source: postlfs/security/mitkrb.xml@ 45ab6c7

trunk
Last change on this file since 45ab6c7 was 45ab6c7, checked in by Xi Ruoyao <xry111@…>, 3 months ago

more SVN prop clean up

Remove "$LastChanged$" everywhere, and also some unused $Date$

  • Property mode set to 100644
File size: 31.9 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY mitkrb-download-http "https://kerberos.org/dist/krb5/&mitkrb-major-version;/krb5-&mitkrb-version;.tar.gz">
8 <!ENTITY mitkrb-download-ftp " ">
9 <!ENTITY mitkrb-md5sum "81257292f8243f735654d4fd5d1fef6a">
10 <!ENTITY mitkrb-size "8.3 MB">
11 <!ENTITY mitkrb-buildsize "138 MB (add 24 MB for tests)">
12 <!ENTITY mitkrb-time "0.8 SBU (add 1.4 SBU for tests)">
13]>
14
15<sect1 id="mitkrb" xreflabel="MIT Kerberos V5-&mitkrb-version;">
16 <?dbhtml filename="mitkrb.html"?>
17
18 <sect1info>
19 <date>$Date$</date>
20 </sect1info>
21
22 <title>MIT Kerberos V5-&mitkrb-version;</title>
23
24 <indexterm zone="mitkrb">
25 <primary sortas="a-MIT-Kerberos">MIT Kerberos V5</primary>
26 </indexterm>
27
28 <sect2 role="package">
29 <title>Introduction to MIT Kerberos V5</title>
30
31 <para>
32 <application>MIT Kerberos V5</application> is a free implementation
33 of Kerberos 5. Kerberos is a network authentication protocol. It
34 centralizes the authentication database and uses kerberized
35 applications to work with servers or services that support Kerberos
36 allowing single logins and encrypted communication over internal
37 networks or the Internet.
38 </para>
39
40 &lfs101_checked;
41
42 <bridgehead renderas="sect3">Package Information</bridgehead>
43 <itemizedlist spacing="compact">
44 <listitem>
45 <para>
46 Download (HTTP): <ulink url="&mitkrb-download-http;"/>
47 </para>
48 </listitem>
49 <listitem>
50 <para>
51 Download (FTP): <ulink url="&mitkrb-download-ftp;"/>
52 </para>
53 </listitem>
54 <listitem>
55 <para>
56 Download MD5 sum: &mitkrb-md5sum;
57 </para>
58 </listitem>
59 <listitem>
60 <para>
61 Download size: &mitkrb-size;
62 </para>
63 </listitem>
64 <listitem>
65 <para>
66 Estimated disk space required: &mitkrb-buildsize;
67 </para>
68 </listitem>
69 <listitem>
70 <para>
71 Estimated build time: &mitkrb-time;
72 </para>
73 </listitem>
74 </itemizedlist>
75
76 <bridgehead renderas="sect3">MIT Kerberos V5 Dependencies</bridgehead>
77
78 <bridgehead renderas="sect4">Optional</bridgehead>
79 <para role="optional">
80 <!-- <xref linkend="dejagnu"/> (for full test coverage), -->
81 <xref linkend="bind-utils"/>,
82 <xref linkend="gnupg2"/> (to authenticate the package),
83 <xref linkend="keyutils"/>,
84 <xref linkend="openldap"/>,<!-- Seems so that mit has its own
85 implementation of rpc now.
