source: postlfs/security/mitkrb.xml@ 1005be4

10.0 10.1 11.0 11.1 8.4 9.0 9.1 lazarus qt5new trunk upgradedb xry111/intltool xry111/test-20220226
Last change on this file since 1005be4 was 1005be4, checked in by Douglas R. Reno <renodr@…>, 3 years ago

Tag the rest of the stuff I build before Xorg

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@21173 af4574ff-66df-0310-9fd7-8a98e5e911e0

  • Property mode set to 100644
File size: 31.7 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY mitkrb-download-http "https://kerberos.org/dist/krb5/&mitkrb-major-version;/krb5-&mitkrb-version;.tar.gz">
8 <!ENTITY mitkrb-download-ftp " ">
9 <!ENTITY mitkrb-md5sum "3b729d89eb441150e146780c4138481b">
10 <!ENTITY mitkrb-size "8.4 MB">
11 <!ENTITY mitkrb-buildsize "104 MB (add 26 MB for tests)">
12 <!ENTITY mitkrb-time "0.4 SBU (using parallelism=4; add 2.2 SBU for tests)">
13]>
14
15<sect1 id="mitkrb" xreflabel="MIT Kerberos V5-&mitkrb-version;">
16 <?dbhtml filename="mitkrb.html"?>
17
18 <sect1info>
19 <othername>$LastChangedBy$</othername>
20 <date>$Date$</date>
21 </sect1info>
22
23 <title>MIT Kerberos V5-&mitkrb-version;</title>
24
25 <indexterm zone="mitkrb">
26 <primary sortas="a-MIT-Kerberos">MIT Kerberos V5</primary>
27 </indexterm>
28
29 <sect2 role="package">
30 <title>Introduction to MIT Kerberos V5</title>
31
32 <para>
33 <application>MIT Kerberos V5</application> is a free implementation
34 of Kerberos 5. Kerberos is a network authentication protocol. It
35 centralizes the authentication database and uses kerberized
36 applications to work with servers or services that support Kerberos
37 allowing single logins and encrypted communication over internal
38 networks or the Internet.
39 </para>
40
41 &lfs84_checked;
42
43 <bridgehead renderas="sect3">Package Information</bridgehead>
44 <itemizedlist spacing="compact">
45 <listitem>
46 <para>
47 Download (HTTP): <ulink url="&mitkrb-download-http;"/>
48 </para>
49 </listitem>
50 <listitem>
51 <para>
52 Download (FTP): <ulink url="&mitkrb-download-ftp;"/>
53 </para>
54 </listitem>
55 <listitem>
56 <para>
57 Download MD5 sum: &mitkrb-md5sum;
58 </para>
59 </listitem>
60 <listitem>
61 <para>
62 Download size: &mitkrb-size;
63 </para>
64 </listitem>
65 <listitem>
66 <para>
67 Estimated disk space required: &mitkrb-buildsize;
68 </para>
69 </listitem>
70 <listitem>
71 <para>
72 Estimated build time: &mitkrb-time;
73 </para>
74 </listitem>
75 </itemizedlist>
76
77<!-- Patch is not needed for this version, but don't remove this.
78 <bridgehead renderas="sect3">Additional Downloads</bridgehead>
79 <itemizedlist spacing="compact">
80 <listitem>
81 <para>
82 Patch required on systems with IPv4 only enabled:
83 <ulink url="&patch-root;/mitkrb-&mitkrb-version;-fix_ipv4_only-1.patch"/>
84 </para>
85 </listitem>
86 </itemizedlist>
87-->
88
89 <bridgehead renderas="sect3">MIT Kerberos V5 Dependencies</bridgehead>
90
91 <bridgehead renderas="sect4">Optional</bridgehead>
92 <para role="optional">
93 <xref linkend="dejagnu"/> (for full test coverage),
94 <xref linkend="gnupg2"/> (to authenticate the package),
95 <xref linkend="keyutils"/>,
96 <xref linkend="openldap"/>,
97 <xref linkend="python2"/> (used during the testsuite),
98 <xref linkend="rpcbind"/> (used during the testsuite), and
99 <xref linkend="valgrind"/> (used during the test suite)
