domain changed to ALL CAPS. This isn't required, but both
294 <application>Heimdal</application> and <application>MIT
295 krb5</application> recommend it.</para>
296
297 <para><option>encrypt = true</option> provides encryption of all
298 traffic between kerberized clients and servers. It's not necessary
299 and can be left off. If you leave it off, you can encrypt all traffic
300 from the client to the server using a switch on the client program
301 instead.</para>
302
303 <para>The <option>[realms]</option> parameters tell the client
304 programs where to look for the KDC authentication services.</para>
305
306 <para>The <option>[domain_realm]</option> section maps a domain
307 to a realm.</para>
308
309 <para>Store the master password in a key file using the following
310 commands:</para>
311
312<screen role="root"><userinput>install -v -m755 -d /var/lib/heimdal &amp;&amp;
313kstash</userinput></screen>
314
315 <para>Create the KDC database:</para>
316
317<screen role="root"><userinput>kadmin -l</userinput></screen>
318
319 <para>The commands below will prompt you for information about the
320 principles. Choose the defaults for now unless you know what you are
321 doing and need to specify different values. You can go in later and
322 change the defaults, should you feel the need. You may use the up and
323 down arrow keys to use the history feature of <command>kadmin</command>
324 in a similar manner as the <command>bash</command> history
325 feature.</para>
326
327 <para>At the <prompt>kadmin&gt;</prompt> prompt, issue the following
328 statement:</para>
329
330<screen role="root"><userinput>init <replaceable>[EXAMPLE.COM]</replaceable></userinput></screen>
331
332 <para>The database must now be populated with at least one principle
333 (user). For now, just use your regular login name or root. You may
334 create as few, or as many principles as you wish using the following
335 statement:</para>
336
337<screen role="root"><userinput>add <replaceable>[loginname]</replaceable></userinput></screen>
338
339 <para>The KDC server and any machine running kerberized
340 server daemons must have a host key installed:</para>
341
342<screen role="root"><userinput>add --random-key host/<replaceable>[hostname.example.com]</replaceable></userinput></screen>
343
344 <para>After choosing the defaults when prompted, you will have to
345 export the data to a keytab file:</para>
346
347<screen role="root"><userinput>ext host/<replaceable>[hostname.example.com]</replaceable></userinput></screen>
348
349 <para>This should have created two files in
350 <filename class="directory">/etc/heimdal</filename>:
351 <filename>krb5.keytab</filename> (Kerberos 5) and
352 <filename>srvtab</filename> (Kerberos 4). Both files should have 600
353 (root rw only) permissions. Keeping the keytab files from public access
354 is crucial to the overall security of the Kerberos installation.</para>
355
356 <para>Eventually, you'll want to add server daemon principles to the
357 database and extract them to the keytab file. You do this in the same
358 way you created the host principles. Below is an example:</para>
359
360<screen role="root"><userinput>add --random-key ftp/<replaceable>[hostname.example.com]</replaceable></userinput></screen>
361
362 <para>(choose the defaults)</para>
363
364<screen role="root"><userinput>ext ftp/<replaceable>[hostname.example.com]</replaceable></userinput></screen>
365
366 <para>Exit the <command>kadmin</command> program (use
367 <command>quit</command> or <command>exit</command>) and return back
368 to the shell prompt. Start the KDC daemon manually, just to test out
369 the installation:</para>
370
371<screen role="root"><userinput>/usr/sbin/kdc &amp;</userinput></screen>
372
373 <para>Attempt to get a TGT (ticket granting ticket) with
374 the following command:</para>
375
376<screen><userinput>kinit <replaceable>[loginname]</replaceable></userinput></screen>
377
378 <para>You will be prompted for the password you created. After you get
379 your ticket, you should list it with the following command:</para>
380
381<screen><userinput>klist</userinput></screen>
382
383 <para>Information about the ticket should be displayed on
384 the screen.</para>
385
386 <para>To test the functionality of the <filename>keytab</filename> file,
387 issue the following command:</para>
388
389<screen><userinput>ktutil list</userinput></screen>
390
391 <para>This should dump a list of the host principals, along with the
392 encryption methods used to access the principals.</para>
393
394 <para>At this point, if everything has been successful so far, you
395 can feel fairly confident in the installation, setup and configuration
396 of your new <application>Heimdal</application> Kerberos 5
397 installation.</para>
398
399 <para id="heimdal-init">Install the
400 <filename>/etc/rc.d/init.d/heimdal</filename> init script included
401 in the <xref linkend="intro-important-bootscripts"/> package:</para>
402
403 <indexterm zone="heimdal heimdal-init">
404 <primary sortas="f-heimdal">heimdal</primary>
405 </indexterm>
406
407<screen role="root"><userinput>make install-heimdal</userinput></screen>
408
409 </sect4>
410
411 <sect4>
412 <title>Using Kerberized Client Programs</title>
413
414 <para>To use the kerberized client programs (<command>telnet</command>,
415 <command>ftp</command>, <command>rsh</command>,
416 <command>rxterm</command>, <command>rxtelnet</command>,
417 <command>rcp</command>, <command>xnlock</command>), you first must get
418 a TGT. Use the <command>kinit</command> program to get the ticket.
