source: postlfs/security/mitkrb-systemd.xml@ 295ca00

systemd-13485
Last change on this file since 295ca00 was 295ca00, checked in by Douglas R. Reno <renodr@…>, 6 years ago

Update to Sudo-1.8.15 (merged from trunk r16594)
Update to stunnel-5.29 (merged from trunk r16797)
Update to ssh-askpass-4.1p2 (merged from trunk r16811)
Update to p11-kit-0.23.2 (merged from trunk r16716)
Update to OpenSSL-1.0.2e (merged from trunk r16708)
Update to OpenSSH-7.1p2 (merged from trunk r16811)
Update to NSS-3.21 (merged from trunk r16627)
Update to MIT Kerberos V5-1.14 (merged from trunk r16679)
Update to iptables-1.6.0 (merged from trunk r16742)
Update to GPGME-1.6.0 (merged from trunk r16360)
Update to GnuTLS-3.4.8 (merged from trunk r16797)

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/branches/systemd@16833 af4574ff-66df-0310-9fd7-8a98e5e911e0

  • Property mode set to 100644
File size: 31.9 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY mitkrb-download-http "http://web.mit.edu/kerberos/dist/krb5/&mitkrb-major-version;/krb5-&mitkrb-version;.tar.gz">
8 <!ENTITY mitkrb-download-ftp " ">
9 <!ENTITY mitkrb-md5sum "0727968764d0208388b85ad31aafde24">
10 <!ENTITY mitkrb-size "12 MB">
11 <!ENTITY mitkrb-buildsize "165 MB (Additional 26 MB for the testsuite)">
12 <!ENTITY mitkrb-time "1 SBU (additional 5.5 SBU for the testsuite)">
13]>
14
15<sect1 id="mitkrb" xreflabel="MIT Kerberos V5-&mitkrb-version;">
16 <?dbhtml filename="mitkrb.html"?>
17
18 <sect1info>
19 <othername>$LastChangedBy$</othername>
20 <date>$Date$</date>
21 </sect1info>
22
23 <title>MIT Kerberos V5-&mitkrb-version;</title>
24
25 <indexterm zone="mitkrb">
26 <primary sortas="a-MIT-Kerberos">MIT Kerberos V5</primary>
27 </indexterm>
28
29 <sect2 role="package">
30 <title>Introduction to MIT Kerberos V5</title>
31
32 <para>
33 <application>MIT Kerberos V5</application> is a free implementation
34 of Kerberos 5. Kerberos is a network authentication protocol. It
35 centralizes the authentication database and uses kerberized
36 applications to work with servers or services that support Kerberos
37 allowing single logins and encrypted communication over internal
38 networks or the Internet.
39 </para>
40
41 &lfs77_checked;
42
43 <bridgehead renderas="sect3">Package Information</bridgehead>
44 <itemizedlist spacing="compact">
45 <listitem>
46 <para>
47 Download (HTTP): <ulink url="&mitkrb-download-http;"/>
48 </para>
49 </listitem>
50 <listitem>
51 <para>
52 Download (FTP): <ulink url="&mitkrb-download-ftp;"/>
53 </para>
54 </listitem>
55 <listitem>
56 <para>
57 Download MD5 sum: &mitkrb-md5sum;
58 </para>
59 </listitem>
60 <listitem>
61 <para>
62 Download size: &mitkrb-size;
63 </para>
64 </listitem>
65 <listitem>
66 <para>
67 Estimated disk space required: &mitkrb-buildsize;
68 </para>
69 </listitem>
70 <listitem>
71 <para>
72 Estimated build time: &mitkrb-time;
73 </para>
74 </listitem>
75 </itemizedlist>
76
77 <bridgehead renderas="sect3">MIT Kerberos V5 Dependencies</bridgehead>
78
79 <bridgehead renderas="sect4">Optional</bridgehead>
80 <para role="optional">
81 <xref linkend="dejagnu"/> (for full test coverage),
82 <xref linkend="gnupg2"/> (to authenticate the package),
83 <xref linkend="keyutils"/>,
84 <xref linkend="openldap"/>,
85 <xref linkend="python2"/> (used during the testsuite), and
86 <xref linkend="rpcbind"/> (used during the testsuite)