100 </para>
101
102 <note>
103 <para>
104 Some sort of time synchronization facility on your system (like
105 <xref linkend="ntp"/>) is required since Kerberos won't authenticate
106 if there is a time difference between a kerberized client and the
107 KDC server.
108 </para>
109 </note>
110
111 <para condition="html" role="usernotes">User Notes:
112 <ulink url="&blfs-wiki;/mitkrb"/>
113 </para>
114 </sect2>
115
116 <sect2 role="installation">
117 <title>Installation of MIT Kerberos V5</title>
118
119<!-- PATCH IS REJECTED - ALREADY PATCHED
120 <para>
121 If your system is configured to support only IPv4, apply the following
122 patch:
123 </para>
124
125<screen><userinput>patch -p1 -i ../mitkrb-&mitkrb-version;-fix_ipv4_only-1.patch</userinput></screen>
126-->
127
128 <para>
129 Build <application>MIT Kerberos V5</application> by running the
130 following commands:
131 </para>
132
133<screen><userinput>cd src &amp;&amp;
134
135sed -i -e 's@\^u}@^u cols 300}@' tests/dejagnu/config/default.exp &amp;&amp;
136sed -i -e '/eq 0/{N;s/12 //}' plugins/kdb/db2/libdb2/test/run.test &amp;&amp;
137
138./configure --prefix=/usr \
139 --sysconfdir=/etc \
140 --localstatedir=/var/lib \
141 --with-system-et \
142 --with-system-ss \
143 --with-system-verto=no \
144 --enable-dns-for-realm &amp;&amp;
145make</userinput></screen>
146
147 <para>
148 To test the build, issue as the <systemitem
149 class="username">root</systemitem> user: <command>make -k check</command>.
150 You need at least <xref linkend="tcl"/>, which is used to drive the
151 testsuite. Furthermore, <xref linkend="dejagnu"/> must be available for
152 some of the tests to run. If you have a former version of MIT Kerberos V5
153 installed, it may happen that the test suite pick up the installed
154 versions of the libraries, rather than the newly built ones. If so, it is
155 better to run the tests after the installation. The t_ccselect test
156 is known to fail.
157 </para>
158
159 <para>
160 Now, as the <systemitem class="username">root</systemitem> user:
161 </para>
162
163<screen role="root"><userinput>make install &amp;&amp;
164
165for f in gssapi_krb5 gssrpc k5crypto kadm5clnt kadm5srv \
166 kdb5 kdb_ldap krad krb5 krb5support verto ; do
167
168 find /usr/lib -type f -name "lib$f*.so*" -exec chmod -v 755 {} \;
169done &amp;&amp;
170
171mv -v /usr/lib/libkrb5.so.3* /lib &amp;&amp;
172mv -v /usr/lib/libk5crypto.so.3* /lib &amp;&amp;
173mv -v /usr/lib/libkrb5support.so.0* /lib &amp;&amp;
174
175ln -v -sf ../../lib/libkrb5.so.3.3 /usr/lib/libkrb5.so &amp;&amp;
176ln -v -sf ../../lib/libk5crypto.so.3.1 /usr/lib/libk5crypto.so &amp;&amp;
177ln -v -sf ../../lib/libkrb5support.so.0.1 /usr/lib/libkrb5support.so &amp;&amp;
178
179mv -v /usr/bin/ksu /bin &amp;&amp;
180chmod -v 755 /bin/ksu &amp;&amp;
181
182install -v -dm755 /usr/share/doc/krb5-&mitkrb-version; &amp;&amp;
183cp -vfr ../doc/* /usr/share/doc/krb5-&mitkrb-version;</userinput></screen>
184
185 </sect2>
186
187 <sect2 role="commands">
188 <title>Command Explanations</title>
189
190 <para>
191 The first sed increases the width of the virtual terminal used for some
192 tests to prevent some spurious text in the output which is taken as a
193 failure. The second <command>sed</command> removes a test that is known
194 to fail.
195 </para>
196
197 <para>
198 <parameter>--localstatedir=/var/lib</parameter>: This option is
199 used so that the Kerberos variable run-time data is located in
200 <filename class="directory">/var/lib</filename> instead of
201 <filename class="directory">/usr/var</filename>.
202 </para>
203
204 <para>
205 <parameter>--with-system-et</parameter>: This switch causes the build
206 to use the system-installed versions of the error-table support
207 software.