419 After you've acquired the ticket, you can use the kerberized programs
420 to connect to any kerberized server on the network. You will not be
421 prompted for authentication until your ticket expires (default is one
422 day), unless you specify a different user as a command line argument
423 to the program.</para>
424
425 <para>The kerberized programs will connect to non-kerberized daemons,
426 warning you that authentication is not encrypted. As mentioned earlier,
427 only the <command>ftp</command> program gives any trouble connecting to
428 non-kerberized daemons.</para>
429
430 <para>In order to use the <application>Heimdal</application>
431 <application>X</application> programs, you'll need to add a service
432 port entry to the <filename>/etc/services</filename> file for the
433 <command>kxd</command> server. There is no 'standardized port number'
434 for the 'kx' service in the IANA database, so you'll have to pick an
435 unused port number. Add an entry to the <filename>services</filename>
436 file similar to the entry below (substitute your chosen port number
437 for <replaceable>[49150]</replaceable>):</para>
438
439<screen><literal>kx <replaceable>[49150]</replaceable>/tcp # Heimdal kerberos X
440kx <replaceable>[49150]</replaceable>/udp # Heimdal kerberos X</literal></screen>
441
442 <para>For additional information consult <ulink
443 url="&hints-root;/downloads/files/heimdal.txt">the
444 Heimdal hint</ulink> on which the above instructions are based.</para>
445
446 </sect4>
447
448 </sect3>
449
450 </sect2>
451
452 <sect2 role="content">
453 <title>Contents</title>
454
455 <segmentedlist>
456 <segtitle>Installed Programs</segtitle>
457 <segtitle>Installed Libraries</segtitle>
458 <segtitle>Installed Directories</segtitle>
459
460 <seglistitem>
461 <seg>afslog, dump_log, ftp, ftpd, hprop, hpropd, ipropd-master,
462 ipropd-slave, kadmin, kadmind, kauth, kcm, kdc, kdestroy, kf, kfd,
463 kgetcred, kinit, klist, kpasswd, kpasswdd, krb5-config, kstash,
464 ktutil, kx, kxd, login, mk_cmds, otp, otpprint, pagsh, pfrom, popper,
465 push, rcp, replay_log, rsh, rshd, rxtelnet, rxterm, string2key, su,
466 telnet, telnetd, tenletxr, truncate-log, verify_krb5_conf
467 and xnlock</seg>
468 <seg>libasn1.[so,a], libeditline.[so,a], libgssapi.[so,a],
469 libhdb.[so,a], libkadm5clnt.[so,a], libkadm5srv.[so,a], libkafs.[so,a],
470 libkrb5.[so,a], libotp.[so,a], libroken.[so,a], libsl.[so,a]
471 and libss.[so,a]</seg>
472 <seg>/etc/heimdal, /usr/include/kadm5,
473 /usr/share/doc/heimdal-&heimdal-version; and /var/lib/heimdal</seg>
474 </seglistitem>
475 </segmentedlist>
476
477 <variablelist>
478 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
479 <?dbfo list-presentation="list"?>
480 <?dbhtml list-presentation="table"?>
481
482 <varlistentry id="afslog">
483 <term><command>afslog</command></term>
484 <listitem>
485 <para>obtains AFS tokens for a number of cells.</para>
486 <indexterm zone="heimdal afslog">
487 <primary sortas="b-afslog">afslog</primary>
488 </indexterm>
489 </listitem>
490 </varlistentry>
491
492 <varlistentry id="ftp">
493 <term><command>ftp</command></term>
494 <listitem>
495 <para>is a kerberized FTP client.</para>
496 <indexterm zone="heimdal ftp">
497 <primary sortas="b-ftp">ftp</primary>
498 </indexterm>
499 </listitem>
500 </varlistentry>
501
502 <varlistentry id="ftpd">
503 <term><command>ftpd</command></term>
