source: postlfs/security/mitkrb.xml@ 5c4a616

10.1 11.0 11.1 11.2 11.3 12.0 12.1 kea ken/TL2024 ken/inkscape-core-mods ken/tuningfonts lazarus lxqt plabs/newcss plabs/python-mods python3.11 qt5new rahul/power-profiles-daemon renodr/vulkan-addition trunk upgradedb xry111/intltool xry111/llvm18 xry111/soup3 xry111/test-20220226 xry111/xf86-video-removal
Last change on this file since 5c4a616 was 5c4a616, checked in by Douglas R. Reno <renodr@…>, 3 years ago

Update to JasPer-2.0.24 (Security Update - 25 vulnerabilities fixed)
Update to glib-2.66.6 (Critical security update)
Update to audacious (and audacious-plugins) 4.1
Update to libevdev-1.11.0
Update to cbindgen-0.17.0
Update to poppler-21.02.0
Update to krb5-1.19
Update to Jinja2-2.11.3 (Python Module)
Update to mousepad-0.5.2

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@24174 af4574ff-66df-0310-9fd7-8a98e5e911e0
  • Property mode set to 100644
File size: 32.1 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY mitkrb-download-http "https://kerberos.org/dist/krb5/&mitkrb-major-version;/krb5-&mitkrb-version;.tar.gz">
8 <!ENTITY mitkrb-download-ftp " ">
9 <!ENTITY mitkrb-md5sum "aaf18447a5a014aa3b7e81814923f4c9">
10 <!ENTITY mitkrb-size "8.3 MB">
11 <!ENTITY mitkrb-buildsize "139 MB (add 24 MB for tests)">
12 <!ENTITY mitkrb-time "0.8 SBU (add 3.4 SBU for tests)">
13]>
14
15<sect1 id="mitkrb" xreflabel="MIT Kerberos V5-&mitkrb-version;">
16 <?dbhtml filename="mitkrb.html"?>
17
18 <sect1info>
19 <othername>$LastChangedBy$</othername>
20 <date>$Date$</date>
21 </sect1info>
22
23 <title>MIT Kerberos V5-&mitkrb-version;</title>
24
25 <indexterm zone="mitkrb">
26 <primary sortas="a-MIT-Kerberos">MIT Kerberos V5</primary>
27 </indexterm>
28
29 <sect2 role="package">
30 <title>Introduction to MIT Kerberos V5</title>
31
32 <para>
33 <application>MIT Kerberos V5</application> is a free implementation
34 of Kerberos 5. Kerberos is a network authentication protocol. It
35 centralizes the authentication database and uses kerberized
36 applications to work with servers or services that support Kerberos
37 allowing single logins and encrypted communication over internal
38 networks or the Internet.
39 </para>
40
41 &lfs10_checked;
42
43 <bridgehead renderas="sect3">Package Information</bridgehead>
44 <itemizedlist spacing="compact">
45 <listitem>
46 <para>
47 Download (HTTP): <ulink url="&mitkrb-download-http;"/>
48 </para>
49 </listitem>
50 <listitem>
51 <para>
52 Download (FTP): <ulink url="&mitkrb-download-ftp;"/>
53 </para>
54 </listitem>
55 <listitem>
56 <para>
57 Download MD5 sum: &mitkrb-md5sum;
58 </para>
59 </listitem>
60 <listitem>
61 <para>
62 Download size: &mitkrb-size;
63 </para>
64 </listitem>
65 <listitem>
66 <para>
67 Estimated disk space required: &mitkrb-buildsize;
68 </para>
69 </listitem>
70 <listitem>
71 <para>
72 Estimated build time: &mitkrb-time;
73 </para>
74 </listitem>
75 </itemizedlist>
76
77 <bridgehead renderas="sect3">MIT Kerberos V5 Dependencies</bridgehead>
78
79 <bridgehead renderas="sect4">Optional</bridgehead>
80 <para role="optional">
81 <!-- <xref linkend="dejagnu"/> (for full test coverage), -->
82 <xref linkend="bind-utils"/>,
83 <xref linkend="gnupg2"/> (to authenticate the package),
84 <xref linkend="keyutils"/>,
85 <xref linkend="openldap"/>,<!-- Seems so that mit has its own
86 implementation of rpc now.