87 </para>
88
89 <note>
90 <para>
91 Some sort of time synchronization facility on your system (like
92 <xref linkend="ntp"/>) is required since Kerberos won't authenticate
93 if there is a time difference between a kerberized client and the
94 KDC server.
95 </para>
96 </note>
97
98 <para condition="html" role="usernotes">User Notes:
99 <ulink url="&blfs-wiki;/mitkrb"/>
100 </para>
101 </sect2>
102
103 <sect2 role="installation">
104 <title>Installation of MIT Kerberos V5</title>
105
106<!--
107 <para>
108 <application>MIT Kerberos V5</application> is distributed in a
109 TAR file containing a compressed TAR package and a detached PGP2
110 <filename class="extension">ASC</filename> file. You'll need to unpack
111 the distribution tar file, then unpack the compressed tar file before
112 starting the build.
113 </para>
114
115 <para>
116 After unpacking the distribution tarball and if you have
117 <xref linkend="gnupg2"/> installed, you can
118 authenticate the package. First, check the contents of the file
119 <filename>krb5-&mitkrb-version;.tar.gz.asc</filename>.
120 </para>
121
122<screen><userinput>gpg2 -\-verify krb5-&mitkrb-version;.tar.gz.asc krb5-&mitkrb-version;.tar.gz</userinput></screen>
123
124 <para>You will probably see output similar to:</para>
125
126<screen><literal>gpg: Signature made Fri May 8 23:40:13 2015 utc using RSA key ID 0055C305
127gpg: Can't check signature: No public key</literal></screen>
128
129 <para>
130 You can import the public key with:
131 </para>
132
133<screen><userinput>gpg2 -\-keyserver pgp.mit.edu -\-recv-keys 0055C305</userinput></screen>
134
135 <para>
136 Now re-verify the package with the first command above. You should get a
137 indication of a good signature, but the key will still not be certified
138 with a trusted signature. Trusting the downloaded key is a separate
139 operation but it is up to you to determine the level of trust.
140 </para>-->
141
142 <para>
143 Build <application>MIT Kerberos V5</application> by running the
144 following commands:
145 </para>
146
147<screen><userinput>cd src &amp;&amp;
148sed -e "s@python2.5/Python.h@&amp; python2.7/Python.h@g" \
149 -e "s@-lpython2.5]@&amp;,\n AC_CHECK_LIB(python2.7,main,[PYTHON_LIB=-lpython2.7])@g" \
150 -i configure.in &amp;&amp;
151
152sed -e 's@\^u}@^u cols 300}@' \
153 -i tests/dejagnu/config/default.exp &amp;&amp;
154
155autoconf &amp;&amp;
156./configure --prefix=/usr \
157 --sysconfdir=/etc \
158 --localstatedir=/var/lib \
159 --with-system-et \
160 --with-system-ss \
161 --with-system-verto=no \
162 --enable-dns-for-realm &amp;&amp;
163make</userinput></screen>
164
165 <para>
166 To test the build, issue: <command>make check</command>. You need at
167 least <xref linkend="tcl"/>, which is used to drive the testsuite.
168 Furthermore, <xref linkend="dejagnu"/> must be available for some
169 of the tests to run. If you have a former version of MIT Kerberos V5
170 installed, it may happen that the test suite pick up the installed
171 versions of the libraries, rather than the newly built ones. If so,
172 it is better to run the tests after the installation.
173 </para>
174
175 <para>
176 Now, as the <systemitem class="username">root</systemitem> user:
177 </para>
178
179<screen role="root"><userinput>make install &amp;&amp;
180
181for LIBRARY in gssapi_krb5 gssrpc k5crypto kadm5clnt kadm5srv \
182 kdb5 kdb_ldap krad krb5 krb5support verto ; do
183 chmod -v 755 /usr/lib/lib$LIBRARY.so
184done &amp;&amp;
185unset LIBRARY &amp;&amp;
186
187mv -v /usr/lib/libkrb5.so.3* /lib &amp;&amp;
188mv -v /usr/lib/libk5crypto.so.3* /lib &amp;&amp;
189mv -v /usr/lib/libkrb5support.so.0* /lib &amp;&amp;
190
191ln -sfv ../../lib/libkrb5.so.3.3 /usr/lib/libkrb5.so &amp;&amp;
192ln -sfv ../../lib/libk5crypto.so.3.1 /usr/lib/libk5crypto.so &amp;&amp;
193ln -sfv ../../lib/libkrb5support.so.0.1 /usr/lib/libkrb5support.so &amp;&amp;
194
195mv -v /usr/bin/ksu /bin &amp;&amp;
196chmod -v 755 /bin/ksu &amp;&amp;
197
198install -v -dm755 /usr/share/doc/krb5-&mitkrb-version; &amp;&amp;
199cp -rfv ../doc/* /usr/share/doc/krb5-&mitkrb-version;</userinput></screen>
200
201
202 </sect2>
203
204 <sect2 role="commands">
205 <title>Command Explanations</title>
206
207 <para>
208 <command>sed -e ...</command>: The first <command>sed</command> fixes
209 <application>Python</application> detection. The second one increases
210 the width of the virtual terminal used for some tests, to prevent
211 some spurious characters from being echoed, which is taken as a failure.