504 <listitem>
505 <para>is a kerberized FTP daemon.</para>
506 <indexterm zone="heimdal ftpd">
507 <primary sortas="b-ftpd">ftpd</primary>
508 </indexterm>
509 </listitem>
510 </varlistentry>
511
512 <varlistentry id="hprop">
513 <term><command>hprop</command></term>
514 <listitem>
515 <para> takes a principal database in a specified format and converts
516 it into a stream of <application>Heimdal</application> database
517 records.</para>
518 <indexterm zone="heimdal hprop">
519 <primary sortas="b-hprop">hprop</primary>
520 </indexterm>
521 </listitem>
522 </varlistentry>
523
524 <varlistentry id="hpropd">
525 <term><command>hpropd</command></term>
526 <listitem>
527 <para>is a server that receives a database sent by
528 <command>hprop</command> and writes it as a local database.</para>
529 <indexterm zone="heimdal hpropd">
530 <primary sortas="b-hpropd">hpropd</primary>
531 </indexterm>
532 </listitem>
533 </varlistentry>
534
535 <varlistentry id="ipropd-master">
536 <term><command>ipropd-master</command></term>
537 <listitem>
538 <para>is a daemon which runs on the master KDC
539 server which incrementally propagates changes to the KDC
540 database to the slave KDC servers.</para>
541 <indexterm zone="heimdal ipropd-master">
542 <primary sortas="b-ipropd-master">ipropd-master</primary>
543 </indexterm>
544 </listitem>
545 </varlistentry>
546
547 <varlistentry id="ipropd-slave">
548 <term><command>ipropd-slave</command></term>
549 <listitem>
550 <para>is a daemon which runs on the slave KDC
551 servers which incrementally propagates changes to the KDC
552 database from the master KDC server.</para>
553 <indexterm zone="heimdal ipropd-slave">
554 <primary sortas="b-ipropd-slave">ipropd-slave</primary>
555 </indexterm>
556 </listitem>
557 </varlistentry>
558
559 <varlistentry id="kadmin">
560 <term><command>kadmin</command></term>
561 <listitem>
562 <para>is a utility used to make modifications to the Kerberos
563 database.</para>
564 <indexterm zone="heimdal kadmin">
565 <primary sortas="b-kadmin">kadmin</primary>
566 </indexterm>
567 </listitem>
568 </varlistentry>
569
570 <varlistentry id="kadmind">
571 <term><command>kadmind</command></term>
572 <listitem>
573 <para>is a server for administrative access to the Kerberos
574 database.</para>
575 <indexterm zone="heimdal kadmind">
576 <primary sortas="b-kadmind">kadmind</primary>
577 </indexterm>
578 </listitem>
579 </varlistentry>
580
581 <varlistentry id="kauth">
582 <term><command>kauth</command></term>
583 <listitem>
584 <para>is a symbolic link to the <command>kinit</command>
585 program.</para>
586 <indexterm zone="heimdal kauth">
587 <primary sortas="g-kauth">kauth</primary>
588 </indexterm>
589 </listitem>
590 </varlistentry>
591
592 <varlistentry id="kcm">
593 <term><command>kcm</command></term>
594 <listitem>
595 <para>is a process based credential cache for Kerberos
596 tickets.</para>
597 <indexterm zone="heimdal kcm">
598 <primary sortas="b-kcm">kcm</primary>
599 </indexterm>
600 </listitem>
601 </varlistentry>
602
603 <varlistentry id="kdc">
604 <term><command>kdc</command></term>
605 <listitem>
606 <para>is a Kerberos 5 server.</para>
607 <indexterm zone="heimdal kdc">
608 <primary sortas="b-kdc">kdc</primary>
609 </indexterm>
610 </listitem>
611 </varlistentry>
612
613 <varlistentry id="kdestroy">
614 <term><command>kdestroy</command></term>
615 <listitem>