87 <xref linkend="rpcbind"/> (used during the testsuite),-->
88 <xref linkend="valgrind"/> (used during the testsuite),
89 <xref linkend="yasm"/>,
90 <ulink url="http://thrysoee.dk/editline/">libedit</ulink>,
91 <ulink url="https://cmocka.org/">cmocka</ulink>,
92 <ulink url="https://pypi.org/project/pyrad/">pyrad</ulink>, and
93 <ulink url="https://cwrap.org/resolv_wrapper.html">resolv_wrapper</ulink>
94 </para>
95
96 <note>
97 <para>
98 Some sort of time synchronization facility on your system (like
99 <xref linkend="ntp"/>) is required since Kerberos won't authenticate
100 if there is a time difference between a kerberized client and the
101 KDC server.
102 </para>
103 </note>
104
105 <para condition="html" role="usernotes">User Notes:
106 <ulink url="&blfs-wiki;/mitkrb"/>
107 </para>
108 </sect2>
109
110 <sect2 role="installation">
111 <title>Installation of MIT Kerberos V5</title>
112
113 <para>
114 Build <application>MIT Kerberos V5</application> by running the
115 following commands:
116 </para>
117
118<screen><userinput>cd src &amp;&amp;
119
120sed -i -e 's@\^u}@^u cols 300}@' tests/dejagnu/config/default.exp &amp;&amp;
121sed -i -e '/eq 0/{N;s/12 //}' plugins/kdb/db2/libdb2/test/run.test &amp;&amp;
122sed -i '/t_iprop.py/d' tests/Makefile.in &amp;&amp;
123
124./configure --prefix=/usr \
125 --sysconfdir=/etc \
126 --localstatedir=/var/lib \
127 --runstatedir=/run \
128 --with-system-et \
129 --with-system-ss \
130 --with-system-verto=no \
131 --enable-dns-for-realm &amp;&amp;
132make</userinput></screen>
133
134 <para>
135 To test the build, issue as the <systemitem
136 class="username">root</systemitem> user: <command>make -k -j1 check</command>.
137 <!-- You need at least <xref link end="tcl"/>, which is used to drive the
138 testsuite. Furthermore, <xref link end="dejagnu"/> must be available for
139 some of the tests to run.--> If you have a former version of MIT Kerberos V5
140 installed, it may happen that the test suite may pick up the installed
141 versions of the libraries, rather than the newly built ones. If so, it is
142 better to run the tests after the installation.
143 <!-- Note: on my laptop -j8 fails but -j1 passes -->
144 </para>
145
146 <para>
147 Now, as the <systemitem class="username">root</systemitem> user:
148 </para>
149
150<screen role="root"><userinput>make install &amp;&amp;
151
152for f in gssapi_krb5 gssrpc k5crypto kadm5clnt kadm5srv \
153 kdb5 kdb_ldap krad krb5 krb5support verto ; do
154
155 find /usr/lib -type f -name "lib$f*.so*" -exec chmod -v 755 {} \;
156done &amp;&amp;
157
158mv -v /usr/lib/libkrb5.so.3* /lib &amp;&amp;
159mv -v /usr/lib/libk5crypto.so.3* /lib &amp;&amp;
160mv -v /usr/lib/libkrb5support.so.0* /lib &amp;&amp;
161
162ln -v -sf ../../lib/libkrb5.so.3.3 /usr/lib/libkrb5.so &amp;&amp;
163ln -v -sf ../../lib/libk5crypto.so.3.1 /usr/lib/libk5crypto.so &amp;&amp;
164ln -v -sf ../../lib/libkrb5support.so.0.1 /usr/lib/libkrb5support.so &amp;&amp;
165
166mv -v /usr/bin/ksu /bin &amp;&amp;
167chmod -v 755 /bin/ksu &amp;&amp;
168
169install -v -dm755 /usr/share/doc/krb5-&mitkrb-version; &amp;&amp;
170cp -vfr ../doc/* /usr/share/doc/krb5-&mitkrb-version;</userinput></screen>
171
172 </sect2>
173
174 <sect2 role="commands">
175 <title>Command Explanations</title>
176
177 <para>
178 The first <command>sed</command> increases the width of the virtual
179 terminal used for some tests to prevent some spurious text in the output
180 which is taken as a failure. The second <command>sed</command> removes a
181 test that is known to fail. The third <command>sed</command> removes a
182 test that is known to hang.