86 <xref linkend="rpcbind"/> (used during the testsuite),-->
87 <xref linkend="valgrind"/> (used during the testsuite),
88 <xref linkend="yasm"/>,
89 <ulink url="http://thrysoee.dk/editline/">libedit</ulink>,
90 <ulink url="https://cmocka.org/">cmocka</ulink>,
91 <ulink url="https://pypi.org/project/pyrad/">pyrad</ulink>, and
92 <ulink url="https://cwrap.org/resolv_wrapper.html">resolv_wrapper</ulink>
93 </para>
94
95 <note>
96 <para>
97 Some sort of time synchronization facility on your system (like
98 <xref linkend="ntp"/>) is required since Kerberos won't authenticate
99 if there is a time difference between a kerberized client and the
100 KDC server.
101 </para>
102 </note>
103
104 <para condition="html" role="usernotes">User Notes:
105 <ulink url="&blfs-wiki;/mitkrb"/>
106 </para>
107 </sect2>
108
109 <sect2 role="installation">
110 <title>Installation of MIT Kerberos V5</title>
111
112 <para>
113 Build <application>MIT Kerberos V5</application> by running the
114 following commands:
115 </para>
116
117<screen><userinput>cd src &amp;&amp;
118
119sed -i -e 's@\^u}@^u cols 300}@' tests/dejagnu/config/default.exp &amp;&amp;
120sed -i -e '/eq 0/{N;s/12 //}' plugins/kdb/db2/libdb2/test/run.test &amp;&amp;
121sed -i '/t_iprop.py/d' tests/Makefile.in &amp;&amp;
122
123./configure --prefix=/usr \
124 --sysconfdir=/etc \
125 --localstatedir=/var/lib \
126 --runstatedir=/run \
127 --with-system-et \
128 --with-system-ss \
129 --with-system-verto=no \
130 --enable-dns-for-realm &amp;&amp;
131make</userinput></screen>
132
133 <para>
134 To test the build, issue as the <systemitem
135 class="username">root</systemitem> user: <command>make -k -j1 check</command>.
136 <!-- You need at least <xref link end="tcl"/>, which is used to drive the
137 testsuite. Furthermore, <xref link end="dejagnu"/> must be available for
138 some of the tests to run.--> If you have a former version of MIT Kerberos V5
139 installed, it may happen that the test suite may pick up the installed
140 versions of the libraries, rather than the newly built ones. If so, it is
141 better to run the tests after the installation.
142 <!-- Note: on my laptop -j8 fails but -j1 passes -->
143 </para>
144
145 <para>
146 Now, as the <systemitem class="username">root</systemitem> user:
147 </para>
148
149<screen role="root"><userinput>make install &amp;&amp;
150
151mv -v /usr/lib/libkrb5.so.3* /lib &amp;&amp;
152mv -v /usr/lib/libk5crypto.so.3* /lib &amp;&amp;
153mv -v /usr/lib/libkrb5support.so.0* /lib &amp;&amp;
154
155ln -v -sf ../../lib/libkrb5.so.3.3 /usr/lib/libkrb5.so &amp;&amp;
156ln -v -sf ../../lib/libk5crypto.so.3.1 /usr/lib/libk5crypto.so &amp;&amp;
157ln -v -sf ../../lib/libkrb5support.so.0.1 /usr/lib/libkrb5support.so &amp;&amp;
158
159mv -v /usr/bin/ksu /bin &amp;&amp;
160chmod -v 755 /bin/ksu &amp;&amp;
161
162install -v -dm755 /usr/share/doc/krb5-&mitkrb-version; &amp;&amp;
163cp -vfr ../doc/* /usr/share/doc/krb5-&mitkrb-version;</userinput></screen>
164
165 </sect2>
166
167 <sect2 role="commands">
168 <title>Command Explanations</title>
169
170 <para>
171 The first <command>sed</command> increases the width of the virtual
172 terminal used for some tests to prevent some spurious text in the output
173 which is taken as a failure. The second <command>sed</command> removes a
174 test that is known to fail. The third <command>sed</command> removes a
175 test that is known to hang.
176 </para>
177
178 <para>
179 <parameter>--localstatedir=/var/lib</parameter>: This option is
180 used so that the Kerberos variable runtime data is located in
181 <filename class="directory">/var/lib</filename> instead of
182 <filename class="directory">/usr/var</filename>.
183 </para>
184
185 <para>
186 <parameter>--runstatedir=/run</parameter>: This option is used so that
187 the Kerberos runtime state information is located in
188 <filename class="directory">/run</filename> instead of the deprecated
189 <filename class="directory">/var/run</filename>.
190 </para>
191
192 <para>
193 <parameter>--with-system-et</parameter>: This switch causes the build
194 to use the system-installed versions of the error-table support
195 software.
196 </para>
197
198 <para>
199 <parameter>--with-system-ss</parameter>: This switch causes the build
200 to use the system-installed versions of the subsystem command-line
201 interface software.