616 <para>removes a principle's current set of tickets.</para>
617 <indexterm zone="heimdal kdestroy">
618 <primary sortas="b-kdestroy">kdestroy</primary>
619 </indexterm>
620 </listitem>
621 </varlistentry>
622
623 <varlistentry id="kf">
624 <term><command>kf</command></term>
625 <listitem>
626 <para>is a program which forwards tickets to a remote host through
627 an authenticated and encrypted stream.</para>
628 <indexterm zone="heimdal kf">
629 <primary sortas="b-kf">kf</primary>
630 </indexterm>
631 </listitem>
632 </varlistentry>
633
634 <varlistentry id="kfd">
635 <term><command>kfd</command></term>
636 <listitem>
637 <para>is a server used to receive forwarded tickets.</para>
638 <indexterm zone="heimdal kfd">
639 <primary sortas="b-kfd">kfd</primary>
640 </indexterm>
641 </listitem>
642 </varlistentry>
643
644 <varlistentry id="kgetcred">
645 <term><command>kgetcred</command></term>
646 <listitem>
647 <para>obtains a ticket for a service.</para>
648 <indexterm zone="heimdal kgetcred">
649 <primary sortas="b-kgetcred">kgetcred</primary>
650 </indexterm>
651 </listitem>
652 </varlistentry>
653
654 <varlistentry id="kinit">
655 <term><command>kinit</command></term>
656 <listitem>
657 <para>is used to authenticate to the Kerberos server as a principal
658 and acquire a ticket granting ticket that can later be used to obtain
659 tickets for other services.</para>
660 <indexterm zone="heimdal kinit">
661 <primary sortas="b-kinit">kinit</primary>
662 </indexterm>
663 </listitem>
664 </varlistentry>
665
666 <varlistentry id="klist">
667 <term><command>klist</command></term>
668 <listitem>
669 <para>reads and displays the current tickets in the credential
670 cache.</para>
671 <indexterm zone="heimdal klist">
672 <primary sortas="b-klist">klist</primary>
673 </indexterm>
674 </listitem>
675 </varlistentry>
676
677 <varlistentry id="kpasswd">
678 <term><command>kpasswd</command></term>
679 <listitem>
680 <para>is a program for changing Kerberos 5 passwords.</para>
681 <indexterm zone="heimdal kpasswd">
682 <primary sortas="b-kpasswd">kpasswd</primary>
683 </indexterm>
684 </listitem>
685 </varlistentry>
686
687 <varlistentry id="kpasswdd">
688 <term><command>kpasswdd</command></term>
689 <listitem>
690 <para>is a Kerberos 5 password changing server.</para>
691 <indexterm zone="heimdal kpasswdd">
692 <primary sortas="b-kpasswdd">kpasswdd</primary>
693 </indexterm>
694 </listitem>
695 </varlistentry>
696
697 <varlistentry id="krb5-config-prog">
698 <term><command>krb5-config</command></term>
699 <listitem>
700 <para>gives information on how to link programs against
701 <application>Heimdal</application> libraries.</para>
702 <indexterm zone="heimdal krb5-config-prog">
703 <primary sortas="b-krb5-config">krb5-config</primary>
704 </indexterm>
705 </listitem>
706 </varlistentry>
707
708 <varlistentry id="kstash">
709 <term><command>kstash</command></term>
710 <listitem>
711 <para>stores the KDC master password in a file.</para>
712 <indexterm zone="heimdal kstash">
713 <primary sortas="b-kstash">kstash</primary>
714 </indexterm>
715 </listitem>
716 </varlistentry>
717
718 <varlistentry id="ktutil">
719 <term><command>ktutil</command></term>
720 <listitem>
721 <para>is a program for managing Kerberos keytabs.</para>
722 <indexterm zone="heimdal ktutil">
723 <primary sortas="b-ktutil">ktutil</primary>
724 </indexterm>
725 </listitem>