183 </para>
184
185 <para>
186 <parameter>--localstatedir=/var/lib</parameter>: This option is
187 used so that the Kerberos variable runtime data is located in
188 <filename class="directory">/var/lib</filename> instead of
189 <filename class="directory">/usr/var</filename>.
190 </para>
191
192 <para>
193 <parameter>--runstatedir=/run</parameter>: This option is used so that
194 the Kerberos runtime state information is located in
195 <filename class="directory">/run</filename> instead of the deprecated
196 <filename class="directory">/var/run</filename>.
197 </para>
198
199 <para>
200 <parameter>--with-system-et</parameter>: This switch causes the build
201 to use the system-installed versions of the error-table support
202 software.
203 </para>
204
205 <para>
206 <parameter>--with-system-ss</parameter>: This switch causes the build
207 to use the system-installed versions of the subsystem command-line
208 interface software.
209 </para>
210
211 <para>
212 <parameter>--with-system-verto=no</parameter>: This switch fixes a bug in
213 the package: it does not recognize its own verto library installed
214 previously. This is not a problem, if reinstalling the same version,
215 but if you are updating, the old library is used as system's one,
216 instead of installing the new version.
217 </para>
218
219 <para>
220 <parameter>--enable-dns-for-realm</parameter>: This switch allows
221 realms to be resolved using the DNS server.
222 </para>
223
224 <para>
225 <option>--with-ldap</option>: Use this switch if you want to compile the
226 <application>OpenLDAP</application> database backend module.
227 </para>
228
229 <para>
230 <command>mv -v /usr/lib/libk... /lib </command> and
231 <command>ln -v -sf ../../lib/libk... /usr/lib/libk...</command>:
232 Move critical libraries to the
233 <filename class="directory">/lib</filename> directory so that they are
234 available when the <filename class="directory">/usr</filename>
235 filesystem is not mounted.
236 </para>
237
238 <para>
239 <command>find /usr/lib -type f -name "lib$f*.so*" -exec chmod -v 755 {} \;</command>:
240 This command changes the permisison of installed libraries.
241 </para>
242
243 <para>
244 <command>mv -v /usr/bin/ksu /bin</command>: Moves the
245 <command>ksu</command> program to the
246 <filename class="directory">/bin</filename> directory so that it is
247 available when the <filename class="directory">/usr</filename>
248 filesystem is not mounted.
249 </para>
250
251 </sect2>
252
253 <sect2 role="configuration">
254 <title>Configuring MIT Kerberos V5</title>
255
256 <sect3 id="krb5-config">
257 <title>Config Files</title>
258
259 <para>
260 <filename>/etc/krb5.conf</filename> and
261 <filename>/var/lib/krb5kdc/kdc.conf</filename>
262 </para>
263
264 <indexterm zone="mitkrb krb5-config">
265 <primary sortas="e-etc-krb5.conf">/etc/krb5.conf</primary>
266 </indexterm>
267
268 <indexterm zone="mitkrb krb5-config">
269 <primary sortas="e-var-lib-krb5kdc-kdc.conf">/var/lib/krb5kdc/kdc.conf</primary>
270 </indexterm>
271
272 </sect3>
273
274 <sect3>
275 <title>Configuration Information</title>
276
277 <sect4>
278 <title>Kerberos Configuration</title>
279
280 <tip>
281 <para>
282 You should consider installing some sort of password checking
283 dictionary so that you can configure the installation to only
284 accept strong passwords. A suitable dictionary to use is shown in
285 the <xref linkend="cracklib"/> instructions. Note that only one
286 file can be used, but you can concatenate many files into one. The
287 configuration file shown below assumes you have installed a
288 dictionary to <filename>/usr/share/dict/words</filename>.
289 </para>
290 </tip>
291
292 <para>
293 Create the Kerberos configuration file with the following
294 commands issued by the <systemitem class="username">root</systemitem>
295 user:
296 </para>
297
298<screen role="root"><userinput>cat &gt; /etc/krb5.conf &lt;&lt; "EOF"
299<literal># Begin /etc/krb5.conf
300
301[libdefaults]
302 default_realm = <replaceable>&lt;EXAMPLE.ORG&gt;</replaceable>
303 encrypt = true
304
305[realms]
306 <replaceable>&lt;EXAMPLE.ORG&gt;</replaceable> = {
307 kdc = <replaceable>&lt;belgarath.example.org&gt;</replaceable>
308 admin_server = <replaceable>&lt;belgarath.example.org&gt;</replaceable>
309 dict_file = /usr/share/dict/words
310 }
311
312[domain_realm]
313 .<replaceable>&lt;example.org&gt;</replaceable> = <replaceable>&lt;EXAMPLE.ORG&gt;</replaceable>
314
315[logging]
316 kdc = SYSLOG:INFO:AUTH
317 admin_server = SYSLOG:INFO:AUTH
318 default = SYSLOG:DEBUG:DAEMON
319
320# End /etc/krb5.conf</literal>
321EOF</userinput></screen>
322
323 <para>
324 You will need to substitute your domain and proper hostname for the
325 occurrences of the <replaceable>&lt;belgarath&gt;</replaceable> and
326 <replaceable>&lt;example.org&gt;</replaceable> names.