212 </para>
213
214 <para>
215 <parameter>--localstatedir=/var/lib</parameter>: This switch is
216 used so that the Kerberos variable run-time data is located in
217 <filename class="directory">/var/lib</filename> instead of
218 <filename class="directory">/usr/var</filename>.
219 </para>
220
221 <para>
222 <parameter>--with-system-et</parameter>: This switch causes the build
223 to use the system-installed versions of the error-table support
224 software.
225 </para>
226
227 <para>
228 <parameter>--with-system-ss</parameter>: This switch causes the build
229 to use the system-installed versions of the subsystem command-line
230 interface software.
231 </para>
232
233 <para>
234 <parameter>--with-system-verto=no</parameter>: This switch fixes a bug in
235 the package: it does not recognize its own verto library installed
236 previously. This is not a problem if you are reinstalling the same version.
237 However, if you are updating, the old library is used as the system library,
238 instead of installing the new version.
239 </para>
240
241 <para>
242 <parameter>--enable-dns-for-realm</parameter>: This switch allows
243 realms to be resolved using the DNS server.
244 </para>
245
246 <para>
247 <command>mv -v /usr/bin/ksu /bin</command>: Moves the
248 <command>ksu</command> program to the
249 <filename class="directory">/bin</filename> directory so that it is
250 available when the <filename class="directory">/usr</filename>
251 filesystem is not mounted.
252 </para>
253
254 <para>
255 <option>--with-ldap</option>: Use this switch if you want to compile
256 <application>OpenLDAP</application> database backend module.
257 </para>
258
259 </sect2>
260
261 <sect2 role="configuration">
262 <title>Configuring MIT Kerberos V5</title>
263
264 <sect3 id="krb5-config">
265 <title>Config Files</title>
266
267 <para>
268 <filename>/etc/krb5.conf</filename> and
269 <filename>/var/lib/krb5kdc/kdc.conf</filename>
270 </para>
271
272 <indexterm zone="mitkrb krb5-config">
273 <primary sortas="e-etc-krb5.conf">/etc/krb5.conf</primary>
274 </indexterm>
275
276 <indexterm zone="mitkrb krb5-config">
277 <primary sortas="e-var-lib-krb5kdc-kdc.conf">/var/lib/krb5kdc/kdc.conf</primary>
278 </indexterm>
279
280 </sect3>
281
282 <sect3>
283 <title>Configuration Information</title>
284
285 <sect4>
286 <title>Kerberos Configuration</title>
287
288 <tip>
289 <para>
290 You should consider installing some sort of password checking
291 dictionary so that you can configure the installation to only
292 accept strong passwords. A suitable dictionary to use is shown in
293 the <xref linkend="cracklib"/> instructions. Note that only one
294 file can be used, but you can concatenate many files into one. The
295 configuration file shown below assumes you have installed a
296 dictionary to <filename>/usr/share/dict/words</filename>.