726 </varlistentry>
727
728 <varlistentry id="kx">
729 <term><command>kx</command></term>
730 <listitem>
731 <para>is a program which securely forwards
732 <application>X</application> connections.</para>
733 <indexterm zone="heimdal kx">
734 <primary sortas="b-kx">kx</primary>
735 </indexterm>
736 </listitem>
737 </varlistentry>
738
739 <varlistentry id="kxd">
740 <term><command>kxd</command></term>
741 <listitem>
742 <para>is the daemon for <command>kx</command>.</para>
743 <indexterm zone="heimdal kxd">
744 <primary sortas="b-kxd">kxd</primary>
745 </indexterm>
746 </listitem>
747 </varlistentry>
748
749 <varlistentry id="login">
750 <term><command>login</command></term>
751 <listitem>
752 <para>is a kerberized login program.</para>
753 <indexterm zone="heimdal login">
754 <primary sortas="b-login">login</primary>
755 </indexterm>
756 </listitem>
757 </varlistentry>
758
759 <varlistentry id="otp">
760 <term><command>otp</command></term>
761 <listitem>
762 <para>manages one-time passwords.</para>
763 <indexterm zone="heimdal otp">
764 <primary sortas="b-otp">otp</primary>
765 </indexterm>
766 </listitem>
767 </varlistentry>
768
769 <varlistentry id="otpprint">
770 <term><command>otpprint</command></term>
771 <listitem>
772 <para>prints lists of one-time passwords.</para>
773 <indexterm zone="heimdal otpprint">
774 <primary sortas="b-otpprint">otpprint</primary>
775 </indexterm>
776 </listitem>
777 </varlistentry>
778
779 <varlistentry id="pfrom">
780 <term><command>pfrom</command></term>
781 <listitem>
782 <para>is a script that runs <command>push --from</command>.</para>
783 <indexterm zone="heimdal pfrom">
784 <primary sortas="b-pfrom">pfrom</primary>
785 </indexterm>
786 </listitem>
787 </varlistentry>
788
789 <varlistentry id="popper">
790 <term><command>popper</command></term>
791 <listitem>
792 <para>is a kerberized POP-3 server.</para>
793 <indexterm zone="heimdal popper">
794 <primary sortas="b-popper">popper</primary>
795 </indexterm>
796 </listitem>
797 </varlistentry>
798
799 <varlistentry id="push">
800 <term><command>push</command></term>
801 <listitem>
802 <para>is a kerberized POP mail retrieval client.</para>
803 <indexterm zone="heimdal push">
804 <primary sortas="b-push">push</primary>
805 </indexterm>
806 </listitem>
807 </varlistentry>
808
809 <varlistentry id="rcp">
810 <term><command>rcp</command></term>
811 <listitem>
812 <para>is a kerberized rcp client program.</para>
813 <indexterm zone="heimdal rcp">
814 <primary sortas="b-rcp">rcp</primary>
815 </indexterm>
816 </listitem>
817 </varlistentry>
818
819 <varlistentry id="rsh">
820 <term><command>rsh</command></term>
821 <listitem>
822 <para>is a kerberized rsh client program.</para>
823 <indexterm zone="heimdal rsh">
824 <primary sortas="b-rsh">rsh</primary>
825 </indexterm>
826 </listitem>
827 </varlistentry>
828
829 <varlistentry id="rshd">
830 <term><command>rshd</command></term>
831 <listitem>
832 <para>is a kerberized rsh server.</para>
833 <indexterm zone="heimdal rshd">
834 <primary sortas="b-rshd">rshd</primary>
835 </indexterm>
836 </listitem>
837 </varlistentry>
838
839 <varlistentry id="rxtelnet">
840 <term><command>rxtelnet</command></term>
841 <listitem>
842 <para>starts a secure <command>xterm</command> window with a
843 <command>telnet</command> to a given host and forwards
844 <application>X</application> connections.</para>
