source: postlfs/security/mitkrb.xml@ 2fcfa4a1

10.0 10.1 11.0 11.1 9.0 9.1 lazarus qt5new trunk upgradedb xry111/intltool xry111/test-20220226
Last change on this file since 2fcfa4a1 was 2fcfa4a1, checked in by Douglas R. Reno <renodr@…>, 3 years ago

Subversion: Adapt to SWIG-4 changes, and note that the test suite for the python bindings fails to initialize.
MIT Kerberos V5 (krb5): Use the internal versions of libcom_err (ss/et) because the verisons shipped with e2fsprogs are incompatible due to function removal
libgrss: Fix the capitalization so that it is consistent with the rest of the book.

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@21844 af4574ff-66df-0310-9fd7-8a98e5e911e0

  • Property mode set to 100644
File size: 32.6 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY mitkrb-download-http "https://kerberos.org/dist/krb5/&mitkrb-major-version;/krb5-&mitkrb-version;.tar.gz">
8 <!ENTITY mitkrb-download-ftp " ">
9 <!ENTITY mitkrb-md5sum "3b729d89eb441150e146780c4138481b">
10 <!ENTITY mitkrb-size "8.4 MB">
11 <!ENTITY mitkrb-buildsize "104 MB (add 26 MB for tests)">
12 <!ENTITY mitkrb-time "0.4 SBU (using parallelism=4; add 2.2 SBU for tests)">
13]>
14
15<sect1 id="mitkrb" xreflabel="MIT Kerberos V5-&mitkrb-version;">
16 <?dbhtml filename="mitkrb.html"?>
17
18 <sect1info>
19 <othername>$LastChangedBy$</othername>
20 <date>$Date$</date>
21 </sect1info>
22
23 <title>MIT Kerberos V5-&mitkrb-version;</title>
24
25 <indexterm zone="mitkrb">
26 <primary sortas="a-MIT-Kerberos">MIT Kerberos V5</primary>
27 </indexterm>
28
29 <sect2 role="package">
30 <title>Introduction to MIT Kerberos V5</title>
31
32 <para>
33 <application>MIT Kerberos V5</application> is a free implementation
34 of Kerberos 5. Kerberos is a network authentication protocol. It
35 centralizes the authentication database and uses kerberized
36 applications to work with servers or services that support Kerberos
37 allowing single logins and encrypted communication over internal
38 networks or the Internet.
39 </para>
40
41 &lfs84_checked;
42
43 <bridgehead renderas="sect3">Package Information</bridgehead>
44 <itemizedlist spacing="compact">
45 <listitem>
46 <para>
47 Download (HTTP): <ulink url="&mitkrb-download-http;"/>
48 </para>
49 </listitem>
50 <listitem>
51 <para>
52 Download (FTP): <ulink url="&mitkrb-download-ftp;"/>
53 </para>
54 </listitem>
55 <listitem>
56 <para>
57 Download MD5 sum: &mitkrb-md5sum;
58 </para>
59 </listitem>
60 <listitem>
61 <para>
62 Download size: &mitkrb-size;
63 </para>
64 </listitem>
65 <listitem>
66 <para>
67 Estimated disk space required: &mitkrb-buildsize;
68 </para>
69 </listitem>
70 <listitem>
71 <para>
72 Estimated build time: &mitkrb-time;
73 </para>
74 </listitem>
75 </itemizedlist>
76
77<!-- Patch is not needed for this version, but don't remove this.
78 <bridgehead renderas="sect3">Additional Downloads</bridgehead>
79 <itemizedlist spacing="compact">
80 <listitem>
81 <para>
82 Patch required on systems with IPv4 only enabled:
83 <ulink url="&patch-root;/mitkrb-&mitkrb-version;-fix_ipv4_only-1.patch"/>
84 </para>
85 </listitem>
86 </itemizedlist>
87-->
88
89 <bridgehead renderas="sect3">MIT Kerberos V5 Dependencies</bridgehead>
90
91 <bridgehead renderas="sect4">Optional</bridgehead>
92 <para role="optional">
93 <xref linkend="dejagnu"/> (for full test coverage),
94 <xref linkend="gnupg2"/> (to authenticate the package),
95 <xref linkend="keyutils"/>,
96 <xref linkend="openldap"/>,
97 <xref linkend="python2"/> (used during the testsuite),
98 <xref linkend="rpcbind"/> (used during the testsuite), and
99 <xref linkend="valgrind"/> (used during the test suite)