208 </para>
209
210 <para>
211 <parameter>--with-system-ss</parameter>: This switch causes the build
212 to use the system-installed versions of the subsystem command-line
213 interface software.
214 </para>
215
216 <para>
217 <parameter>--with-system-verto=no</parameter>: This switch fixes a bug in
218 the package: it does not recognize its own verto library installed
219 previously. This is not a problem, if reinstalling the same version,
220 but if you are updating, the old library is used as system's one,
221 instead of installing the new version.
222 </para>
223
224 <para>
225 <parameter>--enable-dns-for-realm</parameter>: This switch allows
226 realms to be resolved using the DNS server.
227 </para>
228
229 <para>
230 <option>--with-ldap</option>: Use this switch if you want to compile the
231 <application>OpenLDAP</application> database backend module.
232 </para>
233
234 <para>
235 <command>mv -v /usr/lib/libk... /lib </command> and
236 <command>ln -v -sf ../../lib/libk... /usr/lib/libk...</command>:
237 Move critical libraries to the
238 <filename class="directory">/lib</filename> directory so that they are
239 available when the <filename class="directory">/usr</filename>
240 filesystem is not mounted.
241 </para>
242
243 <para>
244 <command>find /usr/lib -type f -name "lib$f*.so*" -exec chmod -v 755 {} \;</command>:
245 This command changes the permisison of installed libraries.
246 </para>
247
248 <para>
249 <command>mv -v /usr/bin/ksu /bin</command>: Moves the
250 <command>ksu</command> program to the
251 <filename class="directory">/bin</filename> directory so that it is
252 available when the <filename class="directory">/usr</filename>
253 filesystem is not mounted.
254 </para>
255
256 </sect2>
257
258 <sect2 role="configuration">
259 <title>Configuring MIT Kerberos V5</title>
260
261 <sect3 id="krb5-config">
262 <title>Config Files</title>
263
264 <para>
265 <filename>/etc/krb5.conf</filename> and
266 <filename>/var/lib/krb5kdc/kdc.conf</filename>
267 </para>
268
269 <indexterm zone="mitkrb krb5-config">
270 <primary sortas="e-etc-krb5.conf">/etc/krb5.conf</primary>
271 </indexterm>
272
273 <indexterm zone="mitkrb krb5-config">
274 <primary sortas="e-var-lib-krb5kdc-kdc.conf">/var/lib/krb5kdc/kdc.conf</primary>
275 </indexterm>
276
277 </sect3>
278
279 <sect3>
280 <title>Configuration Information</title>
281
282 <sect4>
283 <title>Kerberos Configuration</title>
284
285 <tip>
286 <para>
287 You should consider installing some sort of password checking
288 dictionary so that you can configure the installation to only
289 accept strong passwords. A suitable dictionary to use is shown in
290 the <xref linkend="cracklib"/> instructions. Note that only one
291 file can be used, but you can concatenate many files into one. The
292 configuration file shown below assumes you have installed a
293 dictionary to <filename>/usr/share/dict/words</filename>.
294 </para>
295 </tip>
296
297 <para>
298 Create the Kerberos configuration file with the following
299 commands issued by the <systemitem class="username">root</systemitem>
300 user:
301 </para>
302
303<screen role="root"><userinput>cat &gt; /etc/krb5.conf &lt;&lt; "EOF"
304<literal># Begin /etc/krb5.conf
305
306[libdefaults]
307 default_realm = <replaceable>&lt;EXAMPLE.ORG&gt;</replaceable>
308 encrypt = true
309
310[realms]
311 <replaceable>&lt;EXAMPLE.ORG&gt;</replaceable> = {
312 kdc = <replaceable>&lt;belgarath.example.org&gt;</replaceable>
313 admin_server = <replaceable>&lt;belgarath.example.org&gt;</replaceable>
314 dict_file = /usr/share/dict/words
315 }
316
317[domain_realm]
318 .<replaceable>&lt;example.org&gt;</replaceable> = <replaceable>&lt;EXAMPLE.ORG&gt;</replaceable>
319
320[logging]
321 kdc = SYSLOG:INFO:AUTH
322 admin_server = SYSLOG:INFO:AUTH
323 default = SYSLOG:DEBUG:DAEMON
324
325# End /etc/krb5.conf</literal>
326EOF</userinput></screen>
327
328 <para>
329 You will need to substitute your domain and proper hostname for the
330 occurrences of the <replaceable>&lt;belgarath&gt;</replaceable> and
331 <replaceable>&lt;example.org&gt;</replaceable> names.