327 </para>
328
329 <para>
330 <option>default_realm</option> should be the name of your
331 domain changed to ALL CAPS. This isn't required, but both
332 <application>Heimdal</application> and MIT recommend it.
333 </para>
334
335 <para>
336 <option>encrypt = true</option> provides encryption of all traffic
337 between kerberized clients and servers. It's not necessary and can
338 be left off. If you leave it off, you can encrypt all traffic from
339 the client to the server using a switch on the client program
340 instead.
341 </para>
342
343 <para>
344 The <option>[realms]</option> parameters tell the client programs
345 where to look for the KDC authentication services.
346 </para>
347
348 <para>
349 The <option>[domain_realm]</option> section maps a domain to a realm.
350 </para>
351
352 <para>
353 Create the KDC database:
354 </para>
355
356<screen role="root"><userinput>kdb5_util create -r <replaceable>&lt;EXAMPLE.ORG&gt;</replaceable> -s</userinput></screen>
357
358 <para>
359 Now you should populate the database with principals
360 (users). For now, just use your regular login name or
361 <systemitem class="username">root</systemitem>.
362 </para>
363
364<screen role="root"><userinput>kadmin.local
365<prompt>kadmin.local:</prompt> add_policy dict-only
366<prompt>kadmin.local:</prompt> addprinc -policy dict-only <replaceable>&lt;loginname&gt;</replaceable></userinput></screen>
367
368 <para>
369 The KDC server and any machine running kerberized
370 server daemons must have a host key installed:
371 </para>
372
373<screen role="root"><userinput><prompt>kadmin.local:</prompt> addprinc -randkey host/<replaceable>&lt;belgarath.example.org&gt;</replaceable></userinput></screen>
374
375 <para>
376 After choosing the defaults when prompted, you will have to
377 export the data to a keytab file:
378 </para>
379
380<screen role="root"><userinput><prompt>kadmin.local:</prompt> ktadd host/<replaceable>&lt;belgarath.example.org&gt;</replaceable></userinput></screen>
381
382 <para>
383 This should have created a file in
384 <filename class="directory">/etc</filename> named
385 <filename>krb5.keytab</filename> (Kerberos 5). This file should
386 have 600 (<systemitem class="username">root</systemitem> rw only)
387 permissions. Keeping the keytab files from public access is crucial
388 to the overall security of the Kerberos installation.
389 </para>
390
391 <para>
392 Exit the <command>kadmin</command> program (use
393 <command>quit</command> or <command>exit</command>) and return
394 back to the shell prompt. Start the KDC daemon manually, just to
395 test out the installation:
396 </para>
397
398<screen role="root"><userinput>/usr/sbin/krb5kdc</userinput></screen>
399
400 <para>
401 Attempt to get a ticket with the following command:
402 </para>
403
404<screen><userinput>kinit <replaceable>&lt;loginname&gt;</replaceable></userinput></screen>
405
406 <para>
407 You will be prompted for the password you created. After you
408 get your ticket, you can list it with the following command:
409 </para>
410
411<screen><userinput>klist</userinput></screen>
412
413 <para>
414 Information about the ticket should be displayed on the
415 screen.
416 </para>
417
418 <para>
419 To test the functionality of the keytab file, issue the
420 following command as the
421 <systemitem class="username">root</systemitem> user:
422 </para>
423
424<screen role="root"><userinput>ktutil
425<prompt>ktutil:</prompt> rkt /etc/krb5.keytab
426<prompt>ktutil:</prompt> l</userinput></screen>
427
428 <para>
429 This should dump a list of the host principal, along with
430 the encryption methods used to access the principal.
