source: postlfs/security/mitkrb.xml@ b7a300f7

10.0 10.1 11.0 11.1 11.2 8.2 8.3 8.4 9.0 9.1 basic bdubbs/svn elogind lazarus perl-modules plabs/python-mods qt5new trunk upgradedb xry111/intltool xry111/soup3 xry111/test-20220226
Last change on this file since b7a300f7 was b7a300f7, checked in by Pierre Labastie <pieere@…>, 5 years ago

Updates:

  • mesa-17.2.1
  • llvm-5.0.0
  • fontconfig-2.12.6
  • joe-4.5
  • krb5-1.15.2
  • git-2.14.2
  • enchant-2.1.2
  • php-7.1.10
  • add a file setting GIO_USE_TLS in the configuration section of glib-networking

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@19289 af4574ff-66df-0310-9fd7-8a98e5e911e0

  • Property mode set to 100644
File size: 31.8 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY mitkrb-download-http "https://web.mit.edu/kerberos/dist/krb5/&mitkrb-major-version;/krb5-&mitkrb-version;.tar.gz">
8 <!ENTITY mitkrb-download-ftp " ">
9 <!ENTITY mitkrb-md5sum "b160f72161c730897dc7689f876b6e2a">
10 <!ENTITY mitkrb-size "8.9 MB">
11 <!ENTITY mitkrb-buildsize "136 MB (additional 23 MB for the testsuite)">
12 <!ENTITY mitkrb-time "0.8 SBU (additional 5.0 SBU for the testsuite)">
13]>
14
15<sect1 id="mitkrb" xreflabel="MIT Kerberos V5-&mitkrb-version;">
16 <?dbhtml filename="mitkrb.html"?>
17
18 <sect1info>
19 <othername>$LastChangedBy$</othername>
20 <date>$Date$</date>
21 </sect1info>
22
23 <title>MIT Kerberos V5-&mitkrb-version;</title>
24
25 <indexterm zone="mitkrb">
26 <primary sortas="a-MIT-Kerberos">MIT Kerberos V5</primary>
27 </indexterm>
28
29 <sect2 role="package">
30 <title>Introduction to MIT Kerberos V5</title>
31
32 <para>
33 <application>MIT Kerberos V5</application> is a free implementation
34 of Kerberos 5. Kerberos is a network authentication protocol. It
35 centralizes the authentication database and uses kerberized
36 applications to work with servers or services that support Kerberos
37 allowing single logins and encrypted communication over internal
38 networks or the Internet.
39 </para>
40
41 &lfs81_checked;
42
43 <bridgehead renderas="sect3">Package Information</bridgehead>
44 <itemizedlist spacing="compact">
45 <listitem>
46 <para>
47 Download (HTTP): <ulink url="&mitkrb-download-http;"/>
48 </para>
49 </listitem>
50 <listitem>
51 <para>
52 Download (FTP): <ulink url="&mitkrb-download-ftp;"/>
53 </para>
54 </listitem>
55 <listitem>
56 <para>
57 Download MD5 sum: &mitkrb-md5sum;
58 </para>
59 </listitem>
60 <listitem>
61 <para>
62 Download size: &mitkrb-size;
63 </para>
64 </listitem>
65 <listitem>
66 <para>
67 Estimated disk space required: &mitkrb-buildsize;
68 </para>
69 </listitem>
70 <listitem>
71 <para>
72 Estimated build time: &mitkrb-time;
73 </para>
74 </listitem>
75 </itemizedlist>
76
77<!-- Patch is not needed for this version, but don't remove this.
78 <bridgehead renderas="sect3">Additional Downloads</bridgehead>
79 <itemizedlist spacing="compact">
80 <listitem>
81 <para>
82 Patch required on systems with IPv4 only enabled:
83 <ulink url="&patch-root;/mitkrb-&mitkrb-version;-fix_ipv4_only-1.patch"/>
84 </para>
85 </listitem>
86 </itemizedlist>
87-->
88
89 <bridgehead renderas="sect3">MIT Kerberos V5 Dependencies</bridgehead>
90
91 <bridgehead renderas="sect4">Optional</bridgehead>
92 <para role="optional">
93 <xref linkend="dejagnu"/> (for full test coverage),
94 <xref linkend="gnupg2"/> (to authenticate the package),
95 <xref linkend="keyutils"/>,
96 <xref linkend="openldap"/>,
97 <xref linkend="python2"/> (used during the testsuite),
98 <xref linkend="rpcbind"/> (used during the testsuite), and
99 <xref linkend="valgrind"/> (used during the test suite)