332 </para>
333
334 <para>
335 <option>default_realm</option> should be the name of your
336 domain changed to ALL CAPS. This isn't required, but both
337 <application>Heimdal</application> and MIT recommend it.
338 </para>
339
340 <para>
341 <option>encrypt = true</option> provides encryption of all traffic
342 between kerberized clients and servers. It's not necessary and can
343 be left off. If you leave it off, you can encrypt all traffic from
344 the client to the server using a switch on the client program
345 instead.
346 </para>
347
348 <para>
349 The <option>[realms]</option> parameters tell the client programs
350 where to look for the KDC authentication services.
351 </para>
352
353 <para>
354 The <option>[domain_realm]</option> section maps a domain to a realm.
355 </para>
356
357 <para>
358 Create the KDC database:
359 </para>
360
361<screen role="root"><userinput>kdb5_util create -r <replaceable>&lt;EXAMPLE.ORG&gt;</replaceable> -s</userinput></screen>
362
363 <para>
364 Now you should populate the database with principals
365 (users). For now, just use your regular login name or
366 <systemitem class="username">root</systemitem>.
367 </para>
368
369<screen role="root"><userinput>kadmin.local
370<prompt>kadmin.local:</prompt> add_policy dict-only
371<prompt>kadmin.local:</prompt> addprinc -policy dict-only <replaceable>&lt;loginname&gt;</replaceable></userinput></screen>
372
373 <para>
374 The KDC server and any machine running kerberized
375 server daemons must have a host key installed:
376 </para>
377
378<screen role="root"><userinput><prompt>kadmin.local:</prompt> addprinc -randkey host/<replaceable>&lt;belgarath.example.org&gt;</replaceable></userinput></screen>
379
380 <para>
381 After choosing the defaults when prompted, you will have to
382 export the data to a keytab file:
383 </para>
384
385<screen role="root"><userinput><prompt>kadmin.local:</prompt> ktadd host/<replaceable>&lt;belgarath.example.org&gt;</replaceable></userinput></screen>
386
387 <para>
388 This should have created a file in
389 <filename class="directory">/etc</filename> named
390 <filename>krb5.keytab</filename> (Kerberos 5). This file should
391 have 600 (<systemitem class="username">root</systemitem> rw only)
392 permissions. Keeping the keytab files from public access is crucial
393 to the overall security of the Kerberos installation.
394 </para>
395
396 <para>
397 Exit the <command>kadmin</command> program (use
398 <command>quit</command> or <command>exit</command>) and return
399 back to the shell prompt. Start the KDC daemon manually, just to
400 test out the installation:
401 </para>
402
403<screen role="root"><userinput>/usr/sbin/krb5kdc</userinput></screen>
404
405 <para>
406 Attempt to get a ticket with the following command:
407 </para>
408
409<screen><userinput>kinit <replaceable>&lt;loginname&gt;</replaceable></userinput></screen>
410
411 <para>
412 You will be prompted for the password you created. After you
413 get your ticket, you can list it with the following command:
414 </para>
415
416<screen><userinput>klist</userinput></screen>
417
418 <para>
419 Information about the ticket should be displayed on the
420 screen.
421 </para>
422
423 <para>
424 To test the functionality of the keytab file, issue the
425 following command:
426 </para>
427
428<screen><userinput>ktutil
429<prompt>ktutil:</prompt> rkt /etc/krb5.keytab
430<prompt>ktutil:</prompt> l</userinput></screen>
431
432 <para>
433 This should dump a list of the host principal, along with
434 the encryption methods used to access the principal.
435 </para>
436
437 <para>
438 At this point, if everything has been successful so far, you
439 can feel fairly confident in the installation and configuration of
440 the package.
441 </para>
442
443 </sect4>
444
445 <sect4>
446 <title>Additional Information</title>
447
448 <para>
449 For additional information consult the <ulink
450 url="http://web.mit.edu/kerberos/www/krb5-&mitkrb-major-version;/#documentation">
451 documentation for krb5-&mitkrb-version;</ulink> on which the above
452 instructions are based.