845 <indexterm zone="heimdal rxtelnet">
846 <primary sortas="b-rxtelnet">rxtelnet</primary>
847 </indexterm>
848 </listitem>
849 </varlistentry>
850
851 <varlistentry id="rxterm">
852 <term><command>rxterm</command></term>
853 <listitem>
854 <para>starts a secure remote <command>xterm</command>.</para>
855 <indexterm zone="heimdal rxterm">
856 <primary sortas="b-rxterm">rxterm</primary>
857 </indexterm>
858 </listitem>
859 </varlistentry>
860
861 <varlistentry id="string2key">
862 <term><command>string2key</command></term>
863 <listitem>
864 <para>maps a password into a key.</para>
865 <indexterm zone="heimdal string2key">
866 <primary sortas="b-string2key">string2key</primary>
867 </indexterm>
868 </listitem>
869 </varlistentry>
870
871 <varlistentry id="su">
872 <term><command>su</command></term>
873 <listitem>
874 <para>is a kerberized su client program.</para>
875 <indexterm zone="heimdal su">
876 <primary sortas="b-su">su</primary>
877 </indexterm>
878 </listitem>
879 </varlistentry>
880
881 <varlistentry id="telnet">
882 <term><command>telnet</command></term>
883 <listitem>
884 <para>is a kerberized telnet client program.</para>
885 <indexterm zone="heimdal telnet">
886 <primary sortas="b-telnet">telnet</primary>
887 </indexterm>
888 </listitem>
889 </varlistentry>
890
891 <varlistentry id="telnetd">
892 <term><command>telnetd</command></term>
893 <listitem>
894 <para>is a kerberized telnet server.</para>
895 <indexterm zone="heimdal telnetd">
896 <primary sortas="b-telnetd">telnetd</primary>
897 </indexterm>
898 </listitem>
899 </varlistentry>
900
901 <varlistentry id="tenletxr">
902 <term><command>tenletxr</command></term>
903 <listitem>
904 <para>forwards <application>X</application> connections
905 backwards.</para>
906 <indexterm zone="heimdal tenletxr">
907 <primary sortas="b-tenletxr">tenletxr</primary>
908 </indexterm>
909 </listitem>
910 </varlistentry>
911
912 <varlistentry id="verify_krb5_conf">
913 <term><command>verify_krb5_conf</command></term>
914 <listitem>
915 <para>checks <filename>krb5.conf</filename> file for obvious
916 errors.</para>
917 <indexterm zone="heimdal verify_krb5_conf">
918 <primary sortas="b-verify_krb5_conf">verify_krb5_conf</primary>
919 </indexterm>
920 </listitem>
921 </varlistentry>
922
923 <varlistentry id="xnlock">
924 <term><command>xnlock</command></term>
925 <listitem>
926 <para>is a program that acts as a secure screen saver for
927 workstations running <application>X</application>.</para>
928 <indexterm zone="heimdal xnlock">
929 <primary sortas="b-xnlock">xnlock</primary>
930 </indexterm>
931 </listitem>
932 </varlistentry>
933
934 <varlistentry id="libasn1">
935 <term><filename class='libraryfile'>libasn1.[so,a]</filename></term>
936 <listitem>
937 <para>provides the ASN.1 and DER functions to encode and decode
938 the Kerberos TGTs.</para>
939 <indexterm zone="heimdal libasn1">
940 <primary sortas="c-libasn1">libasn1.[so,a]</primary>
941 </indexterm>
942 </listitem>
943 </varlistentry>
944
945 <varlistentry id="libeditline">
946 <term><filename class='libraryfile'>libeditline.a</filename></term>
947 <listitem>
948 <para>is a command-line editing library with history.</para>
949 <indexterm zone="heimdal libeditline">
950 <primary sortas="c-libeditline">libeditline.a</primary>
951 </indexterm>
952 </listitem>
953 </varlistentry>
954
955 <varlistentry id="libgssapi">