100 </para>
101
102 <note>
103 <para>
104 Some sort of time synchronization facility on your system (like
105 <xref linkend="ntp"/>) is required since Kerberos won't authenticate
106 if there is a time difference between a kerberized client and the
107 KDC server.
108 </para>
109 </note>
110
111 <para condition="html" role="usernotes">User Notes:
112 <ulink url="&blfs-wiki;/mitkrb"/>
113 </para>
114 </sect2>
115
116 <sect2 role="installation">
117 <title>Installation of MIT Kerberos V5</title>
118
119<!-- PATCH IS REJECTED - ALREADY PATCHED
120 <para>
121 If your system is configured to support only IPv4, apply the following
122 patch:
123 </para>
124
125<screen><userinput>patch -p1 -i ../mitkrb-&mitkrb-version;-fix_ipv4_only-1.patch</userinput></screen>
126-->
127
128 <para>
129 Build <application>MIT Kerberos V5</application> by running the
130 following commands:
131 </para>
132
133<screen><userinput>cd src &amp;&amp;
134
135sed -e 's@\^u}@^u cols 300}@' \
136 -i tests/dejagnu/config/default.exp &amp;&amp;
137
138sed -e '/eq 0/{N;s/12 //}' \
139 -i plugins/kdb/db2/libdb2/test/run.test &amp;&amp;
140
141./configure --prefix=/usr \
142 --sysconfdir=/etc \
143 --localstatedir=/var/lib \
144 --with-system-et \
145 --with-system-ss \
146 --with-system-verto=no \
147 --enable-dns-for-realm &amp;&amp;
148make</userinput></screen>
149
150 <para>
151 To test the build, issue as the <systemitem
152 class="username">root</systemitem> user: <command>make check</command>.
153 You need at least <xref linkend="tcl"/>, which is used to drive the
154 testsuite. Furthermore, <xref linkend="dejagnu"/> must be available for
155 some of the tests to run. If you have a former version of MIT Kerberos V5
156 installed, it may happen that the test suite pick up the installed
157 versions of the libraries, rather than the newly built ones. If so, it is
158 better to run the tests after the installation.
159 </para>
160
161 <para>
162 Now, as the <systemitem class="username">root</systemitem> user:
163 </para>
164
165<screen role="root"><userinput>make install &amp;&amp;
166
167for f in gssapi_krb5 gssrpc k5crypto kadm5clnt kadm5srv \
168 kdb5 kdb_ldap krad krb5 krb5support verto ; do
169
170 find /usr/lib -type f -name "lib$f*.so*" -exec chmod -v 755 {} \;
171done &amp;&amp;
172
173mv -v /usr/lib/libkrb5.so.3* /lib &amp;&amp;
174mv -v /usr/lib/libk5crypto.so.3* /lib &amp;&amp;
175mv -v /usr/lib/libkrb5support.so.0* /lib &amp;&amp;
176
177ln -v -sf ../../lib/libkrb5.so.3.3 /usr/lib/libkrb5.so &amp;&amp;
178ln -v -sf ../../lib/libk5crypto.so.3.1 /usr/lib/libk5crypto.so &amp;&amp;
179ln -v -sf ../../lib/libkrb5support.so.0.1 /usr/lib/libkrb5support.so &amp;&amp;
180
181mv -v /usr/bin/ksu /bin &amp;&amp;
182chmod -v 755 /bin/ksu &amp;&amp;
183
184install -v -dm755 /usr/share/doc/krb5-&mitkrb-version; &amp;&amp;
185cp -vfr ../doc/* /usr/share/doc/krb5-&mitkrb-version;</userinput></screen>
186
187 </sect2>
188
189 <sect2 role="commands">
190 <title>Command Explanations</title>
191
192 <para>
193 <command>sed -e ...</command>: The first <command>sed</command> fixes
194 <application>Python</application> detection. The second one increases
195 the width of the virtual terminal used for some tests to prevent
196 some spurious text in the output which is taken as a failure. The
197 third <command>sed</command> removes a test that is known to fail.