202 </para>
203
204 <para>
205 <parameter>--with-system-verto=no</parameter>: This switch fixes a bug in
206 the package: it does not recognize its own verto library installed
207 previously. This is not a problem, if reinstalling the same version,
208 but if you are updating, the old library is used as system's one,
209 instead of installing the new version.
210 </para>
211
212 <para>
213 <parameter>--enable-dns-for-realm</parameter>: This switch allows
214 realms to be resolved using the DNS server.
215 </para>
216
217 <para>
218 <option>--with-ldap</option>: Use this switch if you want to compile the
219 <application>OpenLDAP</application> database backend module.
220 </para>
221
222 <para>
223 <command>mv -v /usr/lib/libk... /lib </command> and
224 <command>ln -v -sf ../../lib/libk... /usr/lib/libk...</command>:
225 Move critical libraries to the
226 <filename class="directory">/lib</filename> directory so that they are
227 available when the <filename class="directory">/usr</filename>
228 filesystem is not mounted.
229 </para>
230
231 <para>
232 <command>find /usr/lib -type f -name "lib$f*.so*" -exec chmod -v 755 {} \;</command>:
233 This command changes the permisison of installed libraries.
234 </para>
235
236 <para>
237 <command>mv -v /usr/bin/ksu /bin</command>: Moves the
238 <command>ksu</command> program to the
239 <filename class="directory">/bin</filename> directory so that it is
240 available when the <filename class="directory">/usr</filename>
241 filesystem is not mounted.
242 </para>
243
244 </sect2>
245
246 <sect2 role="configuration">
247 <title>Configuring MIT Kerberos V5</title>
248
249 <sect3 id="krb5-config">
250 <title>Config Files</title>
251
252 <para>
253 <filename>/etc/krb5.conf</filename> and
254 <filename>/var/lib/krb5kdc/kdc.conf</filename>
255 </para>
256
257 <indexterm zone="mitkrb krb5-config">
258 <primary sortas="e-etc-krb5.conf">/etc/krb5.conf</primary>
259 </indexterm>
260
261 <indexterm zone="mitkrb krb5-config">
262 <primary sortas="e-var-lib-krb5kdc-kdc.conf">/var/lib/krb5kdc/kdc.conf</primary>
263 </indexterm>
264
265 </sect3>
266
267 <sect3>
268 <title>Configuration Information</title>
269
270 <sect4>
271 <title>Kerberos Configuration</title>
272
273 <tip>
274 <para>
275 You should consider installing some sort of password checking
276 dictionary so that you can configure the installation to only
277 accept strong passwords. A suitable dictionary to use is shown in
278 the <xref linkend="cracklib"/> instructions. Note that only one
279 file can be used, but you can concatenate many files into one. The
280 configuration file shown below assumes you have installed a
281 dictionary to <filename>/usr/share/dict/words</filename>.
282 </para>
283 </tip>
284
285 <para>
286 Create the Kerberos configuration file with the following
287 commands issued by the <systemitem class="username">root</systemitem>
288 user:
289 </para>
290
291<screen role="root"><userinput>cat &gt; /etc/krb5.conf &lt;&lt; "EOF"
292<literal># Begin /etc/krb5.conf
293
294[libdefaults]
295 default_realm = <replaceable>&lt;EXAMPLE.ORG&gt;</replaceable>
296 encrypt = true
297
298[realms]
299 <replaceable>&lt;EXAMPLE.ORG&gt;</replaceable> = {
300 kdc = <replaceable>&lt;belgarath.example.org&gt;</replaceable>
301 admin_server = <replaceable>&lt;belgarath.example.org&gt;</replaceable>
302 dict_file = /usr/share/dict/words
303 }
304
305[domain_realm]
306 .<replaceable>&lt;example.org&gt;</replaceable> = <replaceable>&lt;EXAMPLE.ORG&gt;</replaceable>
307
308[logging]
309 kdc = SYSLOG:INFO:AUTH
310 admin_server = SYSLOG:INFO:AUTH
311 default = SYSLOG:DEBUG:DAEMON
312
313# End /etc/krb5.conf</literal>
314EOF</userinput></screen>
315
316 <para>
317 You will need to substitute your domain and proper hostname for the
318 occurrences of the <replaceable>&lt;belgarath&gt;</replaceable> and
319 <replaceable>&lt;example.org&gt;</replaceable> names.
