source: postlfs/security/heimdal.xml@ f27505a

10.0 10.1 11.0 11.1 11.2 11.3 12.0 12.1 6.2 6.2.0 6.2.0-rc1 6.2.0-rc2 6.3 6.3-rc1 6.3-rc2 6.3-rc3 7.10 7.4 7.5 7.6 7.6-blfs 7.6-systemd 7.7 7.8 7.9 8.0 8.1 8.2 8.3 8.4 9.0 9.1 basic bdubbs/svn elogind gnome kde5-13430 kde5-14269 kde5-14686 kea ken/TL2024 ken/inkscape-core-mods ken/tuningfonts krejzi/svn lazarus lxqt nosym perl-modules plabs/newcss plabs/python-mods python3.11 qt5new rahul/power-profiles-daemon renodr/vulkan-addition systemd-11177 systemd-13485 trunk upgradedb xry111/intltool xry111/llvm18 xry111/soup3 xry111/test-20220226 xry111/xf86-video-removal
Last change on this file since f27505a was 9084c2eb, checked in by Manuel Canales Esparcia <manuel@…>, 18 years ago

Typo fix. Postlfs.

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@5383 af4574ff-66df-0310-9fd7-8a98e5e911e0
  • Property mode set to 100644
File size: 40.2 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
3 "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY heimdal-download-http "http://ftp.vc-graz.ac.at/mirror/crypto/kerberos/heimdal/heimdal-&heimdal-version;.tar.gz">
8 <!ENTITY heimdal-download-ftp "ftp://ftp.pdc.kth.se/pub/heimdal/src/heimdal-&heimdal-version;.tar.gz">
9 <!ENTITY heimdal-md5sum "0a8097a8772d5d2de8c5539d3182b82a">
10 <!ENTITY heimdal-size "4.5 MB">
11 <!ENTITY heimdal-buildsize "91 MB">
12 <!ENTITY heimdal-time "2.4 SBU">
13]>
14
15<sect1 id="heimdal" xreflabel="Heimdal-&heimdal-version;">
16 <?dbhtml filename="heimdal.html"?>
17
18 <sect1info>
19 <othername>$LastChangedBy$</othername>
20 <date>$Date$</date>
21 <keywordset>
22 <keyword role="package">heimdal-&heimdal-version;.tar</keyword>
23 <keyword role="ftpdir">heimdal</keyword>
24 </keywordset>
25 </sect1info>
26
27 <title>Heimdal-&heimdal-version;</title>
28
29 <indexterm zone="heimdal">
30 <primary sortas="a-Heimdal">Heimdal</primary>
31 </indexterm>
32
33 <sect2 role="package">
34 <title>Introduction to Heimdal</title>
35
36 <para><application>Heimdal</application> is a free implementation
37 of Kerberos 5 that aims to be compatible with MIT krb5 and is
38 backward compatible with krb4. Kerberos is a network authentication
39 protocol. Basically it preserves the integrity of passwords in any
40 untrusted network (like the Internet). Kerberized applications work
41 hand-in-hand with sites that support Kerberos to ensure that passwords
42 cannot be stolen or compromised. A Kerberos installation will make changes
43 to the authentication mechanisms on your network and will overwrite several
44 programs and daemons from the <application>Coreutils</application>,
45 <application>Inetutils</application>, <application>Qpopper</application>
46 and <application>Shadow</application> packages.</para>
47
48 <bridgehead renderas="sect3">Package Information</bridgehead>
49 <itemizedlist spacing="compact">
50 <listitem>
51 <para>Download (HTTP): <ulink url="&heimdal-download-http;"/></para>
52 </listitem>
53 <listitem>
54 <para>Download (FTP): <ulink url="&heimdal-download-ftp;"/></para>
55 </listitem>
56 <listitem>
57 <para>Download MD5 sum: &heimdal-md5sum;</para>
58 </listitem>
59 <listitem>
60 <para>Download size: &heimdal-size;</para>
61 </listitem>
62 <listitem>
63 <para>Estimated disk space required: &heimdal-buildsize;</para>
64 </listitem>
65 <listitem>
66 <para>Estimated build time: &heimdal-time;</para>
67 </listitem>
68 </itemizedlist>
69
70 <bridgehead renderas="sect3">Additional Downloads</bridgehead>
71 <itemizedlist spacing='compact'>
72 <listitem>
73 <para>Required Patch: <ulink
74 url="&patch-root;/heimdal-&heimdal-version;-fhs_compliance-1.patch"/></para>
75 </listitem>
76 <listitem>
77 <para>Required patch for <application>CrackLib</application> support: <ulink
78 url="&patch-root;/heimdal-&heimdal-version;-cracklib-1.patch"/></para>
79 </listitem>
80 </itemizedlist>
81
82 <bridgehead renderas="sect3">Heimdal Dependencies</bridgehead>
83
84 <bridgehead renderas="sect4">Required to Build the Server-Side Tools</bridgehead>
85 <para role="required"><xref linkend="db"/> (recommended) or <xref linkend="gdbm"/></para>
86
87 <bridgehead renderas="sect4">Recommended</bridgehead>
88 <para role="recommended"><xref linkend="openssl"/></para>
89
90 <bridgehead renderas="sect4">Optional</bridgehead>
91 <para role="optional"><xref linkend="linux-pam"/>,
92 <xref linkend="openldap"/>,
93 X (<xref linkend="xorg"/> or <xref linkend="xfree86"/>),
94 <xref linkend="cracklib"/> (compiled with the <filename>heimdal</filename>
95 patch) and
96 <ulink url="http://www.pdc.kth.se/kth-krb/">krb4</ulink></para>
97
98 <note>
99 <para>Some sort of time synchronization facility on your system
100 (like <xref linkend="ntp"/>) is required since Kerberos won't