198 </para>
199
200 <para>
201 <parameter>--localstatedir=/var/lib</parameter>: This option is
202 used so that the Kerberos variable run-time data is located in
203 <filename class="directory">/var/lib</filename> instead of
204 <filename class="directory">/usr/var</filename>.
205 </para>
206
207 <para>
208 <parameter>--with-system-et</parameter>: This switch causes the build
209 to use the system-installed versions of the error-table support
210 software.
211 </para>
212
213 <para>
214 <parameter>--with-system-ss</parameter>: This switch causes the build
215 to use the system-installed versions of the subsystem command-line
216 interface software.
217 </para>
218
219 <para>
220 <parameter>--with-system-verto=no</parameter>: This switch fixes a bug in
221 the package: it does not recognize its own verto library installed
222 previously. This is not a problem, if reinstalling the same version,
223 but if you are updating, the old library is used as system's one,
224 instead of installing the new version.
225 </para>
226
227 <para>
228 <parameter>--enable-dns-for-realm</parameter>: This switch allows
229 realms to be resolved using the DNS server.
230 </para>
231
232 <para>
233 <option>--with-ldap</option>: Use this switch if you want to compile the
234 <application>OpenLDAP</application> database backend module.
235 </para>
236
237 <para>
238 <command>mv -v /usr/lib/libk... /lib </command> and
239 <command>ln -v -sf ../../lib/libk... /usr/lib/libk...</command>:
240 Move critical libraries to the
241 <filename class="directory">/lib</filename> directory so that they are
242 available when the <filename class="directory">/usr</filename>
243 filesystem is not mounted.
244 </para>
245
246 <para>
247 <command>find /usr/lib -type f -name "lib$f*.so*" -exec chmod -v 755 {} \;</command>:
248 This command changes the permisison of installed libraries.
249 </para>
250
251 <para>
252 <command>mv -v /usr/bin/ksu /bin</command>: Moves the
253 <command>ksu</command> program to the
254 <filename class="directory">/bin</filename> directory so that it is
255 available when the <filename class="directory">/usr</filename>
256 filesystem is not mounted.
257 </para>
258
259 </sect2>
260
261 <sect2 role="configuration">
262 <title>Configuring MIT Kerberos V5</title>
263
264 <sect3 id="krb5-config">
265 <title>Config Files</title>
266
267 <para>
268 <filename>/etc/krb5.conf</filename> and
269 <filename>/var/lib/krb5kdc/kdc.conf</filename>
270 </para>
271
272 <indexterm zone="mitkrb krb5-config">
273 <primary sortas="e-etc-krb5.conf">/etc/krb5.conf</primary>
274 </indexterm>
275
276 <indexterm zone="mitkrb krb5-config">
277 <primary sortas="e-var-lib-krb5kdc-kdc.conf">/var/lib/krb5kdc/kdc.conf</primary>
278 </indexterm>
279
280 </sect3>
281
282 <sect3>
283 <title>Configuration Information</title>
284
285 <sect4>
286 <title>Kerberos Configuration</title>
287
288 <tip>
289 <para>
290 You should consider installing some sort of password checking
291 dictionary so that you can configure the installation to only
292 accept strong passwords. A suitable dictionary to use is shown in
293 the <xref linkend="cracklib"/> instructions. Note that only one
294 file can be used, but you can concatenate many files into one. The
295 configuration file shown below assumes you have installed a
296 dictionary to <filename>/usr/share/dict/words</filename>.
297 </para>
298 </tip>
299
300 <para>
301 Create the Kerberos configuration file with the following
302 commands issued by the <systemitem class="username">root</systemitem>
303 user:
304 </para>
305
306<screen role="root"><userinput>cat &gt; /etc/krb5.conf &lt;&lt; "EOF"
307<literal># Begin /etc/krb5.conf
308
309[libdefaults]
310 default_realm = <replaceable>&lt;EXAMPLE.ORG&gt;</replaceable>
311 encrypt = true
312
313[realms]
314 <replaceable>&lt;EXAMPLE.ORG&gt;</replaceable> = {
315 kdc = <replaceable>&lt;belgarath.example.org&gt;</replaceable>
316 admin_server = <replaceable>&lt;belgarath.example.org&gt;</replaceable>
317 dict_file = /usr/share/dict/words
318 }
319
320[domain_realm]
321 .<replaceable>&lt;example.org&gt;</replaceable> = <replaceable>&lt;EXAMPLE.ORG&gt;</replaceable>
322
323[logging]
324 kdc = SYSLOG:INFO:AUTH
325 admin_server = SYSLOG:INFO:AUTH
326 default = SYSLOG:DEBUG:DAEMON
327
328# End /etc/krb5.conf</literal>
329EOF</userinput></screen>
330
331 <para>
332 You will need to substitute your domain and proper hostname for the
333 occurrences of the <replaceable>&lt;belgarath&gt;</replaceable> and
334 <replaceable>&lt;example.org&gt;</replaceable> names.