431 </para>
432
433 <para>
434 Create an empty ACL file that can be modified later:
435 </para>
436
437<screen role="root"><userinput>touch /var/lib/krb5kdc/kadm5.acl</userinput></screen>
438
439 <para>
440 At this point, if everything has been successful so far, you
441 can feel fairly confident in the installation and configuration of
442 the package.
443 </para>
444
445 </sect4>
446
447 <sect4>
448 <title>Additional Information</title>
449
450 <para>
451 For additional information consult the <ulink
452 url="http://web.mit.edu/kerberos/www/krb5-&mitkrb-major-version;/#documentation">
453 documentation for krb5-&mitkrb-version;</ulink> on which the above
454 instructions are based.
455 </para>
456
457 </sect4>
458
459 </sect3>
460
461 <sect3 id="mitkrb-init">
462 <title><phrase revision="sysv">Init Script</phrase>
463 <phrase revision="systemd">Systemd Unit</phrase></title>
464
465 <para revision="sysv">
466 If you want to start <application>Kerberos</application> services
467 at boot, install the <filename>/etc/rc.d/init.d/krb5</filename> init
468 script included in the <xref linkend="bootscripts"/> package using
469 the following command:
470 </para>
471
472 <para revision="systemd">
473 If you want to start <application>Kerberos</application> services
474 at boot, install the <filename>krb5.service</filename> unit included in
475 the <xref linkend="systemd-units"/> package using the following command:
476 </para>
477
478 <indexterm zone="mitkrb mitkrb-init">
479 <primary sortas="f-krb5">krb5</primary>
480 </indexterm>
481
482<screen role="root"><userinput>make install-krb5</userinput></screen>
483
484 </sect3>
485
486 </sect2>
487
488 <sect2 role="content">
489
490 <title>Contents</title>
491
492 <segmentedlist>
493 <segtitle>Installed Programs</segtitle>
494 <segtitle>Installed Libraries</segtitle>
495 <segtitle>Installed Directories</segtitle>
496
497 <seglistitem>
498 <seg>
499 gss-client, gss-server, k5srvutil, kadmin, kadmin.local,
500 kadmind, kdb5_ldap_util (optional), kdb5_util, kdestroy, kinit, klist,
501 kpasswd, kprop, kpropd, kproplog, krb5-config, krb5-send-pr, krb5kdc,
502 ksu, kswitch, ktutil, kvno, sclient, sim_client, sim_server,
503 sserver, uuclient, and uuserver
504 </seg>
505 <seg>
506 libgssapi_krb5.so, libgssrpc.so, libk5crypto.so, libkadm5clnt_mit.so,
507 libkadm5clnt.so, libkadm5srv_mit.so, libkadm5srv.so, libkdb_ldap.so
508 (optional), libkdb5.so, libkrad.so, libkrb5.so, libkrb5support.so,
509 libverto.so, and some plugins under the /usr/lib/krb5 tree
510 </seg>
511 <seg>
512 /usr/include/{gssapi,gssrpc,kadm5,krb5},
513 /usr/lib/krb5,
514 /usr/share/{doc/krb5-&mitkrb-version;,examples/krb5},
515 /var/lib/krb5kdc, and
516 /run/krb5kdc
517 </seg>
518 </seglistitem>
519 </segmentedlist>
520
521 <variablelist>
522 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
523 <?dbfo list-presentation="list"?>
524 <?dbhtml list-presentation="table"?>
525
526 <varlistentry id="gss-client">
527 <term><command>gss-client</command></term>
528 <listitem>
529 <para>
530 is a GSSAPI test client.
531 </para>
532 <indexterm zone="mitkrb gss-client">
533 <primary sortas="b-gss-client">gss-client</primary>
534 </indexterm>
535 </listitem>
536 </varlistentry>
537
538 <varlistentry id="gss-server">
539 <term><command>gss-server</command></term>
540 <listitem>
541 <para>
542 is a GSSAPI test server.
543 </para>
544 <indexterm zone="mitkrb gss-server">
545 <primary sortas="b-gss-server">gss-server</primary>
546 </indexterm>
547 </listitem>
548 </varlistentry>
549
550 <varlistentry id="k5srvutil">
551 <term><command>k5srvutil</command></term>
552 <listitem>
553 <para>
554 is a host keytable manipulation utility.