297 </para>
298 </tip>
299
300 <para>
301 Create the Kerberos configuration file with the following
302 commands issued by the <systemitem class="username">root</systemitem>
303 user:
304 </para>
305
306<screen role="root"><userinput>cat &gt; /etc/krb5.conf &lt;&lt; "EOF"
307<literal># Begin /etc/krb5.conf
308
309[libdefaults]
310 default_realm = <replaceable>&lt;LFS.ORG&gt;</replaceable>
311 encrypt = true
312
313[realms]
314 <replaceable>&lt;LFS.ORG&gt;</replaceable> = {
315 kdc = <replaceable>&lt;belgarath.lfs.org&gt;</replaceable>
316 admin_server = <replaceable>&lt;belgarath.lfs.org&gt;</replaceable>
317 dict_file = /usr/share/dict/words
318 }
319
320[domain_realm]
321 .<replaceable>&lt;lfs.org&gt;</replaceable> = <replaceable>&lt;LFS.ORG&gt;</replaceable>
322
323[logging]
324 kdc = SYSLOG[:INFO[:AUTH]]
325 admin_server = SYSLOG[INFO[:AUTH]]
326 default = SYSLOG[[:SYS]]
327
328# End /etc/krb5.conf</literal>
329EOF</userinput></screen>
330
331 <para>
332 You will need to substitute your domain and proper hostname for the
333 occurrences of the <replaceable>&lt;belgarath&gt;</replaceable> and
334 <replaceable>&lt;lfs.org&gt;</replaceable> names.
335 </para>
336
337 <para>
338 <option>default_realm</option> should be the name of your
339 domain changed to ALL CAPS. This isn't required, but both
340 <application>Heimdal</application> and MIT recommend it.
341 </para>
342
343 <para>
344 <option>encrypt = true</option> provides encryption of all traffic
345 between kerberized clients and servers. It's not necessary and can
346 be left off. If you leave it off, you can encrypt all traffic from
347 the client to the server using a switch on the client program
348 instead.
349 </para>
350
351 <para>
352 The <option>[realms]</option> parameters tell the client programs
353 where to look for the KDC authentication services.
354 </para>
355
356 <para>
357 The <option>[domain_realm]</option> section maps a domain to a realm.
358 </para>
359
360 <para>
361 Create the KDC database:
362 </para>
363
364<screen role="root"><userinput>kdb5_util create -r <replaceable>&lt;LFS.ORG&gt;</replaceable> -s</userinput></screen>
365
366 <para>
367 Now you should populate the database with principals
368 (users). For now, just use your regular login name or
369 <systemitem class="username">root</systemitem>.
370 </para>
371
372<screen role="root"><userinput>kadmin.local
373<prompt>kadmin.local:</prompt> add_policy dict-only
374<prompt>kadmin.local:</prompt> addprinc -policy dict-only <replaceable>&lt;loginname&gt;</replaceable></userinput></screen>
375
376 <para>
377 The KDC server and any machine running kerberized
378 server daemons must have a host key installed:
379 </para>
380
381<screen role="root"><userinput><prompt>kadmin.local:</prompt> addprinc -randkey host/<replaceable>&lt;belgarath.lfs.org&gt;</replaceable></userinput></screen>
382
383 <para>
384 After choosing the defaults when prompted, you will have to
385 export the data to a keytab file:
386 </para>
387
388<screen role="root"><userinput><prompt>kadmin.local:</prompt> ktadd host/<replaceable>&lt;belgarath.lfs.org&gt;</replaceable></userinput></screen>
389
390 <para>
391 This should have created a file in
392 <filename class="directory">/etc</filename> named
393 <filename>krb5.keytab</filename> (Kerberos 5). This file should
394 have 600 (<systemitem class="username">root</systemitem> rw only)
395 permissions. Keeping the keytab files from public access is crucial
396 to the overall security of the Kerberos installation.
397 </para>
398
399 <para>
400 Exit the <command>kadmin</command> program (use
401 <command>quit</command> or <command>exit</command>) and return
402 back to the shell prompt. Start the KDC daemon manually, just to
403 test out the installation:
404 </para>
405
406<screen role="root"><userinput>/usr/sbin/krb5kdc</userinput></screen>
407
408 <para>
409 Attempt to get a ticket with the following command:
410 </para>
411
412<screen><userinput>kinit <replaceable>&lt;loginname&gt;</replaceable></userinput></screen>
413
414 <para>
415 You will be prompted for the password you created. After you
416 get your ticket, you can list it with the following command:
417 </para>
418
419<screen><userinput>klist</userinput></screen>
420
421 <para>
422 Information about the ticket should be displayed on the
423 screen.
424 </para>
425
426 <para>
427 To test the functionality of the keytab file, issue the
428 following command:
429 </para>
430
431<screen><userinput>ktutil
432<prompt>ktutil:</prompt> rkt /etc/krb5.keytab
433<prompt>ktutil:</prompt> l</userinput></screen>
434
435 <para>
436 This should dump a list of the host principal, along with
437 the encryption methods used to access the principal.