335 </para>
336
337 <para>
338 <option>default_realm</option> should be the name of your
339 domain changed to ALL CAPS. This isn't required, but both
340 <application>Heimdal</application> and MIT recommend it.
341 </para>
342
343 <para>
344 <option>encrypt = true</option> provides encryption of all traffic
345 between kerberized clients and servers. It's not necessary and can
346 be left off. If you leave it off, you can encrypt all traffic from
347 the client to the server using a switch on the client program
348 instead.
349 </para>
350
351 <para>
352 The <option>[realms]</option> parameters tell the client programs
353 where to look for the KDC authentication services.
354 </para>
355
356 <para>
357 The <option>[domain_realm]</option> section maps a domain to a realm.
358 </para>
359
360 <para>
361 Create the KDC database:
362 </para>
363
364<screen role="root"><userinput>kdb5_util create -r <replaceable>&lt;EXAMPLE.ORG&gt;</replaceable> -s</userinput></screen>
365
366 <para>
367 Now you should populate the database with principals
368 (users). For now, just use your regular login name or
369 <systemitem class="username">root</systemitem>.
370 </para>
371
372<screen role="root"><userinput>kadmin.local
373<prompt>kadmin.local:</prompt> add_policy dict-only
374<prompt>kadmin.local:</prompt> addprinc -policy dict-only <replaceable>&lt;loginname&gt;</replaceable></userinput></screen>
375
376 <para>
377 The KDC server and any machine running kerberized
378 server daemons must have a host key installed:
379 </para>
380
381<screen role="root"><userinput><prompt>kadmin.local:</prompt> addprinc -randkey host/<replaceable>&lt;belgarath.example.org&gt;</replaceable></userinput></screen>
382
383 <para>
384 After choosing the defaults when prompted, you will have to
385 export the data to a keytab file:
386 </para>
387
388<screen role="root"><userinput><prompt>kadmin.local:</prompt> ktadd host/<replaceable>&lt;belgarath.example.org&gt;</replaceable></userinput></screen>
389
390 <para>
391 This should have created a file in
392 <filename class="directory">/etc</filename> named
393 <filename>krb5.keytab</filename> (Kerberos 5). This file should
394 have 600 (<systemitem class="username">root</systemitem> rw only)
395 permissions. Keeping the keytab files from public access is crucial
396 to the overall security of the Kerberos installation.
397 </para>
398
399 <para>
400 Exit the <command>kadmin</command> program (use
401 <command>quit</command> or <command>exit</command>) and return
402 back to the shell prompt. Start the KDC daemon manually, just to
403 test out the installation:
404 </para>
405
406<screen role="root"><userinput>/usr/sbin/krb5kdc</userinput></screen>
407
408 <para>
409 Attempt to get a ticket with the following command:
410 </para>
411
412<screen><userinput>kinit <replaceable>&lt;loginname&gt;</replaceable></userinput></screen>
413
414 <para>
415 You will be prompted for the password you created. After you
416 get your ticket, you can list it with the following command:
417 </para>
418
419<screen><userinput>klist</userinput></screen>
420
421 <para>
422 Information about the ticket should be displayed on the
423 screen.
424 </para>
425
426 <para>
427 To test the functionality of the keytab file, issue the
428 following command:
429 </para>
430
431<screen><userinput>ktutil
432<prompt>ktutil:</prompt> rkt /etc/krb5.keytab
433<prompt>ktutil:</prompt> l</userinput></screen>
434
435 <para>
436 This should dump a list of the host principal, along with
437 the encryption methods used to access the principal.
438 </para>
439
440 <para>
441 At this point, if everything has been successful so far, you
442 can feel fairly confident in the installation and configuration of
443 the package.