100 </para>
101
102 <note>
103 <para>
104 Some sort of time synchronization facility on your system (like
105 <xref linkend="ntp"/>) is required since Kerberos won't authenticate
106 if there is a time difference between a kerberized client and the
107 KDC server.
108 </para>
109 </note>
110
111 <para condition="html" role="usernotes">User Notes:
112 <ulink url="&blfs-wiki;/mitkrb"/>
113 </para>
114 </sect2>
115
116 <sect2 role="installation">
117 <title>Installation of MIT Kerberos V5</title>
118
119<!-- PATCH IS REJECTED - ALREADY PATCHED
120 <para>
121 If your system is configured to support only IPv4, apply the following
122 patch:
123 </para>
124
125<screen><userinput>patch -p1 -i ../mitkrb-&mitkrb-version;-fix_ipv4_only-1.patch</userinput></screen>
126-->
127
128 <para>
129 Build <application>MIT Kerberos V5</application> by running the
130 following commands:
131 </para>
132
133<screen><userinput>cd src &amp;&amp;
134
135sed -i -e 's@\^u}@^u cols 300}@' tests/dejagnu/config/default.exp &amp;&amp;
136sed -i -e '/eq 0/{N;s/12 //}' plugins/kdb/db2/libdb2/test/run.test &amp;&amp;
137
138./configure --prefix=/usr \
139 --sysconfdir=/etc \
140 --localstatedir=/var/lib \
141 --without-system-et \
142 --without-system-ss \
143 --with-system-verto=no \
144 --enable-dns-for-realm &amp;&amp;
145make</userinput></screen>
146
147 <para>
148 To test the build, issue as the <systemitem
149 class="username">root</systemitem> user: <command>make -k check</command>.
150 You need at least <xref linkend="tcl"/>, which is used to drive the
151 testsuite. Furthermore, <xref linkend="dejagnu"/> must be available for
152 some of the tests to run. If you have a former version of MIT Kerberos V5
153 installed, it may happen that the test suite pick up the installed
154 versions of the libraries, rather than the newly built ones. If so, it is
155 better to run the tests after the installation. The t_ccselect test
156 is known to fail.
157 </para>
158
159 <para>
160 Now, as the <systemitem class="username">root</systemitem> user:
161 </para>
162
163<screen role="root"><userinput>make install &amp;&amp;
164
165for f in gssapi_krb5 gssrpc k5crypto kadm5clnt kadm5srv \
166 kdb5 kdb_ldap krad krb5 krb5support verto ; do
167
168 find /usr/lib -type f -name "lib$f*.so*" -exec chmod -v 755 {} \;
169done &amp;&amp;
170
171mv -v /usr/lib/libkrb5.so.3* /lib &amp;&amp;
172mv -v /usr/lib/libk5crypto.so.3* /lib &amp;&amp;
173mv -v /usr/lib/libkrb5support.so.0* /lib &amp;&amp;
174
175ln -v -sf ../../lib/libkrb5.so.3.3 /usr/lib/libkrb5.so &amp;&amp;
176ln -v -sf ../../lib/libk5crypto.so.3.1 /usr/lib/libk5crypto.so &amp;&amp;
177ln -v -sf ../../lib/libkrb5support.so.0.1 /usr/lib/libkrb5support.so &amp;&amp;
178
179mv -v /usr/bin/ksu /bin &amp;&amp;
180chmod -v 755 /bin/ksu &amp;&amp;
181
182install -v -dm755 /usr/share/doc/krb5-&mitkrb-version; &amp;&amp;
183cp -vfr ../doc/* /usr/share/doc/krb5-&mitkrb-version;</userinput></screen>
184
185 </sect2>
186
187 <sect2 role="commands">
188 <title>Command Explanations</title>
189
190 <para>
191 The first sed increases the width of the virtual terminal used for some
192 tests to prevent some spurious text in the output which is taken as a
193 failure. The second <command>sed</command> removes a test that is known
194 to fail.
195 </para>
196
197 <para>
198 <parameter>--localstatedir=/var/lib</parameter>: This option is
199 used so that the Kerberos variable run-time data is located in
200 <filename class="directory">/var/lib</filename> instead of
201 <filename class="directory">/usr/var</filename>.