320 </para>
321
322 <para>
323 <option>default_realm</option> should be the name of your
324 domain changed to ALL CAPS. This isn't required, but both
325 <application>Heimdal</application> and MIT recommend it.
326 </para>
327
328 <para>
329 <option>encrypt = true</option> provides encryption of all traffic
330 between kerberized clients and servers. It's not necessary and can
331 be left off. If you leave it off, you can encrypt all traffic from
332 the client to the server using a switch on the client program
333 instead.
334 </para>
335
336 <para>
337 The <option>[realms]</option> parameters tell the client programs
338 where to look for the KDC authentication services.
339 </para>
340
341 <para>
342 The <option>[domain_realm]</option> section maps a domain to a realm.
343 </para>
344
345 <para>
346 Create the KDC database:
347 </para>
348
349<screen role="root"><userinput>kdb5_util create -r <replaceable>&lt;EXAMPLE.ORG&gt;</replaceable> -s</userinput></screen>
350
351 <para>
352 Now you should populate the database with principals
353 (users). For now, just use your regular login name or
354 <systemitem class="username">root</systemitem>.
355 </para>
356
357<screen role="root"><userinput>kadmin.local
358<prompt>kadmin.local:</prompt> add_policy dict-only
359<prompt>kadmin.local:</prompt> addprinc -policy dict-only <replaceable>&lt;loginname&gt;</replaceable></userinput></screen>
360
361 <para>
362 The KDC server and any machine running kerberized
363 server daemons must have a host key installed:
364 </para>
365
366<screen role="root"><userinput><prompt>kadmin.local:</prompt> addprinc -randkey host/<replaceable>&lt;belgarath.example.org&gt;</replaceable></userinput></screen>
367
368 <para>
369 After choosing the defaults when prompted, you will have to
370 export the data to a keytab file:
371 </para>
372
373<screen role="root"><userinput><prompt>kadmin.local:</prompt> ktadd host/<replaceable>&lt;belgarath.example.org&gt;</replaceable></userinput></screen>
374
375 <para>
376 This should have created a file in
377 <filename class="directory">/etc</filename> named
378 <filename>krb5.keytab</filename> (Kerberos 5). This file should
379 have 600 (<systemitem class="username">root</systemitem> rw only)
380 permissions. Keeping the keytab files from public access is crucial
381 to the overall security of the Kerberos installation.
382 </para>
383
384 <para>
385 Exit the <command>kadmin</command> program (use
386 <command>quit</command> or <command>exit</command>) and return
387 back to the shell prompt. Start the KDC daemon manually, just to
388 test out the installation:
389 </para>
390
391<screen role="root"><userinput>/usr/sbin/krb5kdc</userinput></screen>
392
393 <para>
394 Attempt to get a ticket with the following command:
395 </para>
396
397<screen><userinput>kinit <replaceable>&lt;loginname&gt;</replaceable></userinput></screen>
398
399 <para>
400 You will be prompted for the password you created. After you
401 get your ticket, you can list it with the following command:
402 </para>
403
404<screen><userinput>klist</userinput></screen>
405
406 <para>
407 Information about the ticket should be displayed on the
408 screen.
409 </para>
410
411 <para>
412 To test the functionality of the keytab file, issue the
413 following command as the
414 <systemitem class="username">root</systemitem> user:
415 </para>
416
417<screen role="root"><userinput>ktutil
418<prompt>ktutil:</prompt> rkt /etc/krb5.keytab
419<prompt>ktutil:</prompt> l</userinput></screen>
420
421 <para>
422 This should dump a list of the host principal, along with
423 the encryption methods used to access the principal.
424 </para>
425
426 <para>
427 Create an empty ACL file that can be modified later:
428 </para>
429
430<screen role="root"><userinput>touch /var/lib/krb5kdc/kadm5.acl</userinput></screen>
431
432 <para>
433 At this point, if everything has been successful so far, you
434 can feel fairly confident in the installation and configuration of
435 the package.
436 </para>
437
438 </sect4>
439
440 <sect4>
441 <title>Additional Information</title>
442
443 <para>
444 For additional information consult the <ulink
445 url="http://web.mit.edu/kerberos/www/krb5-&mitkrb-major-version;/#documentation">
446 documentation for krb5-&mitkrb-version;</ulink> on which the above
447 instructions are based.