101 authenticate if the time differential between a kerberized client
102 and the KDC server is more than 5 minutes.</para>
103 </note>
104
105 </sect2>
106
107 <sect2 role="installation">
108 <title>Installation of Heimdal</title>
109
110 <para>Before installing the package, you may want to preserve the
111 <command>ftp</command> program from the <application>Inetutils</application>
112 package. This is because using the <application>Heimdal</application>
113 <command>ftp</command> program to connect to non-kerberized ftp servers may
114 not work properly. It will allow you to connect (letting you know that
115 transmission of the password is clear text) but will have problems doing
116 puts and gets. Issue the following command as the
117 <systemitem class="username">root</systemitem> user.</para>
118
119<screen role="root"><userinput>mv -v /usr/bin/ftp /usr/bin/ftpn</userinput></screen>
120
121 <para>If you wish the <application>Heimdal</application> package to
122 link against the <application>CrackLib</application> library (requires
123 <xref linkend="cracklib"/> installed with the <filename>heimdal</filename>
124 patch), you must apply a patch:</para>
125
126<screen><userinput>patch -Np1 -i ../heimdal-&heimdal-version;-cracklib-1.patch</userinput></screen>
127
128 <para>Install <application>Heimdal</application> by running the following
129 commands:</para>
130
131<screen><userinput>patch -Np1 -i ../heimdal-&heimdal-version;-fhs_compliance-1.patch &amp;&amp;
132./configure --prefix=/usr \
133 --sysconfdir=/etc/heimdal \
134 --libexecdir=/usr/sbin \
135 --datadir=/var/lib/heimdal \
136 --localstatedir=/var/lib/heimdal \
137 --enable-shared \
138 --with-readline=/usr &amp;&amp;
139make</userinput></screen>
140
141 <para>To test the results, issue: <command>make check</command>.</para>
142
143 <para>Now, as the <systemitem class="username">root</systemitem> user:</para>
144
145<screen role="root"><userinput>mv -v /usr/include/fnmatch.h /usr/include/fnmatch.h.glibc &amp;&amp;
146mv -v /usr/include/glob.h /usr/include/glob.h.glibc &amp;&amp;
147mv -v /usr/include/ss/ss.h /usr/include/ss/ss.h.e2fsprogs &amp;&amp;
148mv -v /usr/lib/libss.a /usr/lib/libss.a.e2fsprogs &amp;&amp;
149mv -v /usr/lib/libss.so /usr/lib/libss.so.e2fsprogs &amp;&amp;
150make install &amp;&amp;
151mv -v /usr/include/fnmatch.h /usr/include/fnmatch.h.heimdal &amp;&amp;
152mv -v /usr/include/fnmatch.h.glibc /usr/include/fnmatch.h &amp;&amp;
153mv -v /usr/include/glob.h /usr/include/glob.h.heimdal &amp;&amp;
154mv -v /usr/include/glob.h.glibc /usr/include/glob.h &amp;&amp;
155install -v -m755 -d /usr/share/doc/heimdal-&heimdal-version;/standardisation &amp;&amp;
156install -v -m644 doc/{init-creds,layman.asc} \
157 /usr/share/doc/heimdal-&heimdal-version; &amp;&amp;
158install -v -m644 doc/standardisation/* \
159 /usr/share/doc/heimdal-&heimdal-version;/standardisation &amp;&amp;
160mv -v /bin/login /bin/login.shadow &amp;&amp;
161mv -v /bin/su /bin/su.shadow &amp;&amp;
162mv -v /usr/bin/{login,su} /bin &amp;&amp;
163ln -v -sf ../../bin/login /usr/bin &amp;&amp;
164mv -v /usr/lib/lib{otp,kafs,krb5,asn1,roken,crypto}.so.* \
165 /usr/lib/libdb-4.3.so /lib &amp;&amp;
166ln -v -sf ../../lib/libdb-4.3.so /usr/lib/libdb.so &amp;&amp;
167ln -v -sf ../../lib/libdb-4.3.so /usr/lib/libdb-4.so &amp;&amp;
168for SYMLINK in otp.so.0.1.3 kafs.so.0.4.1 krb5.so.17.4.0 \
169 asn1.so.6.1.0 roken.so.16.1.0 crypto.so.0.9.7
170do
171 ln -v -sf ../../lib/lib$SYMLINK \
172 /usr/lib/lib`echo $SYMLINK | cut -d. -f1`.so
173done
174ldconfig</userinput></screen>
175
176 </sect2>
177
178 <sect2 role="commands">
179 <title>Command Explanations</title>
180
181 <para><command>mv -v /usr/include/...</command> and
182 <command>mv -v /usr/lib/libss.*</command>: The
183 <application>Heimdal</application> installation will overwrite two
184 interface headers from the <application>Glibc</application> package and an
185 interface header, static library and library symbolic link from the
186 <application>E2fsprogs</application> package. These commands move the
187 original files out of the way before the installation, and then restore
188 the original <application>Glibc</application> headers after the
189 installation. The two <application>Heimdal</application> headers are renamed
190 and preserved on the system. Testing has shown that the system is stable
191 using the <application>Heimdal</application> version of the
192 <filename>libss</filename> library and interface header.</para>
193
194 <para><parameter>--libexecdir=/usr/sbin</parameter>: This switch
195 puts the daemon programs into
196 <filename class="directory">/usr/sbin</filename>.</para>
197
198 <tip>
199 <para>If you want to preserve all your existing
200 <application>Inetutils</application> package daemons, install the