453 </para>
454
455 </sect4>
456
457 </sect3>
458
459 <sect3 id="mitkrb-init">
460 <title><phrase revision="sysv">Init Script</phrase>
461 <phrase revision="systemd">Systemd Unit</phrase></title>
462
463 <para revision="sysv">
464 If you want to start <application>Kerberos</application> services
465 at boot, install the <filename>/etc/rc.d/init.d/krb5</filename> init
466 script included in the <xref linkend="bootscripts"/> package using
467 the following command:
468 </para>
469
470 <para revision="systemd">
471 If you want to start <application>Kerberos</application> services
472 at boot, install the <filename>krb5.service</filename> unit included in
473 the <xref linkend="systemd-units"/> package using the following command:
474 </para>
475
476 <indexterm zone="mitkrb mitkrb-init">
477 <primary sortas="f-krb5">krb5</primary>
478 </indexterm>
479
480<screen role="root"><userinput>make install-krb5</userinput></screen>
481
482 </sect3>
483
484 </sect2>
485
486 <sect2 role="content">
487
488 <title>Contents</title>
489 <para></para>
490
491 <segmentedlist>
492 <segtitle>Installed Programs</segtitle>
493 <segtitle>Installed Libraries</segtitle>
494 <segtitle>Installed Directories</segtitle>
495
496 <seglistitem>
497 <seg>
498 gss-client, gss-server, k5srvutil, kadmin, kadmin.local,
499 kadmind, kdb5_ldap_util (optional), kdb5_util, kdestroy, kinit, klist,
500 kpasswd, kprop, kpropd, kproplog, krb5-config, krb5kdc, krb5-send-pr,
501 ksu, kswitch, ktutil, kvno, sclient, sim_client, sim_server,
502 sserver, uuclient, and uuserver
503 </seg>
504 <seg>
505 libgssapi_krb5.so, libgssrpc.so, libk5crypto.so, libkadm5clnt_mit.so,
506 libkadm5clnt.so, libkadm5srv_mit.so, libkadm5srv.so, libkdb_ldap.so
507 (optional), libkdb5.so, libkrad.so, libkrb5.so, libkrb5support.so,
508 libverto.so, and some plugins under the /usr/lib/krb5 tree
509 </seg>
510 <seg>
511 /usr/include/{gssapi,gssrpc,kadm5,krb5},
512 /usr/lib/krb5,
513 /usr/share/{doc/krb5-&mitkrb-version;,examples/krb5},
514 /var/lib/krb5kdc, and
515 /var/lib/run/krb5kdc
516 </seg>
517 </seglistitem>
518 </segmentedlist>
519
520 <variablelist>
521 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
522 <?dbfo list-presentation="list"?>
523 <?dbhtml list-presentation="table"?>
524
525 <varlistentry id="gss-client">
526 <term><command>gss-client</command></term>
527 <listitem>
528 <para>
529 is a GSSAPI test client.
530 </para>
531 <indexterm zone="mitkrb gss-client">
532 <primary sortas="b-gss-client">gss-client</primary>
533 </indexterm>
534 </listitem>
535 </varlistentry>
536
537 <varlistentry id="gss-server">
538 <term><command>gss-server</command></term>
539 <listitem>
540 <para>
541 is a GSSAPI test server.
542 </para>
543 <indexterm zone="mitkrb gss-server">
544 <primary sortas="b-gss-server">gss-server</primary>
545 </indexterm>
546 </listitem>
547 </varlistentry>
548
549 <varlistentry id="k5srvutil">
550 <term><command>k5srvutil</command></term>
551 <listitem>
552 <para>
553 is a host keytable manipulation utility.
554 </para>
555 <indexterm zone="mitkrb k5srvutil">
556 <primary sortas="b-k5srvutil">k5srvutil</primary>
557 </indexterm>
558 </listitem>
559 </varlistentry>
560
561 <varlistentry id="kadmin">
562 <term><command>kadmin</command></term>
563 <listitem>
564 <para>
565 is an utility used to make modifications
566 to the Kerberos database.