448 </para>
449
450 </sect4>
451
452 </sect3>
453
454 <sect3 id="mitkrb-init">
455 <title><phrase revision="sysv">Init Script</phrase>
456 <phrase revision="systemd">Systemd Unit</phrase></title>
457
458 <para revision="sysv">
459 If you want to start <application>Kerberos</application> services
460 at boot, install the <filename>/etc/rc.d/init.d/krb5</filename> init
461 script included in the <xref linkend="bootscripts"/> package using
462 the following command:
463 </para>
464
465 <para revision="systemd">
466 If you want to start <application>Kerberos</application> services
467 at boot, install the <filename>krb5.service</filename> unit included in
468 the <xref linkend="systemd-units"/> package using the following command:
469 </para>
470
471 <indexterm zone="mitkrb mitkrb-init">
472 <primary sortas="f-krb5">krb5</primary>
473 </indexterm>
474
475<screen role="root"><userinput>make install-krb5</userinput></screen>
476
477 </sect3>
478
479 </sect2>
480
481 <sect2 role="content">
482
483 <title>Contents</title>
484
485 <segmentedlist>
486 <segtitle>Installed Programs</segtitle>
487 <segtitle>Installed Libraries</segtitle>
488 <segtitle>Installed Directories</segtitle>
489
490 <seglistitem>
491 <seg>
492 gss-client, gss-server, k5srvutil, kadmin, kadmin.local,
493 kadmind, kdb5_ldap_util (optional), kdb5_util, kdestroy, kinit, klist,
494 kpasswd, kprop, kpropd, kproplog, krb5-config, krb5-send-pr, krb5kdc,
495 ksu, kswitch, ktutil, kvno, sclient, sim_client, sim_server,
496 sserver, uuclient, and uuserver
497 </seg>
498 <seg>
499 libgssapi_krb5.so, libgssrpc.so, libk5crypto.so, libkadm5clnt_mit.so,
500 libkadm5clnt.so, libkadm5srv_mit.so, libkadm5srv.so, libkdb_ldap.so
501 (optional), libkdb5.so, libkrad.so, libkrb5.so, libkrb5support.so,
502 libverto.so, and some plugins under the /usr/lib/krb5 tree
503 </seg>
504 <seg>
505 /usr/include/{gssapi,gssrpc,kadm5,krb5},
506 /usr/lib/krb5,
507 /usr/share/{doc/krb5-&mitkrb-version;,examples/krb5},
508 /var/lib/krb5kdc, and
509 /run/krb5kdc
510 </seg>
511 </seglistitem>
512 </segmentedlist>
513
514 <variablelist>
515 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
516 <?dbfo list-presentation="list"?>
517 <?dbhtml list-presentation="table"?>
518
519 <varlistentry id="gss-client">
520 <term><command>gss-client</command></term>
521 <listitem>
522 <para>
523 is a GSSAPI test client
524 </para>
525 <indexterm zone="mitkrb gss-client">
526 <primary sortas="b-gss-client">gss-client</primary>
527 </indexterm>
528 </listitem>
529 </varlistentry>
530
531 <varlistentry id="gss-server">
532 <term><command>gss-server</command></term>
533 <listitem>
534 <para>
535 is a GSSAPI test server
536 </para>
537 <indexterm zone="mitkrb gss-server">
538 <primary sortas="b-gss-server">gss-server</primary>
539 </indexterm>
540 </listitem>
541 </varlistentry>
542
543 <varlistentry id="k5srvutil">
544 <term><command>k5srvutil</command></term>
545 <listitem>
546 <para>
547 is a host keytable manipulation utility
548 </para>
549 <indexterm zone="mitkrb k5srvutil">
550 <primary sortas="b-k5srvutil">k5srvutil</primary>
551 </indexterm>
552 </listitem>
553 </varlistentry>
554
555 <varlistentry id="kadmin">
556 <term><command>kadmin</command></term>
557 <listitem>
558 <para>
559 is an utility used to make modifications
560 to the Kerberos database
561 </para>
562 <indexterm zone="mitkrb kadmin">
563 <primary sortas="b-kadmin">kadmin</primary>
564 </indexterm>
565 </listitem>
566 </varlistentry>
567
568 <varlistentry id="kadmin.local">
569 <term><command>kadmin.local</command></term>
570 <listitem>
571 <para>
572 is an utility similar to <command>kadmin</command>, but if the