201 <application>Heimdal</application> daemons into
202 <filename class="directory">/usr/sbin/heimdal</filename> (or wherever
203 you want). Since these programs will be called from
204 <command>(x)inetd</command> or <filename>rc</filename> scripts, it
205 really doesn't matter where they are installed, as long as they are
206 correctly specified in the <filename>/etc/(x)inetd.conf</filename> file
207 and <filename>rc</filename> scripts. If you choose something other than
208 <filename class="directory">/usr/sbin</filename>, you may want to move
209 some of the user programs (such as <command>kadmin</command>) to
210 <filename class="directory">/usr/sbin</filename> manually so they'll be
211 in the privileged user's default <envar>PATH</envar>.</para>
212 </tip>
213
214 <para><command>mv ... .shadow; mv ... /bin; ln -v -sf ../../bin...</command>:
215 The <command>login</command> and <command>su</command> programs installed by
216 <application>Heimdal</application> belong in the
217 <filename class="directory">/bin</filename> directory. The
218 <command>login</command> program is symlinked because
219 <application>Heimdal</application> is expecting to find it in
220 <filename class="directory">/usr/bin</filename>. The old executables are
221 preserved before the move to keep things sane should breaks occur.</para>
222
223 <para><command>mv ... /lib; ln -v -sf ../../lib/lib... /usr/lib...</command>:
224 The <command>login</command> and <command>su</command> programs installed
225 by <application>Heimdal</application> link against
226 <application>Heimdal</application> libraries as well as libraries provided
227 by the <application>OpenSSL</application> and
228 <application>Berkeley DB</application> packages. These
229 libraries are moved to <filename class="directory">/lib</filename> to be
230 FHS compliant and also in case
231 <filename class="directory">/usr</filename> is located on a separate
232 partition which may not always be mounted.</para>
233
234 </sect2>
235
236 <sect2 role="configuration">
237 <title>Configuring Heimdal</title>
238
239 <sect3 id="heimdal-config">
240 <title>Config Files</title>
241
242 <para><filename>/etc/heimdal/*</filename></para>
243
244 <indexterm zone="heimdal heimdal-config">
245 <primary sortas="e-etc-heimdal">/etc/heimdal/*</primary>
246 </indexterm>
247
248 </sect3>
249
250 <sect3>
251 <title>Configuration Information</title>
252
253 <note>
254 <para>All the configuration steps shown below must be accomplished
255 by the <systemitem class='username'>root</systemitem> user unless
256 otherwise noted.</para>
257 </note>
258
259 <sect4>
260 <title>Master KDC Server Configuration</title>
261
262 <para>Create the Kerberos configuration file with the
263 following commands:</para>
264
265<screen role="root"><userinput>install -v -m755 -d /etc/heimdal &amp;&amp;
266cat &gt; /etc/heimdal/krb5.conf &lt;&lt; "EOF"
267<literal># Begin /etc/heimdal/krb5.conf
268
269[libdefaults]
270 default_realm = <replaceable>[EXAMPLE.COM]</replaceable>
271 encrypt = true
272
273[realms]
274 <replaceable>[EXAMPLE.COM]</replaceable> = {
275 kdc = <replaceable>[hostname.example.com]</replaceable>
276 admin_server = <replaceable>[hostname.example.com]</replaceable>
277 kpasswd_server = <replaceable>[hostname.example.com]</replaceable>
278 }
279
280[domain_realm]
281 .<replaceable>[example.com]</replaceable> = <replaceable>[EXAMPLE.COM]</replaceable>
282
283[logging]
284 kdc = FILE:/var/log/kdc.log
285 admin_server = FILE:/var/log/kadmin.log
286 default = FILE:/var/log/krb.log
287
288# End /etc/heimdal/krb5.conf</literal>
289EOF
290chmod -v 644 /etc/heimdal/krb5.conf</userinput></screen>
291
292 <para>You will need to substitute your domain and proper hostname
293 for the occurrences of the <replaceable>[hostname]</replaceable>
294 and <replaceable>[EXAMPLE.COM]</replaceable> names.</para>
295
296 <para><option>default_realm</option> should be the name of your
297 domain changed to ALL CAPS. This isn't required, but both
298 <application>Heimdal</application> and <application>MIT
299 krb5</application> recommend it.</para>
300
301 <para><option>encrypt = true</option> provides encryption of all
302 traffic between kerberized clients and servers. It's not necessary
303 and can be left off. If you leave it off, you can encrypt all traffic
304 from the client to the server using a switch on the client program
305 instead.</para>
306
307 <para>The <option>[realms]</option> parameters tell the client
308 programs where to look for the KDC authentication services.</para>
309
310 <para>The <option>[domain_realm]</option> section maps a domain
311 to a realm.</para>
312
313 <para>Store the master password in a key file using the following
314 commands:</para>
315