444 </para>
445
446 </sect4>
447
448 <sect4>
449 <title>Additional Information</title>
450
451 <para>
452 For additional information consult the <ulink
453 url="http://web.mit.edu/kerberos/www/krb5-&mitkrb-major-version;/#documentation">
454 documentation for krb5-&mitkrb-version;</ulink> on which the above
455 instructions are based.
456 </para>
457
458 </sect4>
459
460 </sect3>
461
462 <sect3 id="mitkrb-init">
463 <title><phrase revision="sysv">Init Script</phrase>
464 <phrase revision="systemd">Systemd Unit</phrase></title>
465
466 <para revision="sysv">
467 If you want to start <application>Kerberos</application> services
468 at boot, install the <filename>/etc/rc.d/init.d/krb5</filename> init
469 script included in the <xref linkend="bootscripts"/> package using
470 the following command:
471 </para>
472
473 <para revision="systemd">
474 If you want to start <application>Kerberos</application> services
475 at boot, install the <filename>krb5.service</filename> unit included in
476 the <xref linkend="systemd-units"/> package using the following command:
477 </para>
478
479 <indexterm zone="mitkrb mitkrb-init">
480 <primary sortas="f-krb5">krb5</primary>
481 </indexterm>
482
483<screen role="root"><userinput>make install-krb5</userinput></screen>
484
485 </sect3>
486
487 </sect2>
488
489 <sect2 role="content">
490
491 <title>Contents</title>
492 <para></para>
493
494 <segmentedlist>
495 <segtitle>Installed Programs</segtitle>
496 <segtitle>Installed Libraries</segtitle>
497 <segtitle>Installed Directories</segtitle>
498
499 <seglistitem>
500 <seg>
501 gss-client, gss-server, k5srvutil, kadmin, kadmin.local,
502 kadmind, kdb5_ldap_util (optional), kdb5_util, kdestroy, kinit, klist,
503 kpasswd, kprop, kpropd, kproplog, krb5-config, krb5kdc, krb5-send-pr,
504 ksu, kswitch, ktutil, kvno, sclient, sim_client, sim_server,
505 sserver, uuclient, and uuserver
506 </seg>
507 <seg>
508 libgssapi_krb5.so, libgssrpc.so, libk5crypto.so, libkadm5clnt_mit.so,
509 libkadm5clnt.so, libkadm5srv_mit.so, libkadm5srv.so, libkdb_ldap.so
510 (optional), libkdb5.so, libkrad.so, libkrb5.so, libkrb5support.so,
511 libverto.so, and some plugins under the /usr/lib/krb5 tree
512 </seg>
513 <seg>
514 /usr/include/{gssapi,gssrpc,kadm5,krb5},
515 /usr/lib/krb5,
516 /usr/share/{doc/krb5-&mitkrb-version;,examples/krb5},
517 /var/lib/krb5kdc, and
518 /var/lib/run/krb5kdc
519 </seg>
520 </seglistitem>
521 </segmentedlist>
522
523 <variablelist>
524 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
525 <?dbfo list-presentation="list"?>
526 <?dbhtml list-presentation="table"?>
527
528 <varlistentry id="gss-client">
529 <term><command>gss-client</command></term>
530 <listitem>
531 <para>
532 is a GSSAPI test client.
533 </para>
534 <indexterm zone="mitkrb gss-client">
535 <primary sortas="b-gss-client">gss-client</primary>
536 </indexterm>
537 </listitem>
538 </varlistentry>
539
540 <varlistentry id="gss-server">
541 <term><command>gss-server</command></term>
542 <listitem>
543 <para>
544 is a GSSAPI test server.
545 </para>
546 <indexterm zone="mitkrb gss-server">
547 <primary sortas="b-gss-server">gss-server</primary>
548 </indexterm>
549 </listitem>
550 </varlistentry>
551
552 <varlistentry id="k5srvutil">
553 <term><command>k5srvutil</command></term>
554 <listitem>
555 <para>
556 is a host keytable manipulation utility.
557 </para>
558 <indexterm zone="mitkrb k5srvutil">
559 <primary sortas="b-k5srvutil">k5srvutil</primary>
560 </indexterm>
561 </listitem>
562 </varlistentry>
563
564 <varlistentry id="kadmin">
565 <term><command>kadmin</command></term>
566 <listitem>
567 <para>
568 is an utility used to make modifications
569 to the Kerberos database.