573 database is db2, the local client <command>kadmin.local</command>,
574 is intended to run directly on the master KDC without Kerberos
575 authentication
576 </para>
577 <indexterm zone="mitkrb kadmin.local">
578 <primary sortas="b-kadmin.local">kadmin.local</primary>
579 </indexterm>
580 </listitem>
581 </varlistentry>
582
583 <varlistentry id="kadmind">
584 <term><command>kadmind</command></term>
585 <listitem>
586 <para>
587 is a server for administrative access
588 to a Kerberos database
589 </para>
590 <indexterm zone="mitkrb kadmind">
591 <primary sortas="b-kadmind">kadmind</primary>
592 </indexterm>
593 </listitem>
594 </varlistentry>
595
596 <varlistentry id="kdb5_ldap_util">
597 <term><command>kdb5_ldap_util (optional)</command></term>
598 <listitem>
599 <para>
600 allows an administrator to manage realms, Kerberos services
601 and ticket policies
602 </para>
603 <indexterm zone="mitkrb kdb5_ldap_util">
604 <primary sortas="b-kdb5_ldap_util">kdb5_ldap_util</primary>
605 </indexterm>
606 </listitem>
607 </varlistentry>
608
609 <varlistentry id="kdb5_util">
610 <term><command>kdb5_util</command></term>
611 <listitem>
612 <para>
613 is the KDC database utility
614 </para>
615 <indexterm zone="mitkrb kdb5_util">
616 <primary sortas="b-kdb5_util">kdb5_util</primary>
617 </indexterm>
618 </listitem>
619 </varlistentry>
620
621 <varlistentry id="kdestroy">
622 <term><command>kdestroy</command></term>
623 <listitem>
624 <para>
625 removes the current set of tickets
626 </para>
627 <indexterm zone="mitkrb kdestroy">
628 <primary sortas="b-kdestroy">kdestroy</primary>
629 </indexterm>
630 </listitem>
631 </varlistentry>
632
633 <varlistentry id="kinit">
634 <term><command>kinit</command></term>
635 <listitem>
636 <para>
637 is used to authenticate to the Kerberos server as a
638 principal and acquire a ticket granting ticket that can
639 later be used to obtain tickets for other services
640 </para>
641 <indexterm zone="mitkrb kinit">
642 <primary sortas="b-kinit">kinit</primary>
643 </indexterm>
644 </listitem>
645 </varlistentry>
646
647 <varlistentry id="klist">
648 <term><command>klist</command></term>
649 <listitem>
650 <para>
651 reads and displays the current tickets in
652 the credential cache
653 </para>
654 <indexterm zone="mitkrb klist">
655 <primary sortas="b-klist">klist</primary>
656 </indexterm>
657 </listitem>
658 </varlistentry>
659
660 <varlistentry id="kpasswd">
661 <term><command>kpasswd</command></term>
662 <listitem>
663 <para>
664 is a program for changing Kerberos 5 passwords
665 </para>
666 <indexterm zone="mitkrb kpasswd">
667 <primary sortas="b-kpasswd">kpasswd</primary>
668 </indexterm>
669 </listitem>
670 </varlistentry>
671
672 <varlistentry id="kprop">
673 <term><command>kprop</command></term>
674 <listitem>
675 <para>
676 takes a principal database in a specified format and
677 converts it into a stream of database records
678 </para>
679 <indexterm zone="mitkrb kprop">
680 <primary sortas="b-kprop">kprop</primary>
681 </indexterm>
682 </listitem>
683 </varlistentry>
684
685 <varlistentry id="kpropd">
686 <term><command>kpropd</command></term>
687 <listitem>
688 <para>
689 receives a database sent by <command>kprop</command>
690 and writes it as a local database
691 </para>
692 <indexterm zone="mitkrb kpropd">
693 <primary sortas="b-kpropd">kpropd</primary>
694 </indexterm>
695 </listitem>
696 </varlistentry>
697
698 <varlistentry id="kproplog">
699 <term><command>kproplog</command></term>
700 <listitem>
701 <para>
702 displays the contents of the KDC database update log to standard
703 output
704 </para>