316<screen role="root"><userinput>install -v -m755 -d /var/lib/heimdal &amp;&amp;
317kstash</userinput></screen>
318
319 <para>Create the KDC database:</para>
320
321<screen role="root"><userinput>kadmin -l</userinput></screen>
322
323 <para>The commands below will prompt you for information about the
324 principles. Choose the defaults for now unless you know what you are
325 doing and need to specify different values. You can go in later and
326 change the defaults, should you feel the need. You may use the up and
327 down arrow keys to use the history feature of <command>kadmin</command>
328 in a similar manner as the <command>bash</command> history
329 feature.</para>
330
331 <para>At the <prompt>kadmin&gt;</prompt> prompt, issue the following
332 statement:</para>
333
334<screen role="root"><userinput>init <replaceable>[EXAMPLE.COM]</replaceable></userinput></screen>
335
336 <para>The database must now be populated with at least one principle
337 (user). For now, just use your regular login name or root. You may
338 create as few, or as many principles as you wish using the following
339 statement:</para>
340
341<screen role="root"><userinput>add <replaceable>[loginname]</replaceable></userinput></screen>
342
343 <para>The KDC server and any machine running kerberized
344 server daemons must have a host key installed:</para>
345
346<screen role="root"><userinput>add --random-key host/<replaceable>[hostname.example.com]</replaceable></userinput></screen>
347
348 <para>After choosing the defaults when prompted, you will have to
349 export the data to a keytab file:</para>
350
351<screen role="root"><userinput>ext host/<replaceable>[hostname.example.com]</replaceable></userinput></screen>
352
353 <para>This should have created two files in
354 <filename class="directory">/etc/heimdal</filename>:
355 <filename>krb5.keytab</filename> (Kerberos 5) and
356 <filename>srvtab</filename> (Kerberos 4). Both files should have 600
357 (root rw only) permissions. Keeping the keytab files from public access
358 is crucial to the overall security of the Kerberos installation.</para>
359
360 <para>Eventually, you'll want to add server daemon principles to the
361 database and extract them to the keytab file. You do this in the same
362 way you created the host principles. Below is an example:</para>
363
364<screen role="root"><userinput>add --random-key ftp/<replaceable>[hostname.example.com]</replaceable></userinput></screen>
365
366 <para>(choose the defaults)</para>
367
368<screen role="root"><userinput>ext ftp/<replaceable>[hostname.example.com]</replaceable></userinput></screen>
369
370 <para>Exit the <command>kadmin</command> program (use
371 <command>quit</command> or <command>exit</command>) and return back
372 to the shell prompt. Start the KDC daemon manually, just to test out
373 the installation:</para>
374
375<screen role="root"><userinput>/usr/sbin/kdc &amp;</userinput></screen>
376
377 <para>Attempt to get a TGT (ticket granting ticket) with
378 the following command:</para>
379
380<screen><userinput>kinit <replaceable>[loginname]</replaceable></userinput></screen>
381
382 <para>You will be prompted for the password you created. After you get
383 your ticket, you should list it with the following command:</para>
384
385<screen><userinput>klist</userinput></screen>
386
387 <para>Information about the ticket should be displayed on
388 the screen.</para>
389
390 <para>To test the functionality of the <filename>keytab</filename> file,
391 issue the following command:</para>
392
393<screen><userinput>ktutil list</userinput></screen>
394
395 <para>This should dump a list of the host principals, along with the
396 encryption methods used to access the principals.</para>
397
398 <para>At this point, if everything has been successful so far, you
399 can feel fairly confident in the installation, setup and configuration
400 of your new <application>Heimdal</application> Kerberos 5
401 installation.</para>
402
403 <para id="heimdal-init">Install the
404 <filename>/etc/rc.d/init.d/heimdal</filename> init script included
405 in the <xref linkend="intro-important-bootscripts"/> package:</para>
406
407 <indexterm zone="heimdal heimdal-init">
408 <primary sortas="f-heimdal">heimdal</primary>
409 </indexterm>
410
411<screen role="root"><userinput>make install-heimdal</userinput></screen>
412
413 </sect4>
414
415 <sect4>
416 <title>Using Kerberized Client Programs</title>
417
418 <para>To use the kerberized client programs (<command>telnet</command>,
419 <command>ftp</command>, <command>rsh</command>,
420 <command>rxterm</command>, <command>rxtelnet</command>,
421 <command>rcp</command>, <command>xnlock</command>), you first must get
422 a TGT. Use the <command>kinit</command> program to get the ticket.