202 </para>
203 <!-- This was broken with e2fsprogs-1.45.0. The API functions in the
204 libcom_err.so library were changed, and one of the functions that
205 KRB5 looks for was removed. As a result, we need to use the system
206 versions for the time being. Check this again at the end of the 9.0
207 release cycle, or at the next version of MIT Kerberos 5. -->
208 <!--
209 <para>
210 <parameter>- -with-system-et</parameter>: This switch causes the build
211 to use the system-installed versions of the error-table support
212 software.
213 </para>
214
215 <para>
216 <parameter>- -with-system-ss</parameter>: This switch causes the build
217 to use the system-installed versions of the subsystem command-line
218 interface software.
219 </para>
220 -->
221
222 <para>
223 <parameter>--without-system-et</parameter>: This switch uses the internal
224 version of the error-table support library because the version that is
225 shipped with e2fsprogs is now incompatible.
226 </para>
227
228 <para>
229 <parameter>--without-system-ss</parameter>: This switch uses the internal
230 version of the subsystem command-line interface software because the version
231 that is shipped with e2fsprogs is now incompatible.
232 </para>
233
234 <para>
235 <parameter>--with-system-verto=no</parameter>: This switch fixes a bug in
236 the package: it does not recognize its own verto library installed
237 previously. This is not a problem, if reinstalling the same version,
238 but if you are updating, the old library is used as system's one,
239 instead of installing the new version.
240 </para>
241
242 <para>
243 <parameter>--enable-dns-for-realm</parameter>: This switch allows
244 realms to be resolved using the DNS server.
245 </para>
246
247 <para>
248 <option>--with-ldap</option>: Use this switch if you want to compile the
249 <application>OpenLDAP</application> database backend module.
250 </para>
251
252 <para>
253 <command>mv -v /usr/lib/libk... /lib </command> and
254 <command>ln -v -sf ../../lib/libk... /usr/lib/libk...</command>:
255 Move critical libraries to the
256 <filename class="directory">/lib</filename> directory so that they are
257 available when the <filename class="directory">/usr</filename>
258 filesystem is not mounted.
259 </para>
260
261 <para>
262 <command>find /usr/lib -type f -name "lib$f*.so*" -exec chmod -v 755 {} \;</command>:
263 This command changes the permisison of installed libraries.
264 </para>
265
266 <para>
267 <command>mv -v /usr/bin/ksu /bin</command>: Moves the
268 <command>ksu</command> program to the
269 <filename class="directory">/bin</filename> directory so that it is
270 available when the <filename class="directory">/usr</filename>
271 filesystem is not mounted.
272 </para>
273
274 </sect2>
275
276 <sect2 role="configuration">
277 <title>Configuring MIT Kerberos V5</title>
278
279 <sect3 id="krb5-config">
280 <title>Config Files</title>
281
282 <para>
283 <filename>/etc/krb5.conf</filename> and
284 <filename>/var/lib/krb5kdc/kdc.conf</filename>
285 </para>
286
287 <indexterm zone="mitkrb krb5-config">
288 <primary sortas="e-etc-krb5.conf">/etc/krb5.conf</primary>
289 </indexterm>
290
291 <indexterm zone="mitkrb krb5-config">
292 <primary sortas="e-var-lib-krb5kdc-kdc.conf">/var/lib/krb5kdc/kdc.conf</primary>
293 </indexterm>
294
295 </sect3>
296
297 <sect3>
298 <title>Configuration Information</title>
299
300 <sect4>
301 <title>Kerberos Configuration</title>
302
303 <tip>
304 <para>
305 You should consider installing some sort of password checking
306 dictionary so that you can configure the installation to only
307 accept strong passwords. A suitable dictionary to use is shown in
308 the <xref linkend="cracklib"/> instructions. Note that only one
309 file can be used, but you can concatenate many files into one. The
310 configuration file shown below assumes you have installed a
311 dictionary to <filename>/usr/share/dict/words</filename>.