567 </para>
568 <indexterm zone="mitkrb kadmin">
569 <primary sortas="b-kadmin">kadmin</primary>
570 </indexterm>
571 </listitem>
572 </varlistentry>
573
574 <varlistentry id="kadmin.local">
575 <term><command>kadmin.local</command></term>
576 <listitem>
577 <para>
578 is an utility similar to <command>kadmin</command>, but if the
579 database is db2, the local client <command>kadmin.local</command>,
580 is intended to run directly on the master KDC without Kerberos
581 authentication.
582 </para>
583 <indexterm zone="mitkrb kadmin.local">
584 <primary sortas="b-kadmin.local">kadmin.local</primary>
585 </indexterm>
586 </listitem>
587 </varlistentry>
588
589 <varlistentry id="kadmind">
590 <term><command>kadmind</command></term>
591 <listitem>
592 <para>
593 is a server for administrative access
594 to a Kerberos database.
595 </para>
596 <indexterm zone="mitkrb kadmind">
597 <primary sortas="b-kadmind">kadmind</primary>
598 </indexterm>
599 </listitem>
600 </varlistentry>
601
602 <varlistentry id="kdb5_ldap_util">
603 <term><command>kdb5_ldap_util (optional)</command></term>
604 <listitem>
605 <para>
606 allows an administrator to manage realms, Kerberos services
607 and ticket policies.
608 </para>
609 <indexterm zone="mitkrb kdb5_ldap_util">
610 <primary sortas="b-kdb5_ldap_util">kdb5_ldap_util</primary>
611 </indexterm>
612 </listitem>
613 </varlistentry>
614
615 <varlistentry id="kdb5_util">
616 <term><command>kdb5_util</command></term>
617 <listitem>
618 <para>
619 is the KDC database utility.
620 </para>
621 <indexterm zone="mitkrb kdb5_util">
622 <primary sortas="b-kdb5_util">kdb5_util</primary>
623 </indexterm>
624 </listitem>
625 </varlistentry>
626
627 <varlistentry id="kdestroy">
628 <term><command>kdestroy</command></term>
629 <listitem>
630 <para>
631 removes the current set of tickets.
632 </para>
633 <indexterm zone="mitkrb kdestroy">
634 <primary sortas="b-kdestroy">kdestroy</primary>
635 </indexterm>
636 </listitem>
637 </varlistentry>
638
639 <varlistentry id="kinit">
640 <term><command>kinit</command></term>
641 <listitem>
642 <para>
643 is used to authenticate to the Kerberos server as a
644 principal and acquire a ticket granting ticket that can
645 later be used to obtain tickets for other services.
646 </para>
647 <indexterm zone="mitkrb kinit">
648 <primary sortas="b-kinit">kinit</primary>
649 </indexterm>
650 </listitem>
651 </varlistentry>
652
653 <varlistentry id="klist">
654 <term><command>klist</command></term>
655 <listitem>
656 <para>
657 reads and displays the current tickets in
658 the credential cache.
659 </para>
660 <indexterm zone="mitkrb klist">
661 <primary sortas="b-klist">klist</primary>
662 </indexterm>
663 </listitem>
664 </varlistentry>
665
666 <varlistentry id="kpasswd">
667 <term><command>kpasswd</command></term>
668 <listitem>
669 <para>
670 is a program for changing Kerberos 5 passwords.
671 </para>
672 <indexterm zone="mitkrb kpasswd">
673 <primary sortas="b-kpasswd">kpasswd</primary>
674 </indexterm>
675 </listitem>
676 </varlistentry>
677
678 <varlistentry id="kprop">
679 <term><command>kprop</command></term>
680 <listitem>
681 <para>
682 takes a principal database in a specified format and
683 converts it into a stream of database records.
684 </para>
685 <indexterm zone="mitkrb kprop">
686 <primary sortas="b-kprop">kprop</primary>
687 </indexterm>
688 </listitem>
689 </varlistentry>
690
691 <varlistentry id="kpropd">
692 <term><command>kpropd</command></term>
693 <listitem>
694 <para>
695 receives a database sent by <command>kprop</command>
696 and writes it as a local database.
697 </para>
698 <indexterm zone="mitkrb kpropd">
699 <primary sortas="b-kpropd">kpropd</primary>
700 </indexterm>
701 </listitem>
702 </varlistentry>
703
704 <varlistentry id="kproplog">
705 <term><command>kproplog</command></term>
706 <listitem>
707 <para>
708 displays the contents of the KDC database update log to standard
709 output.