423 After you've acquired the ticket, you can use the kerberized programs
424 to connect to any kerberized server on the network. You will not be
425 prompted for authentication until your ticket expires (default is one
426 day), unless you specify a different user as a command line argument
427 to the program.</para>
428
429 <para>The kerberized programs will connect to non-kerberized daemons,
430 warning you that authentication is not encrypted. As mentioned earlier,
431 only the <command>ftp</command> program gives any trouble connecting to
432 non-kerberized daemons.</para>
433
434 <para>In order to use the <application>Heimdal</application>
435 <application>X</application> programs, you'll need to add a service
436 port entry to the <filename>/etc/services</filename> file for the
437 <command>kxd</command> server. There is no 'standardized port number'
438 for the 'kx' service in the IANA database, so you'll have to pick an
439 unused port number. Add an entry to the <filename>services</filename>
440 file similar to the entry below (substitute your chosen port number
441 for <replaceable>[49150]</replaceable>):</para>
442
443<screen><literal>kx <replaceable>[49150]</replaceable>/tcp # Heimdal kerberos X
444kx <replaceable>[49150]</replaceable>/udp # Heimdal kerberos X</literal></screen>
445
446 <para>For additional information consult <ulink
447 url="&hints-root;/downloads/files/heimdal.txt">the
448 Heimdal hint</ulink> on which the above instructions are based.</para>
449
450 </sect4>
451
452 </sect3>
453
454 </sect2>
455
456 <sect2 role="content">
457 <title>Contents</title>
458
459 <segmentedlist>
460 <segtitle>Installed Programs</segtitle>
461 <segtitle>Installed Libraries</segtitle>
462 <segtitle>Installed Directories</segtitle>
463
464 <seglistitem>
465 <seg>afslog, dump_log, ftp, ftpd, hprop, hpropd, ipropd-master,
466 ipropd-slave, kadmin, kadmind, kauth, kcm, kdc, kdestroy, kf, kfd,
467 kgetcred, kinit, klist, kpasswd, kpasswdd, krb5-config, kstash,
468 ktutil, kx, kxd, login, mk_cmds, otp, otpprint, pagsh, pfrom, popper,
469 push, rcp, replay_log, rsh, rshd, rxtelnet, rxterm, string2key, su,
470 telnet, telnetd, tenletxr, truncate-log, verify_krb5_conf
471 and xnlock</seg>
472 <seg>libasn1.[so,a], libeditline.[so,a], libgssapi.[so,a],
473 libhdb.[so,a], libkadm5clnt.[so,a], libkadm5srv.[so,a], libkafs.[so,a],
474 libkrb5.[so,a], libotp.[so,a], libroken.[so,a], libsl.[so,a]
475 and libss.[so,a]</seg>
476 <seg>/etc/heimdal, /usr/include/kadm5,
477 /usr/share/doc/heimdal-&heimdal-version; and /var/lib/heimdal</seg>
478 </seglistitem>
479 </segmentedlist>
480
481 <variablelist>
482 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
483 <?dbfo list-presentation="list"?>
484 <?dbhtml list-presentation="table"?>
485
486 <varlistentry id="afslog">
487 <term><command>afslog</command></term>
488 <listitem>
489 <para>obtains AFS tokens for a number of cells.</para>
490 <indexterm zone="heimdal afslog">
491 <primary sortas="b-afslog">afslog</primary>
492 </indexterm>
493 </listitem>
494 </varlistentry>
495
496 <varlistentry id="ftp">
497 <term><command>ftp</command></term>
498 <listitem>
499 <para>is a kerberized FTP client.</para>
500 <indexterm zone="heimdal ftp">
501 <primary sortas="b-ftp">ftp</primary>
502 </indexterm>
503 </listitem>
504 </varlistentry>
505
506 <varlistentry id="ftpd">
507 <term><command>ftpd</command></term>
508 <listitem>
509 <para>is a kerberized FTP daemon.</para>
510 <indexterm zone="heimdal ftpd">
511 <primary sortas="b-ftpd">ftpd</primary>
512 </indexterm>
513 </listitem>
514 </varlistentry>
515
516 <varlistentry id="hprop">
517 <term><command>hprop</command></term>
518 <listitem>
519 <para> takes a principal database in a specified format and converts
520 it into a stream of <application>Heimdal</application> database
521 records.</para>
522 <indexterm zone="heimdal hprop">
523 <primary sortas="b-hprop">hprop</primary>
524 </indexterm>
525 </listitem>
526 </varlistentry>
527
528 <varlistentry id="hpropd">
529 <term><command>hpropd</command></term>
530 <listitem>
531 <para>is a server that receives a database sent by
532 <command>hprop</command> and writes it as a local database.</para>
533 <indexterm zone="heimdal hpropd">
534 <primary sortas="b-hpropd">hpropd</primary>
535 </indexterm>
536 </listitem>
537 </varlistentry>
538
539 <varlistentry id="ipropd-master">
540 <term><command>ipropd-master</command></term>
541 <listitem>
542 <para>is a daemon which runs on the master KDC
543 server which incrementally propagates changes to the KDC
544 database to the slave KDC servers.</para>
545 <indexterm zone="heimdal ipropd-master">
546 <primary sortas="b-ipropd-master">ipropd-master</primary>
547 </indexterm>
548 </listitem>
549 </varlistentry>
550
551 <varlistentry id="ipropd-slave">
552 <term><command>ipropd-slave</command></term>
553 <listitem>
554 <para>is a daemon which runs on the slave KDC
555 servers which incrementally propagates changes to the KDC
556 database from the master KDC server.</para>
557 <indexterm zone="heimdal ipropd-slave">