705 <indexterm zone="mitkrb kproplog">
706 <primary sortas="b-kproplog">kproplog</primary>
707 </indexterm>
708 </listitem>
709 </varlistentry>
710
711 <varlistentry id="krb5-config-prog2">
712 <term><command>krb5-config</command></term>
713 <listitem>
714 <para>
715 gives information on how to link programs against
716 libraries
717 </para>
718 <indexterm zone="mitkrb krb5-config-prog2">
719 <primary sortas="b-krb5-config">krb5-config</primary>
720 </indexterm>
721 </listitem>
722 </varlistentry>
723
724 <varlistentry id="krb5kdc">
725 <term><command>krb5kdc</command></term>
726 <listitem>
727 <para>
728 is the <application>Kerberos 5</application> server
729 </para>
730 <indexterm zone="mitkrb krb5kdc">
731 <primary sortas="b-krb5kdc">krb5kdc</primary>
732 </indexterm>
733 </listitem>
734 </varlistentry>
735
736 <varlistentry id="krb5-send-pr">
737 <term><command>krb5-send-pr</command></term>
738 <listitem>
739 <para>
740 sends a problem report (PR) to a central support site
741 </para>
742 <indexterm zone="mitkrb krb5-send-pr">
743 <primary sortas="b-krb-send-pr">krb5-send-pr</primary>
744 </indexterm>
745 </listitem>
746 </varlistentry>
747
748 <varlistentry id="ksu">
749 <term><command>ksu</command></term>
750 <listitem>
751 <para>
752 is the super user program using Kerberos protocol.
753 Requires a properly configured
754 <filename>/etc/shells</filename> and
755 <filename>~/.k5login</filename> containing principals
756 authorized to become super users
757 </para>
758 <indexterm zone="mitkrb ksu">
759 <primary sortas="b-ksu">ksu</primary>
760 </indexterm>
761 </listitem>
762 </varlistentry>
763
764 <varlistentry id="kswitch">
765 <term><command>kswitch</command></term>
766 <listitem>
767 <para>
768 makes the specified credential cache the
769 primary cache for the collection, if a cache
770 collection is available
771 </para>
772 <indexterm zone="mitkrb kswitch">
773 <primary sortas="b-kswitch">kswitch</primary>
774 </indexterm>
775 </listitem>
776 </varlistentry>
777
778 <varlistentry id="ktutil">
779 <term><command>ktutil</command></term>
780 <listitem>
781 <para>
782 is a program for managing Kerberos keytabs
783 </para>
784 <indexterm zone="mitkrb ktutil">
785 <primary sortas="b-ktutil">ktutil</primary>
786 </indexterm>
787 </listitem>
788 </varlistentry>
789
790 <varlistentry id="kvno">
791 <term><command>kvno</command></term>
792 <listitem>
793 <para>
794 prints keyversion numbers of Kerberos principals
795 </para>
796 <indexterm zone="mitkrb kvno">
797 <primary sortas="b-kvno">kvno</primary>
798 </indexterm>
799 </listitem>
800 </varlistentry>
801
802 <varlistentry id="sclient">
803 <term><command>sclient</command></term>
804 <listitem>
805 <para>
806 is used to contact a sample server and authenticate to it
807 using Kerberos 5 tickets, then display the server's
808 response
809 </para>
810 <indexterm zone="mitkrb sclient">
811 <primary sortas="b-sclient">sclient</primary>
812 </indexterm>
813 </listitem>
814 </varlistentry>
815
816 <varlistentry id="sim_client">
817 <term><command>sim_client</command></term>
818 <listitem>
819 <para>
820 is a simple UDP-based sample client program, for
821 demonstration
822 </para>
823 <indexterm zone="mitkrb sim_client">
824 <primary sortas="b-sim_client">sim_client</primary>
825 </indexterm>
826 </listitem>
827 </varlistentry>
828
829 <varlistentry id="sim_server">
830 <term><command>sim_server</command></term>
831 <listitem>
832 <para>
833 is a simple UDP-based server application, for
834 demonstration
835 </para>
836 <indexterm zone="mitkrb sim_server">
837 <primary sortas="b-sim_server">sim_server</primary>
838 </indexterm>