710 </para>
711 <indexterm zone="mitkrb kproplog">
712 <primary sortas="b-kproplog">kproplog</primary>
713 </indexterm>
714 </listitem>
715 </varlistentry>
716
717 <varlistentry id="krb5-config-prog2">
718 <term><command>krb5-config</command></term>
719 <listitem>
720 <para>
721 gives information on how to link programs against
722 libraries.
723 </para>
724 <indexterm zone="mitkrb krb5-config-prog2">
725 <primary sortas="b-krb5-config">krb5-config</primary>
726 </indexterm>
727 </listitem>
728 </varlistentry>
729
730 <varlistentry id="krb5kdc">
731 <term><command>krb5kdc</command></term>
732 <listitem>
733 <para>
734 is the <application>Kerberos 5</application> server.
735 </para>
736 <indexterm zone="mitkrb krb5kdc">
737 <primary sortas="b-krb5kdc">krb5kdc</primary>
738 </indexterm>
739 </listitem>
740 </varlistentry>
741
742 <varlistentry id="krb5-send-pr">
743 <term><command>krb5-send-pr</command></term>
744 <listitem>
745 <para>
746 sends a problem report (PR) to a central support site.
747 </para>
748 <indexterm zone="mitkrb krb5-send-pr">
749 <primary sortas="b-krb-send-pr">krb5-send-pr</primary>
750 </indexterm>
751 </listitem>
752 </varlistentry>
753
754 <varlistentry id="ksu">
755 <term><command>ksu</command></term>
756 <listitem>
757 <para>
758 is the super user program using Kerberos protocol.
759 Requires a properly configured
760 <filename>/etc/shells</filename> and
761 <filename>~/.k5login</filename> containing principals
762 authorized to become super users.
763 </para>
764 <indexterm zone="mitkrb ksu">
765 <primary sortas="b-ksu">ksu</primary>
766 </indexterm>
767 </listitem>
768 </varlistentry>
769
770 <varlistentry id="kswitch">
771 <term><command>kswitch</command></term>
772 <listitem>
773 <para>
774 makes the specified credential cache the
775 primary cache for the collection, if a cache
776 collection is available.
777 </para>
778 <indexterm zone="mitkrb kswitch">
779 <primary sortas="b-kswitch">kswitch</primary>
780 </indexterm>
781 </listitem>
782 </varlistentry>
783
784 <varlistentry id="ktutil">
785 <term><command>ktutil</command></term>
786 <listitem>
787 <para>
788 is a program for managing Kerberos keytabs.
789 </para>
790 <indexterm zone="mitkrb ktutil">
791 <primary sortas="b-ktutil">ktutil</primary>
792 </indexterm>
793 </listitem>
794 </varlistentry>
795
796 <varlistentry id="kvno">
797 <term><command>kvno</command></term>
798 <listitem>
799 <para>
800 prints keyversion numbers of Kerberos principals.
801 </para>
802 <indexterm zone="mitkrb kvno">
803 <primary sortas="b-kvno">kvno</primary>
804 </indexterm>
805 </listitem>
806 </varlistentry>
807
808 <varlistentry id="sclient">
809 <term><command>sclient</command></term>
810 <listitem>
811 <para>
812 is used to contact a sample server and authenticate to it
813 using Kerberos 5 tickets, then display the server's
814 response.
815 </para>
816 <indexterm zone="mitkrb sclient">
817 <primary sortas="b-sclient">sclient</primary>
818 </indexterm>
819 </listitem>
820 </varlistentry>
821
822 <varlistentry id="sim_client">
823 <term><command>sim_client</command></term>
824 <listitem>
825 <para>
826 is a simple UDP-based sample client program, for
827 demonstration.
828 </para>
829 <indexterm zone="mitkrb sim_client">
830 <primary sortas="b-sim_client">sim_client</primary>
831 </indexterm>
832 </listitem>
833 </varlistentry>
834
835 <varlistentry id="sim_server">
836 <term><command>sim_server</command></term>
837 <listitem>
838 <para>
839 is a simple UDP-based server application, for
840 demonstration.