558 <primary sortas="b-ipropd-slave">ipropd-slave</primary>
559 </indexterm>
560 </listitem>
561 </varlistentry>
562
563 <varlistentry id="kadmin">
564 <term><command>kadmin</command></term>
565 <listitem>
566 <para>is a utility used to make modifications to the Kerberos
567 database.</para>
568 <indexterm zone="heimdal kadmin">
569 <primary sortas="b-kadmin">kadmin</primary>
570 </indexterm>
571 </listitem>
572 </varlistentry>
573
574 <varlistentry id="kadmind">
575 <term><command>kadmind</command></term>
576 <listitem>
577 <para>is a server for administrative access to the Kerberos
578 database.</para>
579 <indexterm zone="heimdal kadmind">
580 <primary sortas="b-kadmind">kadmind</primary>
581 </indexterm>
582 </listitem>
583 </varlistentry>
584
585 <varlistentry id="kauth">
586 <term><command>kauth</command></term>
587 <listitem>
588 <para>is a symbolic link to the <command>kinit</command>
589 program.</para>
590 <indexterm zone="heimdal kauth">
591 <primary sortas="g-kauth">kauth</primary>
592 </indexterm>
593 </listitem>
594 </varlistentry>
595
596 <varlistentry id="kcm">
597 <term><command>kcm</command></term>
598 <listitem>
599 <para>is a process based credential cache for Kerberos
600 tickets.</para>
601 <indexterm zone="heimdal kcm">
602 <primary sortas="b-kcm">kcm</primary>
603 </indexterm>
604 </listitem>
605 </varlistentry>
606
607 <varlistentry id="kdc">
608 <term><command>kdc</command></term>
609 <listitem>
610 <para>is a Kerberos 5 server.</para>
611 <indexterm zone="heimdal kdc">
612 <primary sortas="b-kdc">kdc</primary>
613 </indexterm>
614 </listitem>
615 </varlistentry>
616
617 <varlistentry id="kdestroy">
618 <term><command>kdestroy</command></term>
619 <listitem>
620 <para>removes a principle's current set of tickets.</para>
621 <indexterm zone="heimdal kdestroy">
622 <primary sortas="b-kdestroy">kdestroy</primary>
623 </indexterm>
624 </listitem>
625 </varlistentry>
626
627 <varlistentry id="kf">
628 <term><command>kf</command></term>
629 <listitem>
630 <para>is a program which forwards tickets to a remote host through
631 an authenticated and encrypted stream.</para>
632 <indexterm zone="heimdal kf">
633 <primary sortas="b-kf">kf</primary>
634 </indexterm>
635 </listitem>
636 </varlistentry>
637
638 <varlistentry id="kfd">
639 <term><command>kfd</command></term>
640 <listitem>
641 <para>is a server used to receive forwarded tickets.</para>
642 <indexterm zone="heimdal kfd">
643 <primary sortas="b-kfd">kfd</primary>
644 </indexterm>
645 </listitem>
646 </varlistentry>
647
648 <varlistentry id="kgetcred">
649 <term><command>kgetcred</command></term>
650 <listitem>
651 <para>obtains a ticket for a service.</para>
652 <indexterm zone="heimdal kgetcred">
653 <primary sortas="b-kgetcred">kgetcred</primary>
654 </indexterm>
655 </listitem>
656 </varlistentry>
657
658 <varlistentry id="kinit">
659 <term><command>kinit</command></term>
660 <listitem>
661 <para>is used to authenticate to the Kerberos server as a principal
662 and acquire a ticket granting ticket that can later be used to obtain
663 tickets for other services.</para>
664 <indexterm zone="heimdal kinit">
665 <primary sortas="b-kinit">kinit</primary>
666 </indexterm>
667 </listitem>
668 </varlistentry>
669
670 <varlistentry id="klist">
671 <term><command>klist</command></term>
672 <listitem>
673 <para>reads and displays the current tickets in the credential
674 cache.</para>
675 <indexterm zone="heimdal klist">
676 <primary sortas="b-klist">klist</primary>
677 </indexterm>
678 </listitem>
679 </varlistentry>
680
681 <varlistentry id="kpasswd">
682 <term><command>kpasswd</command></term>
683 <listitem>
684 <para>is a program for changing Kerberos 5 passwords.</para>
685 <indexterm zone="heimdal kpasswd">
686 <primary sortas="b-kpasswd">kpasswd</primary>
687 </indexterm>
688 </listitem>
689 </varlistentry>
690
691 <varlistentry id="kpasswdd">
692 <term><command>kpasswdd</command></term>
693 <listitem>
694 <para>is a Kerberos 5 password changing server.</para>
695 <indexterm zone="heimdal kpasswdd">
696 <primary sortas="b-kpasswdd">kpasswdd</primary>
697 </indexterm>
698 </listitem>
699 </varlistentry>
700
701 <varlistentry id="krb5-config-prog">
702 <term><command>krb5-config</command></term>
703 <listitem>
704 <para>gives information on how to link programs against
705 <application>Heimdal</application> libraries.</para>
706 <indexterm zone="heimdal krb5-config-prog">
707 <primary sortas="b-krb5-config">krb5-config</primary>
708 </indexterm>
709 </listitem>
710 </varlistentry>
711
712 <varlistentry id="kstash">
713 <term><command>kstash</command></term>
714 <listitem>
715 <para>stores the KDC master password in a file.</para>
716 <indexterm zone="heimdal kstash">
717 <primary sortas="b-kstash">kstash</primary>
718 </indexterm>
719 </listitem>
720 </varlistentry>
721
722 <varlistentry id="ktutil">
723 <term><command>ktutil</command></term>
724 <listitem>
725 <para>is a program for managing Kerberos keytabs.</para>
726 <indexterm zone="heimdal ktutil">
727 <primary sortas="b-ktutil">ktutil</primary>
728 </indexterm>
729 </listitem>