570 </para>
571 <indexterm zone="mitkrb kadmin">
572 <primary sortas="b-kadmin">kadmin</primary>
573 </indexterm>
574 </listitem>
575 </varlistentry>
576
577 <varlistentry id="kadmin.local">
578 <term><command>kadmin.local</command></term>
579 <listitem>
580 <para>
581 is an utility similar to <command>kadmin</command>, but if the
582 database is db2, the local client <command>kadmin.local</command>,
583 is intended to run directly on the master KDC without Kerberos
584 authentication.
585 </para>
586 <indexterm zone="mitkrb kadmin.local">
587 <primary sortas="b-kadmin.local">kadmin.local</primary>
588 </indexterm>
589 </listitem>
590 </varlistentry>
591
592 <varlistentry id="kadmind">
593 <term><command>kadmind</command></term>
594 <listitem>
595 <para>
596 is a server for administrative access
597 to a Kerberos database.
598 </para>
599 <indexterm zone="mitkrb kadmind">
600 <primary sortas="b-kadmind">kadmind</primary>
601 </indexterm>
602 </listitem>
603 </varlistentry>
604
605 <varlistentry id="kdb5_ldap_util">
606 <term><command>kdb5_ldap_util (optional)</command></term>
607 <listitem>
608 <para>
609 allows an administrator to manage realms, Kerberos services
610 and ticket policies.
611 </para>
612 <indexterm zone="mitkrb kdb5_ldap_util">
613 <primary sortas="b-kdb5_ldap_util">kdb5_ldap_util</primary>
614 </indexterm>
615 </listitem>
616 </varlistentry>
617
618 <varlistentry id="kdb5_util">
619 <term><command>kdb5_util</command></term>
620 <listitem>
621 <para>
622 is the KDC database utility.
623 </para>
624 <indexterm zone="mitkrb kdb5_util">
625 <primary sortas="b-kdb5_util">kdb5_util</primary>
626 </indexterm>
627 </listitem>
628 </varlistentry>
629
630 <varlistentry id="kdestroy">
631 <term><command>kdestroy</command></term>
632 <listitem>
633 <para>
634 removes the current set of tickets.
635 </para>
636 <indexterm zone="mitkrb kdestroy">
637 <primary sortas="b-kdestroy">kdestroy</primary>
638 </indexterm>
639 </listitem>
640 </varlistentry>
641
642 <varlistentry id="kinit">
643 <term><command>kinit</command></term>
644 <listitem>
645 <para>
646 is used to authenticate to the Kerberos server as a
647 principal and acquire a ticket granting ticket that can
648 later be used to obtain tickets for other services.
649 </para>
650 <indexterm zone="mitkrb kinit">
651 <primary sortas="b-kinit">kinit</primary>
652 </indexterm>
653 </listitem>
654 </varlistentry>
655
656 <varlistentry id="klist">
657 <term><command>klist</command></term>
658 <listitem>
659 <para>
660 reads and displays the current tickets in
661 the credential cache.
662 </para>
663 <indexterm zone="mitkrb klist">
664 <primary sortas="b-klist">klist</primary>
665 </indexterm>
666 </listitem>
667 </varlistentry>
668
669 <varlistentry id="kpasswd">
670 <term><command>kpasswd</command></term>
671 <listitem>
672 <para>
673 is a program for changing Kerberos 5 passwords.
674 </para>
675 <indexterm zone="mitkrb kpasswd">
676 <primary sortas="b-kpasswd">kpasswd</primary>
677 </indexterm>
678 </listitem>
679 </varlistentry>
680
681 <varlistentry id="kprop">
682 <term><command>kprop</command></term>
683 <listitem>
684 <para>
685 takes a principal database in a specified format and
686 converts it into a stream of database records.
687 </para>
688 <indexterm zone="mitkrb kprop">
689 <primary sortas="b-kprop">kprop</primary>
690 </indexterm>
691 </listitem>
692 </varlistentry>
693
694 <varlistentry id="kpropd">
695 <term><command>kpropd</command></term>
696 <listitem>
697 <para>
698 receives a database sent by <command>kprop</command>
699 and writes it as a local database.