839 </listitem>
840 </varlistentry>
841
842 <varlistentry id="sserver">
843 <term><command>sserver</command></term>
844 <listitem>
845 <para>
846 is the sample Kerberos 5 server
847 </para>
848 <indexterm zone="mitkrb sserver">
849 <primary sortas="b-sserver">sserver</primary>
850 </indexterm>
851 </listitem>
852 </varlistentry>
853
854 <varlistentry id="uuclient">
855 <term><command>uuclient</command></term>
856 <listitem>
857 <para>
858 is another sample client
859 </para>
860 <indexterm zone="mitkrb uuclient">
861 <primary sortas="b-uuclient">uuclient</primary>
862 </indexterm>
863 </listitem>
864 </varlistentry>
865
866 <varlistentry id="uuserver">
867 <term><command>uuserver</command></term>
868 <listitem>
869 <para>
870 is another sample server
871 </para>
872 <indexterm zone="mitkrb uuserver">
873 <primary sortas="b-uuserver">uuserver</primary>
874 </indexterm>
875 </listitem>
876 </varlistentry>
877
878
879 <varlistentry id="libgssapi_krb5">
880 <term><filename class="libraryfile">libgssapi_krb5.so</filename></term>
881 <listitem>
882 <para>
883 contains the Generic Security Service Application Programming
884 Interface (GSSAPI) functions which provides security services
885 to callers in a generic fashion, supportable with a range of
886 underlying mechanisms and technologies and hence allowing
887 source-level portability of applications to different
888 environments
889 </para>
890 <indexterm zone="mitkrb libgssapi_krb5">
891 <primary sortas="c-libgssapi_krb5">libgssapi_krb5.so</primary>
892 </indexterm>
893 </listitem>
894 </varlistentry>
895
896 <varlistentry id="libkadm5clnt">
897 <term><filename class="libraryfile">libkadm5clnt.so</filename></term>
898 <listitem>
899 <para>
900 contains the administrative authentication and password checking
901 functions required by Kerberos 5 client-side programs
902 </para>
903 <indexterm zone="mitkrb libkadm5clnt">
904 <primary sortas="c-libkadm5clnt">libkadm5clnt.so</primary>
905 </indexterm>
906 </listitem>
907 </varlistentry>
908
909 <varlistentry id="libkadm5srv">
910 <term><filename class="libraryfile">libkadm5srv.so</filename></term>
911 <listitem>
912 <para>
913 contains the administrative authentication and password
914 checking functions required by Kerberos 5 servers
915 </para>
916 <indexterm zone="mitkrb libkadm5srv">
917 <primary sortas="c-libkadm5srv">libkadm5srv.so</primary>
918 </indexterm>
919 </listitem>
920 </varlistentry>
921
922 <varlistentry id="libkdb5">
923 <term><filename class="libraryfile">libkdb5.so</filename></term>
924 <listitem>
925 <para>
926 is a Kerberos 5 authentication/authorization database
927 access library
928 </para>
929 <indexterm zone="mitkrb libkdb5">
930 <primary sortas="c-libkdb5">libkdb5.so</primary>
931 </indexterm>
932 </listitem>
933 </varlistentry>
934
935 <varlistentry id="libkrad">
936 <term><filename class="libraryfile">libkrad.so</filename></term>
937 <listitem>
938 <para>
939 contains the internal support library for RADIUS functionality
940 </para>
941 <indexterm zone="mitkrb libkrad">
942 <primary sortas="c-libkrad">libkrad.so</primary>
943 </indexterm>
944 </listitem>
945 </varlistentry>
946
947 <varlistentry id="libkrb5">
948 <term><filename class="libraryfile">libkrb5.so</filename></term>
949 <listitem>
950 <para>
951 is an all-purpose <application>Kerberos 5</application> library
952 </para>
953 <indexterm zone="mitkrb libkrb5">
954 <primary sortas="c-libkrb5">libkrb5.so</primary>
955 </indexterm>
956 </listitem>
957 </varlistentry>
958
959 </variablelist>
960
961 </sect2>
962
963</sect1>
Note: See TracBrowser for help on using the repository browser.