312 </para>
313 </tip>
314
315 <para>
316 Create the Kerberos configuration file with the following
317 commands issued by the <systemitem class="username">root</systemitem>
318 user:
319 </para>
320
321<screen role="root"><userinput>cat &gt; /etc/krb5.conf &lt;&lt; "EOF"
322<literal># Begin /etc/krb5.conf
323
324[libdefaults]
325 default_realm = <replaceable>&lt;EXAMPLE.ORG&gt;</replaceable>
326 encrypt = true
327
328[realms]
329 <replaceable>&lt;EXAMPLE.ORG&gt;</replaceable> = {
330 kdc = <replaceable>&lt;belgarath.example.org&gt;</replaceable>
331 admin_server = <replaceable>&lt;belgarath.example.org&gt;</replaceable>
332 dict_file = /usr/share/dict/words
333 }
334
335[domain_realm]
336 .<replaceable>&lt;example.org&gt;</replaceable> = <replaceable>&lt;EXAMPLE.ORG&gt;</replaceable>
337
338[logging]
339 kdc = SYSLOG:INFO:AUTH
340 admin_server = SYSLOG:INFO:AUTH
341 default = SYSLOG:DEBUG:DAEMON
342
343# End /etc/krb5.conf</literal>
344EOF</userinput></screen>
345
346 <para>
347 You will need to substitute your domain and proper hostname for the
348 occurrences of the <replaceable>&lt;belgarath&gt;</replaceable> and
349 <replaceable>&lt;example.org&gt;</replaceable> names.
350 </para>
351
352 <para>
353 <option>default_realm</option> should be the name of your
354 domain changed to ALL CAPS. This isn't required, but both
355 <application>Heimdal</application> and MIT recommend it.
356 </para>
357
358 <para>
359 <option>encrypt = true</option> provides encryption of all traffic
360 between kerberized clients and servers. It's not necessary and can
361 be left off. If you leave it off, you can encrypt all traffic from
362 the client to the server using a switch on the client program
363 instead.
364 </para>
365
366 <para>
367 The <option>[realms]</option> parameters tell the client programs
368 where to look for the KDC authentication services.
369 </para>
370
371 <para>
372 The <option>[domain_realm]</option> section maps a domain to a realm.
373 </para>
374
375 <para>
376 Create the KDC database:
377 </para>
378
379<screen role="root"><userinput>kdb5_util create -r <replaceable>&lt;EXAMPLE.ORG&gt;</replaceable> -s</userinput></screen>
380
381 <para>
382 Now you should populate the database with principals
383 (users). For now, just use your regular login name or
384 <systemitem class="username">root</systemitem>.
385 </para>
386
387<screen role="root"><userinput>kadmin.local
388<prompt>kadmin.local:</prompt> add_policy dict-only
389<prompt>kadmin.local:</prompt> addprinc -policy dict-only <replaceable>&lt;loginname&gt;</replaceable></userinput></screen>
390
391 <para>
392 The KDC server and any machine running kerberized
393 server daemons must have a host key installed:
394 </para>
395
396<screen role="root"><userinput><prompt>kadmin.local:</prompt> addprinc -randkey host/<replaceable>&lt;belgarath.example.org&gt;</replaceable></userinput></screen>
397
398 <para>
399 After choosing the defaults when prompted, you will have to
400 export the data to a keytab file:
401 </para>
402
403<screen role="root"><userinput><prompt>kadmin.local:</prompt> ktadd host/<replaceable>&lt;belgarath.example.org&gt;</replaceable></userinput></screen>
404
405 <para>
406 This should have created a file in
407 <filename class="directory">/etc</filename> named
408 <filename>krb5.keytab</filename> (Kerberos 5). This file should
409 have 600 (<systemitem class="username">root</systemitem> rw only)
410 permissions. Keeping the keytab files from public access is crucial
411 to the overall security of the Kerberos installation.
412 </para>
413
414 <para>
415 Exit the <command>kadmin</command> program (use
416 <command>quit</command> or <command>exit</command>) and return
417 back to the shell prompt. Start the KDC daemon manually, just to
418 test out the installation:
419 </para>
420
421<screen role="root"><userinput>/usr/sbin/krb5kdc</userinput></screen>
422
423 <para>
424 Attempt to get a ticket with the following command:
425 </para>
426
427<screen><userinput>kinit <replaceable>&lt;loginname&gt;</replaceable></userinput></screen>
428
429 <para>
430 You will be prompted for the password you created. After you
431 get your ticket, you can list it with the following command:
432 </para>
433
434<screen><userinput>klist</userinput></screen>
435
436 <para>
437 Information about the ticket should be displayed on the
438 screen.
439 </para>
440
441 <para>
442 To test the functionality of the keytab file, issue the
443 following command:
444 </para>
445
446<screen><userinput>ktutil
447<prompt>ktutil:</prompt> rkt /etc/krb5.keytab
448<prompt>ktutil:</prompt> l</userinput></screen>
449
450 <para>
451 This should dump a list of the host principal, along with
452 the encryption methods used to access the principal.