700 </para>
701 <indexterm zone="mitkrb kpropd">
702 <primary sortas="b-kpropd">kpropd</primary>
703 </indexterm>
704 </listitem>
705 </varlistentry>
706
707 <varlistentry id="kproplog">
708 <term><command>kproplog</command></term>
709 <listitem>
710 <para>
711 displays the contents of the KDC database update log to standard
712 output.
713 </para>
714 <indexterm zone="mitkrb kproplog">
715 <primary sortas="b-kproplog">kproplog</primary>
716 </indexterm>
717 </listitem>
718 </varlistentry>
719
720 <varlistentry id="krb5-config-prog2">
721 <term><command>krb5-config</command></term>
722 <listitem>
723 <para>
724 gives information on how to link programs against
725 libraries.
726 </para>
727 <indexterm zone="mitkrb krb5-config-prog2">
728 <primary sortas="b-krb5-config">krb5-config</primary>
729 </indexterm>
730 </listitem>
731 </varlistentry>
732
733 <varlistentry id="krb5kdc">
734 <term><command>krb5kdc</command></term>
735 <listitem>
736 <para>
737 is the <application>Kerberos 5</application> server.
738 </para>
739 <indexterm zone="mitkrb krb5kdc">
740 <primary sortas="b-krb5kdc">krb5kdc</primary>
741 </indexterm>
742 </listitem>
743 </varlistentry>
744
745 <varlistentry id="krb5-send-pr">
746 <term><command>krb5-send-pr</command></term>
747 <listitem>
748 <para>
749 sends a problem report (PR) to a central support site.
750 </para>
751 <indexterm zone="mitkrb krb5-send-pr">
752 <primary sortas="b-krb-send-pr">krb5-send-pr</primary>
753 </indexterm>
754 </listitem>
755 </varlistentry>
756
757 <varlistentry id="ksu">
758 <term><command>ksu</command></term>
759 <listitem>
760 <para>
761 is the super user program using Kerberos protocol.
762 Requires a properly configured
763 <filename>/etc/shells</filename> and
764 <filename>~/.k5login</filename> containing principals
765 authorized to become super users.
766 </para>
767 <indexterm zone="mitkrb ksu">
768 <primary sortas="b-ksu">ksu</primary>
769 </indexterm>
770 </listitem>
771 </varlistentry>
772
773 <varlistentry id="kswitch">
774 <term><command>kswitch</command></term>
775 <listitem>
776 <para>
777 makes the specified credential cache the
778 primary cache for the collection, if a cache
779 collection is available.
780 </para>
781 <indexterm zone="mitkrb kswitch">
782 <primary sortas="b-kswitch">kswitch</primary>
783 </indexterm>
784 </listitem>
785 </varlistentry>
786
787 <varlistentry id="ktutil">
788 <term><command>ktutil</command></term>
789 <listitem>
790 <para>
791 is a program for managing Kerberos keytabs.
792 </para>
793 <indexterm zone="mitkrb ktutil">
794 <primary sortas="b-ktutil">ktutil</primary>
795 </indexterm>
796 </listitem>
797 </varlistentry>
798
799 <varlistentry id="kvno">
800 <term><command>kvno</command></term>
801 <listitem>
802 <para>
803 prints keyversion numbers of Kerberos principals.
804 </para>
805 <indexterm zone="mitkrb kvno">
806 <primary sortas="b-kvno">kvno</primary>
807 </indexterm>
808 </listitem>
809 </varlistentry>
810
811 <varlistentry id="sclient">
812 <term><command>sclient</command></term>
813 <listitem>
814 <para>
815 is used to contact a sample server and authenticate to it
816 using Kerberos 5 tickets, then display the server's
817 response.
818 </para>
819 <indexterm zone="mitkrb sclient">
820 <primary sortas="b-sclient">sclient</primary>
821 </indexterm>
822 </listitem>
823 </varlistentry>
824
825 <varlistentry id="sim_client">
826 <term><command>sim_client</command></term>
827 <listitem>
828 <para>
829 is a simple UDP-based sample client program, for
830 demonstration.
831 </para>
832 <indexterm zone="mitkrb sim_client">
833 <primary sortas="b-sim_client">sim_client</primary>
834 </indexterm>
835 </listitem>
836 </varlistentry>
837
838 <varlistentry id="sim_server">
839 <term><command>sim_server</command></term>
840 <listitem>
841 <para>
842 is a simple UDP-based server application, for
843 demonstration.