956 <term><filename class='libraryfile'>libgssapi.[so,a]</filename></term>
957 <listitem>
958 <para>contain the Generic Security Service Application Programming
959 Interface (GSSAPI) functions which provides security
960 services to callers in a generic fashion, supportable with a range of
961 underlying mechanisms and technologies and hence allowing source-level
962 portability of applications to different environments.</para>
963 <indexterm zone="heimdal libgssapi">
964 <primary sortas="c-libgssapi">libgssapi.[so,a]</primary>
965 </indexterm>
966 </listitem>
967 </varlistentry>
968
969 <varlistentry id="libhdb">
970 <term><filename class='libraryfile'>libhdb.[so,a]</filename></term>
971 <listitem>
972 <para>is a <application>Heimdal</application> Kerberos 5
973 authentication/authorization database access library.</para>
974 <indexterm zone="heimdal libhdb">
975 <primary sortas="c-libhdb">libhdb.[so,a]</primary>
976 </indexterm>
977 </listitem>
978 </varlistentry>
979
980 <varlistentry id="libkadm5clnt">
981 <term><filename class='libraryfile'>libkadm5clnt.[so,a]</filename></term>
982 <listitem>
983 <para>contains the administrative authentication and password
984 checking functions required by Kerberos 5 client-side programs.</para>
985 <indexterm zone="heimdal libkadm5clnt">
986 <primary sortas="c-libkadm5clnt">libkadm5clnt.[so,a]</primary>
987 </indexterm>
988 </listitem>
989 </varlistentry>
990
991 <varlistentry id="libkadm5srv">
992 <term><filename class='libraryfile'>libkadm5srv.[so,a]</filename></term>
993 <listitem>
994 <para>contain the administrative authentication and password
995 checking functions required by Kerberos 5 servers.</para>
996 <indexterm zone="heimdal libkadm5srv">
997 <primary sortas="c-libkadm5srv">libkadm5srv.[so,a]</primary>
998 </indexterm>
999 </listitem>
1000 </varlistentry>
1001
1002 <varlistentry id="libkafs">
1003 <term><filename class='libraryfile'>libkafs.[so,a]</filename></term>
1004 <listitem>
1005 <para>contains the functions required to authenticated to AFS.</para>
1006 <indexterm zone="heimdal libkafs">
1007 <primary sortas="c-libkafs">libkafs.[so,a]</primary>
1008 </indexterm>
1009 </listitem>
1010 </varlistentry>
1011
1012 <varlistentry id="libkrb5">
1013 <term><filename class='libraryfile'>libkrb5.[so,a]</filename></term>
1014 <listitem>
1015 <para>is an all-purpose Kerberos 5 library.</para>
1016 <indexterm zone="heimdal libkrb5">
1017 <primary sortas="c-libkrb5">libkrb5.[so,a]</primary>
1018 </indexterm>
1019 </listitem>
1020 </varlistentry>
1021
1022 <varlistentry id="libotp">
1023 <term><filename class='libraryfile'>libotp.[so,a]</filename></term>
1024 <listitem>
1025 <para>contains the functions required to handle authenticating
1026 one time passwords.</para>
1027 <indexterm zone="heimdal libotp">
1028 <primary sortas="c-libotp">libotp.[so,a]</primary>
1029 </indexterm>
1030 </listitem>
1031 </varlistentry>
1032
1033 <varlistentry id="libroken">
1034 <term><filename class='libraryfile'>libroken.[so,a]</filename></term>
1035 <listitem>
1036 <para>is a library containing Kerberos 5 compatibility
1037 functions.</para>
1038 <indexterm zone="heimdal libroken">
1039 <primary sortas="c-libroken">libroken.[so,a]</primary>
1040 </indexterm>
1041 </listitem>
1042 </varlistentry>
1043
1044 </variablelist>
1045
1046 </sect2>
1047
1048</sect1>
Note: See TracBrowser for help on using the repository browser.