453 </para>
454
455 <para>
456 At this point, if everything has been successful so far, you
457 can feel fairly confident in the installation and configuration of
458 the package.
459 </para>
460
461 </sect4>
462
463 <sect4>
464 <title>Additional Information</title>
465
466 <para>
467 For additional information consult the <ulink
468 url="http://web.mit.edu/kerberos/www/krb5-&mitkrb-major-version;/#documentation">
469 documentation for krb5-&mitkrb-version;</ulink> on which the above
470 instructions are based.
471 </para>
472
473 </sect4>
474
475 </sect3>
476
477 <sect3 id="mitkrb-init">
478 <title><phrase revision="sysv">Init Script</phrase>
479 <phrase revision="systemd">Systemd Unit</phrase></title>
480
481 <para revision="sysv">
482 If you want to start <application>Kerberos</application> services
483 at boot, install the <filename>/etc/rc.d/init.d/krb5</filename> init
484 script included in the <xref linkend="bootscripts"/> package using
485 the following command:
486 </para>
487
488 <para revision="systemd">
489 If you want to start <application>Kerberos</application> services
490 at boot, install the <filename>krb5.service</filename> unit included in
491 the <xref linkend="systemd-units"/> package using the following command:
492 </para>
493
494 <indexterm zone="mitkrb mitkrb-init">
495 <primary sortas="f-krb5">krb5</primary>
496 </indexterm>
497
498<screen role="root"><userinput>make install-krb5</userinput></screen>
499
500 </sect3>
501
502 </sect2>
503
504 <sect2 role="content">
505
506 <title>Contents</title>
507 <para></para>
508
509 <segmentedlist>
510 <segtitle>Installed Programs</segtitle>
511 <segtitle>Installed Libraries</segtitle>
512 <segtitle>Installed Directories</segtitle>
513
514 <seglistitem>
515 <seg>
516 gss-client, gss-server, k5srvutil, kadmin, kadmin.local,
517 kadmind, kdb5_ldap_util (optional), kdb5_util, kdestroy, kinit, klist,
518 kpasswd, kprop, kpropd, kproplog, krb5-config, krb5kdc, krb5-send-pr,
519 ksu, kswitch, ktutil, kvno, sclient, sim_client, sim_server,
520 sserver, uuclient, and uuserver
521 </seg>
522 <seg>
523 libgssapi_krb5.so, libgssrpc.so, libk5crypto.so, libkadm5clnt_mit.so,
524 libkadm5clnt.so, libkadm5srv_mit.so, libkadm5srv.so, libkdb_ldap.so
525 (optional), libkdb5.so, libkrad.so, libkrb5.so, libkrb5support.so,
526 libverto.so, and some plugins under the /usr/lib/krb5 tree
527 </seg>
528 <seg>
529 /usr/include/{gssapi,gssrpc,kadm5,krb5},
530 /usr/lib/krb5,
531 /usr/share/{doc/krb5-&mitkrb-version;,examples/krb5},
532 /var/lib/krb5kdc, and
533 /var/lib/run/krb5kdc
534 </seg>
535 </seglistitem>
536 </segmentedlist>
537
538 <variablelist>
539 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
540 <?dbfo list-presentation="list"?>
541 <?dbhtml list-presentation="table"?>
542
543 <varlistentry id="gss-client">
544 <term><command>gss-client</command></term>
545 <listitem>
546 <para>
547 is a GSSAPI test client.
548 </para>
549 <indexterm zone="mitkrb gss-client">
550 <primary sortas="b-gss-client">gss-client</primary>
551 </indexterm>
552 </listitem>
553 </varlistentry>
554
555 <varlistentry id="gss-server">
556 <term><command>gss-server</command></term>
557 <listitem>
558 <para>
559 is a GSSAPI test server.
560 </para>
561 <indexterm zone="mitkrb gss-server">
562 <primary sortas="b-gss-server">gss-server</primary>
563 </indexterm>
564 </listitem>
565 </varlistentry>
566
567 <varlistentry id="k5srvutil">
568 <term><command>k5srvutil</command></term>
569 <listitem>
570 <para>
571 is a host keytable manipulation utility.