555 </para>
556 <indexterm zone="mitkrb k5srvutil">
557 <primary sortas="b-k5srvutil">k5srvutil</primary>
558 </indexterm>
559 </listitem>
560 </varlistentry>
561
562 <varlistentry id="kadmin">
563 <term><command>kadmin</command></term>
564 <listitem>
565 <para>
566 is an utility used to make modifications
567 to the Kerberos database.
568 </para>
569 <indexterm zone="mitkrb kadmin">
570 <primary sortas="b-kadmin">kadmin</primary>
571 </indexterm>
572 </listitem>
573 </varlistentry>
574
575 <varlistentry id="kadmin.local">
576 <term><command>kadmin.local</command></term>
577 <listitem>
578 <para>
579 is an utility similar to <command>kadmin</command>, but if the
580 database is db2, the local client <command>kadmin.local</command>,
581 is intended to run directly on the master KDC without Kerberos
582 authentication.
583 </para>
584 <indexterm zone="mitkrb kadmin.local">
585 <primary sortas="b-kadmin.local">kadmin.local</primary>
586 </indexterm>
587 </listitem>
588 </varlistentry>
589
590 <varlistentry id="kadmind">
591 <term><command>kadmind</command></term>
592 <listitem>
593 <para>
594 is a server for administrative access
595 to a Kerberos database.
596 </para>
597 <indexterm zone="mitkrb kadmind">
598 <primary sortas="b-kadmind">kadmind</primary>
599 </indexterm>
600 </listitem>
601 </varlistentry>
602
603 <varlistentry id="kdb5_ldap_util">
604 <term><command>kdb5_ldap_util (optional)</command></term>
605 <listitem>
606 <para>
607 allows an administrator to manage realms, Kerberos services
608 and ticket policies.
609 </para>
610 <indexterm zone="mitkrb kdb5_ldap_util">
611 <primary sortas="b-kdb5_ldap_util">kdb5_ldap_util</primary>
612 </indexterm>
613 </listitem>
614 </varlistentry>
615
616 <varlistentry id="kdb5_util">
617 <term><command>kdb5_util</command></term>
618 <listitem>
619 <para>
620 is the KDC database utility.
621 </para>
622 <indexterm zone="mitkrb kdb5_util">
623 <primary sortas="b-kdb5_util">kdb5_util</primary>
624 </indexterm>
625 </listitem>
626 </varlistentry>
627
628 <varlistentry id="kdestroy">
629 <term><command>kdestroy</command></term>
630 <listitem>
631 <para>
632 removes the current set of tickets.
633 </para>
634 <indexterm zone="mitkrb kdestroy">
635 <primary sortas="b-kdestroy">kdestroy</primary>
636 </indexterm>
637 </listitem>
638 </varlistentry>
639
640 <varlistentry id="kinit">
641 <term><command>kinit</command></term>
642 <listitem>
643 <para>
644 is used to authenticate to the Kerberos server as a
645 principal and acquire a ticket granting ticket that can
646 later be used to obtain tickets for other services.
647 </para>
648 <indexterm zone="mitkrb kinit">
649 <primary sortas="b-kinit">kinit</primary>
650 </indexterm>
651 </listitem>
652 </varlistentry>
653
654 <varlistentry id="klist">
655 <term><command>klist</command></term>
656 <listitem>
657 <para>
658 reads and displays the current tickets in
659 the credential cache.
660 </para>
661 <indexterm zone="mitkrb klist">
662 <primary sortas="b-klist">klist</primary>
663 </indexterm>
664 </listitem>
665 </varlistentry>
666
667 <varlistentry id="kpasswd">
668 <term><command>kpasswd</command></term>
669 <listitem>
670 <para>
671 is a program for changing Kerberos 5 passwords.
672 </para>
673 <indexterm zone="mitkrb kpasswd">
674 <primary sortas="b-kpasswd">kpasswd</primary>
675 </indexterm>
676 </listitem>
677 </varlistentry>
678
679 <varlistentry id="kprop">
680 <term><command>kprop</command></term>
681 <listitem>
682 <para>
683 takes a principal database in a specified format and
684 converts it into a stream of database records.
685 </para>
686 <indexterm zone="mitkrb kprop">
687 <primary sortas="b-kprop">kprop</primary>
688 </indexterm>
689 </listitem>
690 </varlistentry>
691
692 <varlistentry id="kpropd">
693 <term><command>kpropd</command></term>
694 <listitem>
695 <para>
696 receives a database sent by <command>kprop</command>
697 and writes it as a local database.