438 </para>
439
440 <para>
441 At this point, if everything has been successful so far, you
442 can feel fairly confident in the installation and configuration of
443 the package.
444 </para>
445
446 </sect4>
447
448 <sect4>
449 <title>Additional Information</title>
450
451 <para>
452 For additional information consult the <ulink
453 url="http://web.mit.edu/kerberos/www/krb5-&mitkrb-major-version;/#documentation">
454 documentation for krb5-&mitkrb-version;</ulink> on which the above
455 instructions are based.
456 </para>
457
458 </sect4>
459
460 </sect3>
461
462 <sect3 id="mitkrb-init">
463 <title>Systemd Units</title>
464
465 <para>
466 To start the Kerberos services at boot,
467 install the systemd units from the <xref linkend="bootscripts"/>
468 package by running the following command as the
469 <systemitem class="username">root</systemitem> user:
470 </para>
471
472 <indexterm zone="mitkrb mitkrb-init">
473 <primary sortas="f-krb5">krb5</primary>
474 </indexterm>
475
476<screen role="root"><userinput>make install-krb5</userinput></screen>
477
478 </sect3>
479
480 </sect2>
481
482 <sect2 role="content">
483
484 <title>Contents</title>
485 <para></para>
486
487 <segmentedlist>
488 <segtitle>Installed Programs</segtitle>
489 <segtitle>Installed Libraries</segtitle>
490 <segtitle>Installed Directories</segtitle>
491
492 <seglistitem>
493 <seg>
494 gss-client,
495 gss-server,
496 k5srvutil,
497 kadmin,
498 kadmin.local,
499 kadmind,
500 kdb5_ldap_util (optional),
501 kdb5_util,
502 kdestroy,
503 kinit,
504 klist,
505 kpasswd,
506 kprop,
507 kpropd,
508 kproplog,
509 krb5-config,
510 krb5kdc,
511 krb5-send-pr,
512 ksu,
513 kswitch,
514 ktutil,
515 kvno,
516 sclient,
517 sim_client,
518 sim_server,
519 sserver,
520 uuclient,
521 and uuserver
522 </seg>
523 <seg>
524 libgssapi_krb5.so,
525 libgssrpc.so,
526 libk5crypto.so,
527 libkadm5clnt_mit.so,
528 libkadm5clnt.so,
529 libkadm5srv_mit.so,
530 libkadm5srv.so,
531 libkdb_ldap.so
532 (optional),
533 libkdb5.so,
534 libkrad.so,
535 libkrb5.so,
536 libkrb5support.so,
537 libverto.so,
538 and some plugins under the /usr/lib/krb5 tree
539 </seg>
540 <seg>
541 /usr/include/gssapi,
542 /usr/include/gssrpc,
543 /usr/include/kadm5,
544 /usr/include/krb5,
545 /usr/lib/krb5,
546 /usr/share/doc/krb5-&mitkrb-version;,
547 /usr/share/examples/krb5 and
548 /var/lib/krb5kdc
549 </seg>
550 </seglistitem>
551 </segmentedlist>
552
553 <variablelist>
554 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
555 <?dbfo list-presentation="list"?>
556 <?dbhtml list-presentation="table"?>
557
558 <varlistentry id="gss-client">
559 <term><command>gss-client</command></term>
560 <listitem>
561 <para>
562 is a GSSAPI test client.
563 </para>
564 <indexterm zone="mitkrb gss-client">
565 <primary sortas="b-gss-client">gss-client</primary>
566 </indexterm>
567 </listitem>
568 </varlistentry>
569
570 <varlistentry id="gss-server">
571 <term><command>gss-server</command></term>
572 <listitem>
573 <para>
574 is a GSSAPI test server.
575 </para>
576 <indexterm zone="mitkrb gss-server">
577 <primary sortas="b-gss-server">gss-server</primary>
578 </indexterm>
579 </listitem>
580 </varlistentry>
581
582 <varlistentry id="k5srvutil">
583 <term><command>k5srvutil</command></term>
584 <listitem>
585 <para>
586 is a host keytable manipulation utility.
587 </para>
588 <indexterm zone="mitkrb k5srvutil">
589 <primary sortas="b-k5srvutil">k5srvutil</primary>
590 </indexterm>
591 </listitem>
592 </varlistentry>
593
594 <varlistentry id="kadmin">
595 <term><command>kadmin</command></term>
596 <listitem>
597 <para>
598 is a utility used to make modifications
599 to the Kerberos database.