572 </para>
573 <indexterm zone="mitkrb k5srvutil">
574 <primary sortas="b-k5srvutil">k5srvutil</primary>
575 </indexterm>
576 </listitem>
577 </varlistentry>
578
579 <varlistentry id="kadmin">
580 <term><command>kadmin</command></term>
581 <listitem>
582 <para>
583 is an utility used to make modifications
584 to the Kerberos database.
585 </para>
586 <indexterm zone="mitkrb kadmin">
587 <primary sortas="b-kadmin">kadmin</primary>
588 </indexterm>
589 </listitem>
590 </varlistentry>
591
592 <varlistentry id="kadmin.local">
593 <term><command>kadmin.local</command></term>
594 <listitem>
595 <para>
596 is an utility similar to <command>kadmin</command>, but if the
597 database is db2, the local client <command>kadmin.local</command>,
598 is intended to run directly on the master KDC without Kerberos
599 authentication.
600 </para>
601 <indexterm zone="mitkrb kadmin.local">
602 <primary sortas="b-kadmin.local">kadmin.local</primary>
603 </indexterm>
604 </listitem>
605 </varlistentry>
606
607 <varlistentry id="kadmind">
608 <term><command>kadmind</command></term>
609 <listitem>
610 <para>
611 is a server for administrative access
612 to a Kerberos database.
613 </para>
614 <indexterm zone="mitkrb kadmind">
615 <primary sortas="b-kadmind">kadmind</primary>
616 </indexterm>
617 </listitem>
618 </varlistentry>
619
620 <varlistentry id="kdb5_ldap_util">
621 <term><command>kdb5_ldap_util (optional)</command></term>
622 <listitem>
623 <para>
624 allows an administrator to manage realms, Kerberos services
625 and ticket policies.
626 </para>
627 <indexterm zone="mitkrb kdb5_ldap_util">
628 <primary sortas="b-kdb5_ldap_util">kdb5_ldap_util</primary>
629 </indexterm>
630 </listitem>
631 </varlistentry>
632
633 <varlistentry id="kdb5_util">
634 <term><command>kdb5_util</command></term>
635 <listitem>
636 <para>
637 is the KDC database utility.
638 </para>
639 <indexterm zone="mitkrb kdb5_util">
640 <primary sortas="b-kdb5_util">kdb5_util</primary>
641 </indexterm>
642 </listitem>
643 </varlistentry>
644
645 <varlistentry id="kdestroy">
646 <term><command>kdestroy</command></term>
647 <listitem>
648 <para>
649 removes the current set of tickets.
650 </para>
651 <indexterm zone="mitkrb kdestroy">
652 <primary sortas="b-kdestroy">kdestroy</primary>
653 </indexterm>
654 </listitem>
655 </varlistentry>
656
657 <varlistentry id="kinit">
658 <term><command>kinit</command></term>
659 <listitem>
660 <para>
661 is used to authenticate to the Kerberos server as a
662 principal and acquire a ticket granting ticket that can
663 later be used to obtain tickets for other services.
664 </para>
665 <indexterm zone="mitkrb kinit">
666 <primary sortas="b-kinit">kinit</primary>
667 </indexterm>
668 </listitem>
669 </varlistentry>
670
671 <varlistentry id="klist">
672 <term><command>klist</command></term>
673 <listitem>
674 <para>
675 reads and displays the current tickets in
676 the credential cache.
677 </para>
678 <indexterm zone="mitkrb klist">
679 <primary sortas="b-klist">klist</primary>
680 </indexterm>
681 </listitem>
682 </varlistentry>
683
684 <varlistentry id="kpasswd">
685 <term><command>kpasswd</command></term>
686 <listitem>
687 <para>
688 is a program for changing Kerberos 5 passwords.
689 </para>
690 <indexterm zone="mitkrb kpasswd">
691 <primary sortas="b-kpasswd">kpasswd</primary>
692 </indexterm>
693 </listitem>
694 </varlistentry>
695
696 <varlistentry id="kprop">
697 <term><command>kprop</command></term>
698 <listitem>
699 <para>
700 takes a principal database in a specified format and
701 converts it into a stream of database records.
702 </para>
703 <indexterm zone="mitkrb kprop">
704 <primary sortas="b-kprop">kprop</primary>
705 </indexterm>
706 </listitem>
707 </varlistentry>
708
709 <varlistentry id="kpropd">
710 <term><command>kpropd</command></term>
711 <listitem>
712 <para>
713 receives a database sent by <command>kprop</command>
714 and writes it as a local database.