698 </para>
699 <indexterm zone="mitkrb kpropd">
700 <primary sortas="b-kpropd">kpropd</primary>
701 </indexterm>
702 </listitem>
703 </varlistentry>
704
705 <varlistentry id="kproplog">
706 <term><command>kproplog</command></term>
707 <listitem>
708 <para>
709 displays the contents of the KDC database update log to standard
710 output.
711 </para>
712 <indexterm zone="mitkrb kproplog">
713 <primary sortas="b-kproplog">kproplog</primary>
714 </indexterm>
715 </listitem>
716 </varlistentry>
717
718 <varlistentry id="krb5-config-prog2">
719 <term><command>krb5-config</command></term>
720 <listitem>
721 <para>
722 gives information on how to link programs against
723 libraries.
724 </para>
725 <indexterm zone="mitkrb krb5-config-prog2">
726 <primary sortas="b-krb5-config">krb5-config</primary>
727 </indexterm>
728 </listitem>
729 </varlistentry>
730
731 <varlistentry id="krb5kdc">
732 <term><command>krb5kdc</command></term>
733 <listitem>
734 <para>
735 is the <application>Kerberos 5</application> server.
736 </para>
737 <indexterm zone="mitkrb krb5kdc">
738 <primary sortas="b-krb5kdc">krb5kdc</primary>
739 </indexterm>
740 </listitem>
741 </varlistentry>
742
743 <varlistentry id="krb5-send-pr">
744 <term><command>krb5-send-pr</command></term>
745 <listitem>
746 <para>
747 sends a problem report (PR) to a central support site.
748 </para>
749 <indexterm zone="mitkrb krb5-send-pr">
750 <primary sortas="b-krb-send-pr">krb5-send-pr</primary>
751 </indexterm>
752 </listitem>
753 </varlistentry>
754
755 <varlistentry id="ksu">
756 <term><command>ksu</command></term>
757 <listitem>
758 <para>
759 is the super user program using Kerberos protocol.
760 Requires a properly configured
761 <filename>/etc/shells</filename> and
762 <filename>~/.k5login</filename> containing principals
763 authorized to become super users.
764 </para>
765 <indexterm zone="mitkrb ksu">
766 <primary sortas="b-ksu">ksu</primary>
767 </indexterm>
768 </listitem>
769 </varlistentry>
770
771 <varlistentry id="kswitch">
772 <term><command>kswitch</command></term>
773 <listitem>
774 <para>
775 makes the specified credential cache the
776 primary cache for the collection, if a cache
777 collection is available.
778 </para>
779 <indexterm zone="mitkrb kswitch">
780 <primary sortas="b-kswitch">kswitch</primary>
781 </indexterm>
782 </listitem>
783 </varlistentry>
784
785 <varlistentry id="ktutil">
786 <term><command>ktutil</command></term>
787 <listitem>
788 <para>
789 is a program for managing Kerberos keytabs.
790 </para>
791 <indexterm zone="mitkrb ktutil">
792 <primary sortas="b-ktutil">ktutil</primary>
793 </indexterm>
794 </listitem>
795 </varlistentry>
796
797 <varlistentry id="kvno">
798 <term><command>kvno</command></term>
799 <listitem>
800 <para>
801 prints keyversion numbers of Kerberos principals.
802 </para>
803 <indexterm zone="mitkrb kvno">
804 <primary sortas="b-kvno">kvno</primary>
805 </indexterm>
806 </listitem>
807 </varlistentry>
808
809 <varlistentry id="sclient">
810 <term><command>sclient</command></term>
811 <listitem>
812 <para>
813 is used to contact a sample server and authenticate to it
814 using Kerberos 5 tickets, then display the server's
815 response.
816 </para>
817 <indexterm zone="mitkrb sclient">
818 <primary sortas="b-sclient">sclient</primary>
819 </indexterm>
820 </listitem>
821 </varlistentry>
822
823 <varlistentry id="sim_client">
824 <term><command>sim_client</command></term>
825 <listitem>
826 <para>
827 is a simple UDP-based sample client program, for
828 demonstration.
829 </para>
830 <indexterm zone="mitkrb sim_client">
831 <primary sortas="b-sim_client">sim_client</primary>
832 </indexterm>
833 </listitem>
834 </varlistentry>
835
836 <varlistentry id="sim_server">
837 <term><command>sim_server</command></term>
838 <listitem>
839 <para>
840 is a simple UDP-based server application, for
841 demonstration.