600 </para>
601 <indexterm zone="mitkrb kadmin">
602 <primary sortas="b-kadmin">kadmin</primary>
603 </indexterm>
604 </listitem>
605 </varlistentry>
606
607 <varlistentry id="kadmin.local">
608 <term><command>kadmin.local</command></term>
609 <listitem>
610 <para>
611 is a utility similar at <command>kadmin</command>, but if the
612 database is db2, the local client <command>kadmin.local</command>,
613 is intended to run directly on the master KDC without Kerberos
614 authentication.
615 </para>
616 <indexterm zone="mitkrb kadmin.local">
617 <primary sortas="b-kadmin.local">kadmin.local</primary>
618 </indexterm>
619 </listitem>
620 </varlistentry>
621
622 <varlistentry id="kadmind">
623 <term><command>kadmind</command></term>
624 <listitem>
625 <para>
626 is a server for administrative access
627 to a Kerberos database.
628 </para>
629 <indexterm zone="mitkrb kadmind">
630 <primary sortas="b-kadmind">kadmind</primary>
631 </indexterm>
632 </listitem>
633 </varlistentry>
634
635 <varlistentry id="kdb5_ldap_util">
636 <term><command>kdb5_ldap_util (optional)</command></term>
637 <listitem>
638 <para>
639 allows an administrator to manage realms, Kerberos services
640 and ticket policies.
641 </para>
642 <indexterm zone="mitkrb kdb5_ldap_util">
643 <primary sortas="b-kdb5_ldap_util">kdb5_ldap_util</primary>
644 </indexterm>
645 </listitem>
646 </varlistentry>
647
648 <varlistentry id="kdb5_util">
649 <term><command>kdb5_util</command></term>
650 <listitem>
651 <para>
652 is the KDC database utility.
653 </para>
654 <indexterm zone="mitkrb kdb5_util">
655 <primary sortas="b-kdb5_util">kdb5_util</primary>
656 </indexterm>
657 </listitem>
658 </varlistentry>
659
660 <varlistentry id="kdestroy">
661 <term><command>kdestroy</command></term>
662 <listitem>
663 <para>
664 removes the current set of tickets.
665 </para>
666 <indexterm zone="mitkrb kdestroy">
667 <primary sortas="b-kdestroy">kdestroy</primary>
668 </indexterm>
669 </listitem>
670 </varlistentry>
671
672 <varlistentry id="kinit">
673 <term><command>kinit</command></term>
674 <listitem>
675 <para>
676 is used to authenticate to the Kerberos server as a
677 principal and acquire a ticket granting ticket that can
678 later be used to obtain tickets for other services.
679 </para>
680 <indexterm zone="mitkrb kinit">
681 <primary sortas="b-kinit">kinit</primary>
682 </indexterm>
683 </listitem>
684 </varlistentry>
685
686 <varlistentry id="klist">
687 <term><command>klist</command></term>
688 <listitem>
689 <para>
690 reads and displays the current tickets in
691 the credential cache.
692 </para>
693 <indexterm zone="mitkrb klist">
694 <primary sortas="b-klist">klist</primary>
695 </indexterm>
696 </listitem>
697 </varlistentry>
698
699 <varlistentry id="kpasswd">
700 <term><command>kpasswd</command></term>
701 <listitem>
702 <para>
703 is a program for changing Kerberos 5 passwords.
704 </para>
705 <indexterm zone="mitkrb kpasswd">
706 <primary sortas="b-kpasswd">kpasswd</primary>
707 </indexterm>
708 </listitem>
709 </varlistentry>
710
711 <varlistentry id="kprop">
712 <term><command>kprop</command></term>
713 <listitem>
714 <para>
715 takes a principal database in a specified format and
716 converts it into a stream of database records.
717 </para>
718 <indexterm zone="mitkrb kprop">
719 <primary sortas="b-kprop">kprop</primary>
720 </indexterm>
721 </listitem>
722 </varlistentry>
723
724 <varlistentry id="kpropd">
725 <term><command>kpropd</command></term>
726 <listitem>
727 <para>
728 receives a database sent by <command>kprop</command>
729 and writes it as a local database.