844 </para>
845 <indexterm zone="mitkrb sim_server">
846 <primary sortas="b-sim_server">sim_server</primary>
847 </indexterm>
848 </listitem>
849 </varlistentry>
850
851 <varlistentry id="sserver">
852 <term><command>sserver</command></term>
853 <listitem>
854 <para>
855 is the sample Kerberos 5 server.
856 </para>
857 <indexterm zone="mitkrb sserver">
858 <primary sortas="b-sserver">sserver</primary>
859 </indexterm>
860 </listitem>
861 </varlistentry>
862
863 <varlistentry id="uuclient">
864 <term><command>uuclient</command></term>
865 <listitem>
866 <para>
867 is another sample client.
868 </para>
869 <indexterm zone="mitkrb uuclient">
870 <primary sortas="b-uuclient">uuclient</primary>
871 </indexterm>
872 </listitem>
873 </varlistentry>
874
875 <varlistentry id="uuserver">
876 <term><command>uuserver</command></term>
877 <listitem>
878 <para>
879 is another sample server.
880 </para>
881 <indexterm zone="mitkrb uuserver">
882 <primary sortas="b-uuserver">uuserver</primary>
883 </indexterm>
884 </listitem>
885 </varlistentry>
886
887
888 <varlistentry id="libgssapi_krb5">
889 <term><filename class="libraryfile">libgssapi_krb5.so</filename></term>
890 <listitem>
891 <para>
892 contains the Generic Security Service Application Programming
893 Interface (GSSAPI) functions which provides security services
894 to callers in a generic fashion, supportable with a range of
895 underlying mechanisms and technologies and hence allowing
896 source-level portability of applications to different
897 environments.
898 </para>
899 <indexterm zone="mitkrb libgssapi_krb5">
900 <primary sortas="c-libgssapi_krb5">libgssapi_krb5.so</primary>
901 </indexterm>
902 </listitem>
903 </varlistentry>
904
905 <varlistentry id="libkadm5clnt">
906 <term><filename class="libraryfile">libkadm5clnt.so</filename></term>
907 <listitem>
908 <para>
909 contains the administrative authentication and password checking
910 functions required by Kerberos 5 client-side programs.
911 </para>
912 <indexterm zone="mitkrb libkadm5clnt">
913 <primary sortas="c-libkadm5clnt">libkadm5clnt.so</primary>
914 </indexterm>
915 </listitem>
916 </varlistentry>
917
918 <varlistentry id="libkadm5srv">
919 <term><filename class="libraryfile">libkadm5srv.so</filename></term>
920 <listitem>
921 <para>
922 contains the administrative authentication and password
923 checking functions required by Kerberos 5 servers.
924 </para>
925 <indexterm zone="mitkrb libkadm5srv">
926 <primary sortas="c-libkadm5srv">libkadm5srv.so</primary>
927 </indexterm>
928 </listitem>
929 </varlistentry>
930
931 <varlistentry id="libkdb5">
932 <term><filename class="libraryfile">libkdb5.so</filename></term>
933 <listitem>
934 <para>
935 is a Kerberos 5 authentication/authorization database
936 access library.
937 </para>
938 <indexterm zone="mitkrb libkdb5">
939 <primary sortas="c-libkdb5">libkdb5.so</primary>
940 </indexterm>
941 </listitem>
942 </varlistentry>
943
944 <varlistentry id="libkrad">
945 <term><filename class="libraryfile">libkrad.so</filename></term>
946 <listitem>
947 <para>
948 contains the internal support library for RADIUS functionality.
949 </para>
950 <indexterm zone="mitkrb libkrad">
951 <primary sortas="c-libkrad">libkrad.so</primary>
952 </indexterm>
953 </listitem>
954 </varlistentry>
955
956 <varlistentry id="libkrb5">
957 <term><filename class="libraryfile">libkrb5.so</filename></term>
958 <listitem>
959 <para>
960 is an all-purpose <application>Kerberos 5</application> library.
961 </para>
962 <indexterm zone="mitkrb libkrb5">
963 <primary sortas="c-libkrb5">libkrb5.so</primary>
964 </indexterm>
965 </listitem>
966 </varlistentry>
967
968 </variablelist>
969
970 </sect2>
971
972</sect1>
Note: See TracBrowser for help on using the repository browser.