730 </varlistentry>
731
732 <varlistentry id="kx">
733 <term><command>kx</command></term>
734 <listitem>
735 <para>is a program which securely forwards
736 <application>X</application> connections.</para>
737 <indexterm zone="heimdal kx">
738 <primary sortas="b-kx">kx</primary>
739 </indexterm>
740 </listitem>
741 </varlistentry>
742
743 <varlistentry id="kxd">
744 <term><command>kxd</command></term>
745 <listitem>
746 <para>is the daemon for <command>kx</command>.</para>
747 <indexterm zone="heimdal kxd">
748 <primary sortas="b-kxd">kxd</primary>
749 </indexterm>
750 </listitem>
751 </varlistentry>
752
753 <varlistentry id="login">
754 <term><command>login</command></term>
755 <listitem>
756 <para>is a kerberized login program.</para>
757 <indexterm zone="heimdal login">
758 <primary sortas="b-login">login</primary>
759 </indexterm>
760 </listitem>
761 </varlistentry>
762
763 <varlistentry id="otp">
764 <term><command>otp</command></term>
765 <listitem>
766 <para>manages one-time passwords.</para>
767 <indexterm zone="heimdal otp">
768 <primary sortas="b-otp">otp</primary>
769 </indexterm>
770 </listitem>
771 </varlistentry>
772
773 <varlistentry id="otpprint">
774 <term><command>otpprint</command></term>
775 <listitem>
776 <para>prints lists of one-time passwords.</para>
777 <indexterm zone="heimdal otpprint">
778 <primary sortas="b-otpprint">otpprint</primary>
779 </indexterm>
780 </listitem>
781 </varlistentry>
782
783 <varlistentry id="pfrom">
784 <term><command>pfrom</command></term>
785 <listitem>
786 <para>is a script that runs <command>push --from</command>.</para>
787 <indexterm zone="heimdal pfrom">
788 <primary sortas="b-pfrom">pfrom</primary>
789 </indexterm>
790 </listitem>
791 </varlistentry>
792
793 <varlistentry id="popper">
794 <term><command>popper</command></term>
795 <listitem>
796 <para>is a kerberized POP-3 server.</para>
797 <indexterm zone="heimdal popper">
798 <primary sortas="b-popper">popper</primary>
799 </indexterm>
800 </listitem>
801 </varlistentry>
802
803 <varlistentry id="push">
804 <term><command>push</command></term>
805 <listitem>
806 <para>is a kerberized POP mail retrieval client.</para>
807 <indexterm zone="heimdal push">
808 <primary sortas="b-push">push</primary>
809 </indexterm>
810 </listitem>
811 </varlistentry>
812
813 <varlistentry id="rcp">
814 <term><command>rcp</command></term>
815 <listitem>
816 <para>is a kerberized rcp client program.</para>
817 <indexterm zone="heimdal rcp">
818 <primary sortas="b-rcp">rcp</primary>
819 </indexterm>
820 </listitem>
821 </varlistentry>
822
823 <varlistentry id="rsh">
824 <term><command>rsh</command></term>
825 <listitem>
826 <para>is a kerberized rsh client program.</para>
827 <indexterm zone="heimdal rsh">
828 <primary sortas="b-rsh">rsh</primary>
829 </indexterm>
830 </listitem>
831 </varlistentry>
832
833 <varlistentry id="rshd">
834 <term><command>rshd</command></term>
835 <listitem>
836 <para>is a kerberized rsh server.</para>
837 <indexterm zone="heimdal rshd">
838 <primary sortas="b-rshd">rshd</primary>
839 </indexterm>
840 </listitem>
841 </varlistentry>
842
843 <varlistentry id="rxtelnet">
844 <term><command>rxtelnet</command></term>
845 <listitem>
846 <para>starts a secure <command>xterm</command> window with a
847 <command>telnet</command> to a given host and forwards
848 <application>X</application> connections.</para>
849 <indexterm zone="heimdal rxtelnet">
850 <primary sortas="b-rxtelnet">rxtelnet</primary>
851 </indexterm>
852 </listitem>
853 </varlistentry>
854
855 <varlistentry id="rxterm">
856 <term><command>rxterm</command></term>
857 <listitem>
858 <para>starts a secure remote <command>xterm</command>.</para>
859 <indexterm zone="heimdal rxterm">
860 <primary sortas="b-rxterm">rxterm</primary>
861 </indexterm>
862 </listitem>
863 </varlistentry>
864
865 <varlistentry id="string2key">
866 <term><command>string2key</command></term>
867 <listitem>
868 <para>maps a password into a key.</para>
869 <indexterm zone="heimdal string2key">
870 <primary sortas="b-string2key">string2key</primary>
871 </indexterm>
872 </listitem>
873 </varlistentry>
874
875 <varlistentry id="su">
876 <term><command>su</command></term>
877 <listitem>
878 <para>is a kerberized su client program.</para>
879 <indexterm zone="heimdal su">
880 <primary sortas="b-su">su</primary>
881 </indexterm>
882 </listitem>
883 </varlistentry>
884
885 <varlistentry id="telnet">
886 <term><command>telnet</command></term>
887 <listitem>
888 <para>is a kerberized telnet client program.</para>
889 <indexterm zone="heimdal telnet">
890 <primary sortas="b-telnet">telnet</primary>
891 </indexterm>
892 </listitem>
893 </varlistentry>
894
895 <varlistentry id="telnetd">
896 <term><command>telnetd</command></term>
897 <listitem>
898 <para>is a kerberized telnet server.</para>
899 <indexterm zone="heimdal telnetd">
900 <primary sortas="b-telnetd">telnetd</primary>
901 </indexterm>
902 </listitem>
903 </varlistentry>
904
905 <varlistentry id="tenletxr">
906 <term><command>tenletxr</command></term>
907 <listitem>
908 <para>forwards <application>X</application> connections