842 </para>
843 <indexterm zone="mitkrb sim_server">
844 <primary sortas="b-sim_server">sim_server</primary>
845 </indexterm>
846 </listitem>
847 </varlistentry>
848
849 <varlistentry id="sserver">
850 <term><command>sserver</command></term>
851 <listitem>
852 <para>
853 is the sample Kerberos 5 server.
854 </para>
855 <indexterm zone="mitkrb sserver">
856 <primary sortas="b-sserver">sserver</primary>
857 </indexterm>
858 </listitem>
859 </varlistentry>
860
861 <varlistentry id="uuclient">
862 <term><command>uuclient</command></term>
863 <listitem>
864 <para>
865 is another sample client.
866 </para>
867 <indexterm zone="mitkrb uuclient">
868 <primary sortas="b-uuclient">uuclient</primary>
869 </indexterm>
870 </listitem>
871 </varlistentry>
872
873 <varlistentry id="uuserver">
874 <term><command>uuserver</command></term>
875 <listitem>
876 <para>
877 is another sample server.
878 </para>
879 <indexterm zone="mitkrb uuserver">
880 <primary sortas="b-uuserver">uuserver</primary>
881 </indexterm>
882 </listitem>
883 </varlistentry>
884
885
886 <varlistentry id="libgssapi_krb5">
887 <term><filename class="libraryfile">libgssapi_krb5.so</filename></term>
888 <listitem>
889 <para>
890 contains the Generic Security Service Application Programming
891 Interface (GSSAPI) functions which provides security services
892 to callers in a generic fashion, supportable with a range of
893 underlying mechanisms and technologies and hence allowing
894 source-level portability of applications to different
895 environments.
896 </para>
897 <indexterm zone="mitkrb libgssapi_krb5">
898 <primary sortas="c-libgssapi_krb5">libgssapi_krb5.so</primary>
899 </indexterm>
900 </listitem>
901 </varlistentry>
902
903 <varlistentry id="libkadm5clnt">
904 <term><filename class="libraryfile">libkadm5clnt.so</filename></term>
905 <listitem>
906 <para>
907 contains the administrative authentication and password checking
908 functions required by Kerberos 5 client-side programs.
909 </para>
910 <indexterm zone="mitkrb libkadm5clnt">
911 <primary sortas="c-libkadm5clnt">libkadm5clnt.so</primary>
912 </indexterm>
913 </listitem>
914 </varlistentry>
915
916 <varlistentry id="libkadm5srv">
917 <term><filename class="libraryfile">libkadm5srv.so</filename></term>
918 <listitem>
919 <para>
920 contains the administrative authentication and password
921 checking functions required by Kerberos 5 servers.
922 </para>
923 <indexterm zone="mitkrb libkadm5srv">
924 <primary sortas="c-libkadm5srv">libkadm5srv.so</primary>
925 </indexterm>
926 </listitem>
927 </varlistentry>
928
929 <varlistentry id="libkdb5">
930 <term><filename class="libraryfile">libkdb5.so</filename></term>
931 <listitem>
932 <para>
933 is a Kerberos 5 authentication/authorization database
934 access library.
935 </para>
936 <indexterm zone="mitkrb libkdb5">
937 <primary sortas="c-libkdb5">libkdb5.so</primary>
938 </indexterm>
939 </listitem>
940 </varlistentry>
941
942 <varlistentry id="libkrad">
943 <term><filename class="libraryfile">libkrad.so</filename></term>
944 <listitem>
945 <para>
946 contains the internal support library for RADIUS functionality.
947 </para>
948 <indexterm zone="mitkrb libkrad">
949 <primary sortas="c-libkrad">libkrad.so</primary>
950 </indexterm>
951 </listitem>
952 </varlistentry>
953
954 <varlistentry id="libkrb5">
955 <term><filename class="libraryfile">libkrb5.so</filename></term>
956 <listitem>
957 <para>
958 is an all-purpose <application>Kerberos 5</application> library.
959 </para>
960 <indexterm zone="mitkrb libkrb5">
961 <primary sortas="c-libkrb5">libkrb5.so</primary>
962 </indexterm>
963 </listitem>
964 </varlistentry>
965
966 </variablelist>
967
968 </sect2>
969
970</sect1>
Note: See TracBrowser for help on using the repository browser.