841 </para>
842 <indexterm zone="mitkrb sim_server">
843 <primary sortas="b-sim_server">sim_server</primary>
844 </indexterm>
845 </listitem>
846 </varlistentry>
847
848 <varlistentry id="sserver">
849 <term><command>sserver</command></term>
850 <listitem>
851 <para>
852 is the sample Kerberos 5 server.
853 </para>
854 <indexterm zone="mitkrb sserver">
855 <primary sortas="b-sserver">sserver</primary>
856 </indexterm>
857 </listitem>
858 </varlistentry>
859
860 <varlistentry id="uuclient">
861 <term><command>uuclient</command></term>
862 <listitem>
863 <para>
864 is another sample client.
865 </para>
866 <indexterm zone="mitkrb uuclient">
867 <primary sortas="b-uuclient">uuclient</primary>
868 </indexterm>
869 </listitem>
870 </varlistentry>
871
872 <varlistentry id="uuserver">
873 <term><command>uuserver</command></term>
874 <listitem>
875 <para>
876 is another sample server.
877 </para>
878 <indexterm zone="mitkrb uuserver">
879 <primary sortas="b-uuserver">uuserver</primary>
880 </indexterm>
881 </listitem>
882 </varlistentry>
883
884
885 <varlistentry id="libgssapi_krb5">
886 <term><filename class="libraryfile">libgssapi_krb5.so</filename></term>
887 <listitem>
888 <para>
889 contains the Generic Security Service Application Programming
890 Interface (GSSAPI) functions which provides security services
891 to callers in a generic fashion, supportable with a range of
892 underlying mechanisms and technologies and hence allowing
893 source-level portability of applications to different
894 environments.
895 </para>
896 <indexterm zone="mitkrb libgssapi_krb5">
897 <primary sortas="c-libgssapi_krb5">libgssapi_krb5.so</primary>
898 </indexterm>
899 </listitem>
900 </varlistentry>
901
902 <varlistentry id="libkadm5clnt">
903 <term><filename class="libraryfile">libkadm5clnt.so</filename></term>
904 <listitem>
905 <para>
906 contains the administrative authentication and password checking
907 functions required by Kerberos 5 client-side programs.
908 </para>
909 <indexterm zone="mitkrb libkadm5clnt">
910 <primary sortas="c-libkadm5clnt">libkadm5clnt.so</primary>
911 </indexterm>
912 </listitem>
913 </varlistentry>
914
915 <varlistentry id="libkadm5srv">
916 <term><filename class="libraryfile">libkadm5srv.so</filename></term>
917 <listitem>
918 <para>
919 contains the administrative authentication and password
920 checking functions required by Kerberos 5 servers.
921 </para>
922 <indexterm zone="mitkrb libkadm5srv">
923 <primary sortas="c-libkadm5srv">libkadm5srv.so</primary>
924 </indexterm>
925 </listitem>
926 </varlistentry>
927
928 <varlistentry id="libkdb5">
929 <term><filename class="libraryfile">libkdb5.so</filename></term>
930 <listitem>
931 <para>
932 is a Kerberos 5 authentication/authorization database
933 access library.
934 </para>
935 <indexterm zone="mitkrb libkdb5">
936 <primary sortas="c-libkdb5">libkdb5.so</primary>
937 </indexterm>
938 </listitem>
939 </varlistentry>
940
941 <varlistentry id="libkrad">
942 <term><filename class="libraryfile">libkrad.so</filename></term>
943 <listitem>
944 <para>
945 contains the internal support library for RADIUS functionality.
946 </para>
947 <indexterm zone="mitkrb libkrad">
948 <primary sortas="c-libkrad">libkrad.so</primary>
949 </indexterm>
950 </listitem>
951 </varlistentry>
952
953 <varlistentry id="libkrb5">
954 <term><filename class="libraryfile">libkrb5.so</filename></term>
955 <listitem>
956 <para>
957 is an all-purpose <application>Kerberos 5</application> library.
958 </para>
959 <indexterm zone="mitkrb libkrb5">
960 <primary sortas="c-libkrb5">libkrb5.so</primary>
961 </indexterm>
962 </listitem>
963 </varlistentry>
964
965 </variablelist>
966
967 </sect2>
968
969</sect1>
Note: See TracBrowser for help on using the repository browser.