909 backwards.</para>
910 <indexterm zone="heimdal tenletxr">
911 <primary sortas="b-tenletxr">tenletxr</primary>
912 </indexterm>
913 </listitem>
914 </varlistentry>
915
916 <varlistentry id="verify_krb5_conf">
917 <term><command>verify_krb5_conf</command></term>
918 <listitem>
919 <para>checks <filename>krb5.conf</filename> file for obvious
920 errors.</para>
921 <indexterm zone="heimdal verify_krb5_conf">
922 <primary sortas="b-verify_krb5_conf">verify_krb5_conf</primary>
923 </indexterm>
924 </listitem>
925 </varlistentry>
926
927 <varlistentry id="xnlock">
928 <term><command>xnlock</command></term>
929 <listitem>
930 <para>is a program that acts as a secure screen saver for
931 workstations running <application>X</application>.</para>
932 <indexterm zone="heimdal xnlock">
933 <primary sortas="b-xnlock">xnlock</primary>
934 </indexterm>
935 </listitem>
936 </varlistentry>
937
938 <varlistentry id="libasn1">
939 <term><filename class='libraryfile'>libasn1.[so,a]</filename></term>
940 <listitem>
941 <para>provides the ASN.1 and DER functions to encode and decode
942 the Kerberos TGTs.</para>
943 <indexterm zone="heimdal libasn1">
944 <primary sortas="c-libasn1">libasn1.[so,a]</primary>
945 </indexterm>
946 </listitem>
947 </varlistentry>
948
949 <varlistentry id="libeditline">
950 <term><filename class='libraryfile'>libeditline.a</filename></term>
951 <listitem>
952 <para>is a command-line editing library with history.</para>
953 <indexterm zone="heimdal libeditline">
954 <primary sortas="c-libeditline">libeditline.a</primary>
955 </indexterm>
956 </listitem>
957 </varlistentry>
958
959 <varlistentry id="libgssapi">
960 <term><filename class='libraryfile'>libgssapi.[so,a]</filename></term>
961 <listitem>
962 <para>contain the Generic Security Service Application Programming
963 Interface (GSSAPI) functions which provides security
964 services to callers in a generic fashion, supportable with a range of
965 underlying mechanisms and technologies and hence allowing source-level
966 portability of applications to different environments.</para>
967 <indexterm zone="heimdal libgssapi">
968 <primary sortas="c-libgssapi">libgssapi.[so,a]</primary>
969 </indexterm>
970 </listitem>
971 </varlistentry>
972
973 <varlistentry id="libhdb">
974 <term><filename class='libraryfile'>libhdb.[so,a]</filename></term>
975 <listitem>
976 <para>is a <application>Heimdal</application> Kerberos 5
977 authentication/authorization database access library.</para>
978 <indexterm zone="heimdal libhdb">
979 <primary sortas="c-libhdb">libhdb.[so,a]</primary>
980 </indexterm>
981 </listitem>
982 </varlistentry>
983
984 <varlistentry id="libkadm5clnt">
985 <term><filename class='libraryfile'>libkadm5clnt.[so,a]</filename></term>
986 <listitem>
987 <para>contains the administrative authentication and password
988 checking functions required by Kerberos 5 client-side programs.</para>
989 <indexterm zone="heimdal libkadm5clnt">
990 <primary sortas="c-libkadm5clnt">libkadm5clnt.[so,a]</primary>
991 </indexterm>
992 </listitem>
993 </varlistentry>
994
995 <varlistentry id="libkadm5srv">
996 <term><filename class='libraryfile'>libkadm5srv.[so,a]</filename></term>
997 <listitem>
998 <para>contain the administrative authentication and password
999 checking functions required by Kerberos 5 servers.</para>
1000 <indexterm zone="heimdal libkadm5srv">
1001 <primary sortas="c-libkadm5srv">libkadm5srv.[so,a]</primary>
1002 </indexterm>
1003 </listitem>
1004 </varlistentry>
1005
1006 <varlistentry id="libkafs">
1007 <term><filename class='libraryfile'>libkafs.[so,a]</filename></term>
1008 <listitem>
1009 <para>contains the functions required to authenticated to AFS.</para>
1010 <indexterm zone="heimdal libkafs">
1011 <primary sortas="c-libkafs">libkafs.[so,a]</primary>
1012 </indexterm>
1013 </listitem>
1014 </varlistentry>
1015
1016 <varlistentry id="libkrb5">
1017 <term><filename class='libraryfile'>libkrb5.[so,a]</filename></term>
1018 <listitem>
1019 <para>is an all-purpose Kerberos 5 library.</para>
1020 <indexterm zone="heimdal libkrb5">
1021 <primary sortas="c-libkrb5">libkrb5.[so,a]</primary>
1022 </indexterm>
1023 </listitem>
1024 </varlistentry>
1025
1026 <varlistentry id="libotp">
1027 <term><filename class='libraryfile'>libotp.[so,a]</filename></term>
1028 <listitem>
1029 <para>contains the functions required to handle authenticating
1030 one time passwords.</para>
1031 <indexterm zone="heimdal libotp">
1032 <primary sortas="c-libotp">libotp.[so,a]</primary>
1033 </indexterm>
1034 </listitem>
1035 </varlistentry>
1036
1037 <varlistentry id="libroken">
1038 <term><filename class='libraryfile'>libroken.[so,a]</filename></term>
1039 <listitem>
1040 <para>is a library containing Kerberos 5 compatibility
1041 functions.</para>
1042 <indexterm zone="heimdal libroken">
1043 <primary sortas="c-libroken">libroken.[so,a]</primary>
1044 </indexterm>
1045 </listitem>
1046 </varlistentry>
1047
1048 </variablelist>
1049
1050 </sect2>
1051
1052</sect1>
Note: See TracBrowser for help on using the repository browser.