730 </para>
731 <indexterm zone="mitkrb kpropd">
732 <primary sortas="b-kpropd">kpropd</primary>
733 </indexterm>
734 </listitem>
735 </varlistentry>
736
737 <varlistentry id="kproplog">
738 <term><command>kproplog</command></term>
739 <listitem>
740 <para>
741 displays the contents of the KDC database update log to standard
742 output.
743 </para>
744 <indexterm zone="mitkrb kproplog">
745 <primary sortas="b-kproplog">kproplog</primary>
746 </indexterm>
747 </listitem>
748 </varlistentry>
749
750 <varlistentry id="krb5-config-prog2">
751 <term><command>krb5-config</command></term>
752 <listitem>
753 <para>
754 gives information on how to link programs against
755 libraries.
756 </para>
757 <indexterm zone="mitkrb krb5-config-prog2">
758 <primary sortas="b-krb5-config">krb5-config</primary>
759 </indexterm>
760 </listitem>
761 </varlistentry>
762
763 <varlistentry id="krb5kdc">
764 <term><command>krb5kdc</command></term>
765 <listitem>
766 <para>
767 is the <application>Kerberos 5</application> server.
768 </para>
769 <indexterm zone="mitkrb krb5kdc">
770 <primary sortas="b-krb5kdc">krb5kdc</primary>
771 </indexterm>
772 </listitem>
773 </varlistentry>
774
775 <varlistentry id="krb5-send-pr">
776 <term><command>krb5-send-pr</command></term>
777 <listitem>
778 <para>
779 send problem report (PR) to a central support site.
780 </para>
781 <indexterm zone="mitkrb krb5-send-pr">
782 <primary sortas="b-krb-send-pr">krb5-send-pr</primary>
783 </indexterm>
784 </listitem>
785 </varlistentry>
786
787 <varlistentry id="ksu">
788 <term><command>ksu</command></term>
789 <listitem>
790 <para>
791 is the super user program using Kerberos protocol.
792 Requires a properly configured
793 <filename>/etc/shells</filename> and
794 <filename>~/.k5login</filename> containing principals
795 authorized to become super users.
796 </para>
797 <indexterm zone="mitkrb ksu">
798 <primary sortas="b-ksu">ksu</primary>
799 </indexterm>
800 </listitem>
801 </varlistentry>
802
803 <varlistentry id="kswitch">
804 <term><command>kswitch</command></term>
805 <listitem>
806 <para>
807 makes the specified credential cache the
808 primary cache for the collection, if a cache
809 collection is available.
810 </para>
811 <indexterm zone="mitkrb kswitch">
812 <primary sortas="b-kswitch">kswitch</primary>
813 </indexterm>
814 </listitem>
815 </varlistentry>
816
817 <varlistentry id="ktutil">
818 <term><command>ktutil</command></term>
819 <listitem>
820 <para>
821 is a program for managing Kerberos keytabs.
822 </para>
823 <indexterm zone="mitkrb ktutil">
824 <primary sortas="b-ktutil">ktutil</primary>
825 </indexterm>
826 </listitem>
827 </varlistentry>
828
829 <varlistentry id="kvno">
830 <term><command>kvno</command></term>
831 <listitem>
832 <para>
833 prints keyversion numbers of Kerberos principals.
834 </para>
835 <indexterm zone="mitkrb kvno">
836 <primary sortas="b-kvno">kvno</primary>
837 </indexterm>
838 </listitem>
839 </varlistentry>
840
841 <varlistentry id="sclient">
842 <term><command>sclient</command></term>
843 <listitem>
844 <para>
845 used to contact a sample server and authenticate to it
846 using Kerberos 5 tickets, then display the server's
847 response.
848 </para>
849 <indexterm zone="mitkrb sclient">
850 <primary sortas="b-sclient">sclient</primary>
851 </indexterm>
852 </listitem>
853 </varlistentry>
854
855 <varlistentry id="sim_client">
856 <term><command>sim_client</command></term>
857 <listitem>
858 <para>
859 is a simple UDP-based sample client program, for
860 demonstration.
861 </para>
862 <indexterm zone="mitkrb sim_client">
863 <primary sortas="b-sim_client">sim_client</primary>
864 </indexterm>
865 </listitem>
866 </varlistentry>
867
868 <varlistentry id="sim_server">
869 <term><command>sim_server</command></term>
870 <listitem>
871 <para>
872 is a simple UDP-based server application, for
873 demonstration.