715 </para>
716 <indexterm zone="mitkrb kpropd">
717 <primary sortas="b-kpropd">kpropd</primary>
718 </indexterm>
719 </listitem>
720 </varlistentry>
721
722 <varlistentry id="kproplog">
723 <term><command>kproplog</command></term>
724 <listitem>
725 <para>
726 displays the contents of the KDC database update log to standard
727 output.
728 </para>
729 <indexterm zone="mitkrb kproplog">
730 <primary sortas="b-kproplog">kproplog</primary>
731 </indexterm>
732 </listitem>
733 </varlistentry>
734
735 <varlistentry id="krb5-config-prog2">
736 <term><command>krb5-config</command></term>
737 <listitem>
738 <para>
739 gives information on how to link programs against
740 libraries.
741 </para>
742 <indexterm zone="mitkrb krb5-config-prog2">
743 <primary sortas="b-krb5-config">krb5-config</primary>
744 </indexterm>
745 </listitem>
746 </varlistentry>
747
748 <varlistentry id="krb5kdc">
749 <term><command>krb5kdc</command></term>
750 <listitem>
751 <para>
752 is the <application>Kerberos 5</application> server.
753 </para>
754 <indexterm zone="mitkrb krb5kdc">
755 <primary sortas="b-krb5kdc">krb5kdc</primary>
756 </indexterm>
757 </listitem>
758 </varlistentry>
759
760 <varlistentry id="krb5-send-pr">
761 <term><command>krb5-send-pr</command></term>
762 <listitem>
763 <para>
764 sends a problem report (PR) to a central support site.
765 </para>
766 <indexterm zone="mitkrb krb5-send-pr">
767 <primary sortas="b-krb-send-pr">krb5-send-pr</primary>
768 </indexterm>
769 </listitem>
770 </varlistentry>
771
772 <varlistentry id="ksu">
773 <term><command>ksu</command></term>
774 <listitem>
775 <para>
776 is the super user program using Kerberos protocol.
777 Requires a properly configured
778 <filename>/etc/shells</filename> and
779 <filename>~/.k5login</filename> containing principals
780 authorized to become super users.
781 </para>
782 <indexterm zone="mitkrb ksu">
783 <primary sortas="b-ksu">ksu</primary>
784 </indexterm>
785 </listitem>
786 </varlistentry>
787
788 <varlistentry id="kswitch">
789 <term><command>kswitch</command></term>
790 <listitem>
791 <para>
792 makes the specified credential cache the
793 primary cache for the collection, if a cache
794 collection is available.
795 </para>
796 <indexterm zone="mitkrb kswitch">
797 <primary sortas="b-kswitch">kswitch</primary>
798 </indexterm>
799 </listitem>
800 </varlistentry>
801
802 <varlistentry id="ktutil">
803 <term><command>ktutil</command></term>
804 <listitem>
805 <para>
806 is a program for managing Kerberos keytabs.
807 </para>
808 <indexterm zone="mitkrb ktutil">
809 <primary sortas="b-ktutil">ktutil</primary>
810 </indexterm>
811 </listitem>
812 </varlistentry>
813
814 <varlistentry id="kvno">
815 <term><command>kvno</command></term>
816 <listitem>
817 <para>
818 prints keyversion numbers of Kerberos principals.
819 </para>
820 <indexterm zone="mitkrb kvno">
821 <primary sortas="b-kvno">kvno</primary>
822 </indexterm>
823 </listitem>
824 </varlistentry>
825
826 <varlistentry id="sclient">
827 <term><command>sclient</command></term>
828 <listitem>
829 <para>
830 is used to contact a sample server and authenticate to it
831 using Kerberos 5 tickets, then display the server's
832 response.
833 </para>
834 <indexterm zone="mitkrb sclient">
835 <primary sortas="b-sclient">sclient</primary>
836 </indexterm>
837 </listitem>
838 </varlistentry>
839
840 <varlistentry id="sim_client">
841 <term><command>sim_client</command></term>
842 <listitem>
843 <para>
844 is a simple UDP-based sample client program, for
845 demonstration.
846 </para>
847 <indexterm zone="mitkrb sim_client">
848 <primary sortas="b-sim_client">sim_client</primary>
849 </indexterm>
850 </listitem>
851 </varlistentry>
852
853 <varlistentry id="sim_server">
854 <term><command>sim_server</command></term>
855 <listitem>
856 <para>
857 is a simple UDP-based server application, for
858 demonstration.