874 </para>
875 <indexterm zone="mitkrb sim_server">
876 <primary sortas="b-sim_server">sim_server</primary>
877 </indexterm>
878 </listitem>
879 </varlistentry>
880
881 <varlistentry id="sserver">
882 <term><command>sserver</command></term>
883 <listitem>
884 <para>
885 is the sample Kerberos 5 server.
886 </para>
887 <indexterm zone="mitkrb sserver">
888 <primary sortas="b-sserver">sserver</primary>
889 </indexterm>
890 </listitem>
891 </varlistentry>
892
893 <varlistentry id="uuclient">
894 <term><command>uuclient</command></term>
895 <listitem>
896 <para>
897 is an another sample client.
898 </para>
899 <indexterm zone="mitkrb uuclient">
900 <primary sortas="b-uuclient">uuclient</primary>
901 </indexterm>
902 </listitem>
903 </varlistentry>
904
905 <varlistentry id="uuserver">
906 <term><command>uuserver</command></term>
907 <listitem>
908 <para>
909 is an another sample server.
910 </para>
911 <indexterm zone="mitkrb uuserver">
912 <primary sortas="b-uuserver">uuserver</primary>
913 </indexterm>
914 </listitem>
915 </varlistentry>
916
917
918 <varlistentry id="libgssapi_krb5">
919 <term><filename class="libraryfile">libgssapi_krb5.so</filename></term>
920 <listitem>
921 <para>
922 contain the Generic Security Service Application Programming
923 Interface (GSSAPI) functions which provides security services
924 to callers in a generic fashion, supportable with a range of
925 underlying mechanisms and technologies and hence allowing
926 source-level portability of applications to different
927 environments.
928 </para>
929 <indexterm zone="mitkrb libgssapi_krb5">
930 <primary sortas="c-libgssapi_krb5">libgssapi_krb5.so</primary>
931 </indexterm>
932 </listitem>
933 </varlistentry>
934
935 <varlistentry id="libkadm5clnt">
936 <term><filename class="libraryfile">libkadm5clnt.so</filename></term>
937 <listitem>
938 <para>
939 contains the administrative authentication and password checking
940 functions required by Kerberos 5 client-side programs.
941 </para>
942 <indexterm zone="mitkrb libkadm5clnt">
943 <primary sortas="c-libkadm5clnt">libkadm5clnt.so</primary>
944 </indexterm>
945 </listitem>
946 </varlistentry>
947
948 <varlistentry id="libkadm5srv">
949 <term><filename class="libraryfile">libkadm5srv.so</filename></term>
950 <listitem>
951 <para>
952 contain the administrative authentication and password
953 checking functions required by Kerberos 5 servers.
954 </para>
955 <indexterm zone="mitkrb libkadm5srv">
956 <primary sortas="c-libkadm5srv">libkadm5srv.so</primary>
957 </indexterm>
958 </listitem>
959 </varlistentry>
960
961 <varlistentry id="libkdb5">
962 <term><filename class="libraryfile">libkdb5.so</filename></term>
963 <listitem>
964 <para>
965 is a Kerberos 5 authentication/authorization database
966 access library.
967 </para>
968 <indexterm zone="mitkrb libkdb5">
969 <primary sortas="c-libkdb5">libkdb5.so</primary>
970 </indexterm>
971 </listitem>
972 </varlistentry>
973
974 <varlistentry id="libkrad">
975 <term><filename class="libraryfile">libkrad.so</filename></term>
976 <listitem>
977 <para>
978 contains the internal support library for RADIUS functionality.
979 </para>
980 <indexterm zone="mitkrb libkrad">
981 <primary sortas="c-libkrad">libkrad.so</primary>
982 </indexterm>
983 </listitem>
984 </varlistentry>
985
986 <varlistentry id="libkrb5">
987 <term><filename class="libraryfile">libkrb5.so</filename></term>
988 <listitem>
989 <para>
990 is an all-purpose <application>Kerberos 5</application> library.
991 </para>
992 <indexterm zone="mitkrb libkrb5">
993 <primary sortas="c-libkrb5">libkrb5.so</primary>
994 </indexterm>
995 </listitem>
996 </varlistentry>
997
998 </variablelist>
999
1000 </sect2>
1001
1002</sect1>
Note: See TracBrowser for help on using the repository browser.