859 </para>
860 <indexterm zone="mitkrb sim_server">
861 <primary sortas="b-sim_server">sim_server</primary>
862 </indexterm>
863 </listitem>
864 </varlistentry>
865
866 <varlistentry id="sserver">
867 <term><command>sserver</command></term>
868 <listitem>
869 <para>
870 is the sample Kerberos 5 server.
871 </para>
872 <indexterm zone="mitkrb sserver">
873 <primary sortas="b-sserver">sserver</primary>
874 </indexterm>
875 </listitem>
876 </varlistentry>
877
878 <varlistentry id="uuclient">
879 <term><command>uuclient</command></term>
880 <listitem>
881 <para>
882 is another sample client.
883 </para>
884 <indexterm zone="mitkrb uuclient">
885 <primary sortas="b-uuclient">uuclient</primary>
886 </indexterm>
887 </listitem>
888 </varlistentry>
889
890 <varlistentry id="uuserver">
891 <term><command>uuserver</command></term>
892 <listitem>
893 <para>
894 is another sample server.
895 </para>
896 <indexterm zone="mitkrb uuserver">
897 <primary sortas="b-uuserver">uuserver</primary>
898 </indexterm>
899 </listitem>
900 </varlistentry>
901
902
903 <varlistentry id="libgssapi_krb5">
904 <term><filename class="libraryfile">libgssapi_krb5.so</filename></term>
905 <listitem>
906 <para>
907 contains the Generic Security Service Application Programming
908 Interface (GSSAPI) functions which provides security services
909 to callers in a generic fashion, supportable with a range of
910 underlying mechanisms and technologies and hence allowing
911 source-level portability of applications to different
912 environments.
913 </para>
914 <indexterm zone="mitkrb libgssapi_krb5">
915 <primary sortas="c-libgssapi_krb5">libgssapi_krb5.so</primary>
916 </indexterm>
917 </listitem>
918 </varlistentry>
919
920 <varlistentry id="libkadm5clnt">
921 <term><filename class="libraryfile">libkadm5clnt.so</filename></term>
922 <listitem>
923 <para>
924 contains the administrative authentication and password checking
925 functions required by Kerberos 5 client-side programs.
926 </para>
927 <indexterm zone="mitkrb libkadm5clnt">
928 <primary sortas="c-libkadm5clnt">libkadm5clnt.so</primary>
929 </indexterm>
930 </listitem>
931 </varlistentry>
932
933 <varlistentry id="libkadm5srv">
934 <term><filename class="libraryfile">libkadm5srv.so</filename></term>
935 <listitem>
936 <para>
937 contains the administrative authentication and password
938 checking functions required by Kerberos 5 servers.
939 </para>
940 <indexterm zone="mitkrb libkadm5srv">
941 <primary sortas="c-libkadm5srv">libkadm5srv.so</primary>
942 </indexterm>
943 </listitem>
944 </varlistentry>
945
946 <varlistentry id="libkdb5">
947 <term><filename class="libraryfile">libkdb5.so</filename></term>
948 <listitem>
949 <para>
950 is a Kerberos 5 authentication/authorization database
951 access library.
952 </para>
953 <indexterm zone="mitkrb libkdb5">
954 <primary sortas="c-libkdb5">libkdb5.so</primary>
955 </indexterm>
956 </listitem>
957 </varlistentry>
958
959 <varlistentry id="libkrad">
960 <term><filename class="libraryfile">libkrad.so</filename></term>
961 <listitem>
962 <para>
963 contains the internal support library for RADIUS functionality.
964 </para>
965 <indexterm zone="mitkrb libkrad">
966 <primary sortas="c-libkrad">libkrad.so</primary>
967 </indexterm>
968 </listitem>
969 </varlistentry>
970
971 <varlistentry id="libkrb5">
972 <term><filename class="libraryfile">libkrb5.so</filename></term>
973 <listitem>
974 <para>
975 is an all-purpose <application>Kerberos 5</application> library.
976 </para>
977 <indexterm zone="mitkrb libkrb5">
978 <primary sortas="c-libkrb5">libkrb5.so</primary>
979 </indexterm>
980 </listitem>
981 </varlistentry>
982
983 </variablelist>
984
985 </sect2>
986
987</sect1>
Note: See TracBrowser for help on using the repository browser.