source: postlfs/security/mitkrb.xml@ bd097df

10.0 10.1 11.0 11.1 11.2 8.1 8.2 8.3 8.4 9.0 9.1 basic bdubbs/svn elogind lazarus perl-modules plabs/python-mods qt5new trunk upgradedb xry111/intltool xry111/soup3 xry111/test-20220226
Last change on this file since bd097df was bd097df, checked in by DJ Lucas <dj@…>, 5 years ago

tag krb5

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@19131 af4574ff-66df-0310-9fd7-8a98e5e911e0

  • Property mode set to 100644
File size: 32.0 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY mitkrb-download-http "https://web.mit.edu/kerberos/dist/krb5/&mitkrb-major-version;/krb5-&mitkrb-version;.tar.gz">
8 <!ENTITY mitkrb-download-ftp " ">
9 <!ENTITY mitkrb-md5sum "8022f3a1cde8463e44fd35ef42731f85">
10 <!ENTITY mitkrb-size "9.0 MB">
11 <!ENTITY mitkrb-buildsize "136 MB (additional 24 MB for the testsuite)">
12 <!ENTITY mitkrb-time "0.9 SBU (additional 4.0 SBU for the testsuite)">
13]>
14
15<sect1 id="mitkrb" xreflabel="MIT Kerberos V5-&mitkrb-version;">
16 <?dbhtml filename="mitkrb.html"?>
17
18 <sect1info>
19 <othername>$LastChangedBy$</othername>
20 <date>$Date$</date>
21 </sect1info>
22
23 <title>MIT Kerberos V5-&mitkrb-version;</title>
24
25 <indexterm zone="mitkrb">
26 <primary sortas="a-MIT-Kerberos">MIT Kerberos V5</primary>
27 </indexterm>
28
29 <sect2 role="package">
30 <title>Introduction to MIT Kerberos V5</title>
31
32 <para>
33 <application>MIT Kerberos V5</application> is a free implementation
34 of Kerberos 5. Kerberos is a network authentication protocol. It
35 centralizes the authentication database and uses kerberized
36 applications to work with servers or services that support Kerberos
37 allowing single logins and encrypted communication over internal
38 networks or the Internet.
39 </para>
40
41 &lfs81_checked;
42
43 <bridgehead renderas="sect3">Package Information</bridgehead>
44 <itemizedlist spacing="compact">
45 <listitem>
46 <para>
47 Download (HTTP): <ulink url="&mitkrb-download-http;"/>
48 </para>
49 </listitem>
50 <listitem>
51 <para>
52 Download (FTP): <ulink url="&mitkrb-download-ftp;"/>
53 </para>
54 </listitem>
55 <listitem>
56 <para>
57 Download MD5 sum: &mitkrb-md5sum;
58 </para>
59 </listitem>
60 <listitem>
61 <para>
62 Download size: &mitkrb-size;
63 </para>
64 </listitem>
65 <listitem>
66 <para>
67 Estimated disk space required: &mitkrb-buildsize;
68 </para>
69 </listitem>
70 <listitem>
71 <para>
72 Estimated build time: &mitkrb-time;
73 </para>
74 </listitem>
75 </itemizedlist>
76
77<!-- Patch is not needed for this version, but don't remove this.
78 <bridgehead renderas="sect3">Additional Downloads</bridgehead>
79 <itemizedlist spacing="compact">
80 <listitem>
81 <para>
82 Patch required on systems with IPv4 only enabled:
83 <ulink url="&patch-root;/mitkrb-&mitkrb-version;-fix_ipv4_only-1.patch"/>
84 </para>
85 </listitem>
86 </itemizedlist>
87-->
88
89 <bridgehead renderas="sect3">MIT Kerberos V5 Dependencies</bridgehead>
90
91 <bridgehead renderas="sect4">Optional</bridgehead>
92 <para role="optional">
93 <xref linkend="dejagnu"/> (for full test coverage),
94 <xref linkend="gnupg2"/> (to authenticate the package),
95 <xref linkend="keyutils"/>,
96 <xref linkend="openldap"/>,
97 <xref linkend="python2"/> (used during the testsuite),
98 <xref linkend="rpcbind"/> (used during the testsuite), and
99 <xref linkend="valgrind"/> (used during the test suite)
100 </para>
101
102 <note>
103 <para>
104 Some sort of time synchronization facility on your system (like
105 <xref linkend="ntp"/>) is required since Kerberos won't authenticate
106 if there is a time difference between a kerberized client and the
107 KDC server.
108 </para>
109 </note>
110
111 <para condition="html" role="usernotes">User Notes:
112 <ulink url="&blfs-wiki;/mitkrb"/>
113 </para>
114 </sect2>
115
116 <sect2 role="installation">
117 <title>Installation of MIT Kerberos V5</title>
118
119<!-- PATCH IS REJECTED - ALREADY PATCHED
120 <para>
121 If your system is configured to support only IPv4, apply the following
122 patch:
123 </para>
124
125<screen><userinput>patch -p1 -i ../mitkrb-&mitkrb-version;-fix_ipv4_only-1.patch</userinput></screen>
126-->
127
128 <para>
129 Build <application>MIT Kerberos V5</application> by running the
130 following commands:
131 </para>
132
133<screen><userinput>cd src &amp;&amp;
134
135sed -e "s@python2.5/Python.h@&amp; python2.7/Python.h@g" \
136 -e "s@-lpython2.5]@&amp;,\n AC_CHECK_LIB(python2.7,main,[PYTHON_LIB=-lpython2.7])@g" \
137 -i configure.in &amp;&amp;
138
139sed -e 's@\^u}@^u cols 300}@' \
140 -i tests/dejagnu/config/default.exp &amp;&amp;
141
142sed -e '/eq 0/{N;s/12 //}' \
143 -i plugins/kdb/db2/libdb2/test/run.test &amp;&amp;
144
145autoconf &amp;&amp;
146./configure --prefix=/usr \
147 --sysconfdir=/etc \
148 --localstatedir=/var/lib \
149 --with-system-et \
150 --with-system-ss \
151 --with-system-verto=no \
152 --enable-dns-for-realm &amp;&amp;
153make</userinput></screen>
154
155 <para>
156 To test the build, issue as the <systemitem
157 class="username">root</systemitem> user: <command>make check</command>.
158 You need at least <xref linkend="tcl"/>, which is used to drive the
159 testsuite. Furthermore, <xref linkend="dejagnu"/> must be available for
160 some of the tests to run. If you have a former version of MIT Kerberos V5
161 installed, it may happen that the test suite pick up the installed
162 versions of the libraries, rather than the newly built ones. If so, it is
163 better to run the tests after the installation.
164 </para>
165
166 <para>
167 Now, as the <systemitem class="username">root</systemitem> user:
168 </para>
169
170<screen role="root"><userinput>make install &amp;&amp;
171
172for f in gssapi_krb5 gssrpc k5crypto kadm5clnt kadm5srv \
173 kdb5 kdb_ldap krad krb5 krb5support verto ; do
174
175 find /usr/lib -type f -name "lib$f*.so*" -exec chmod -v 755 {} \;
176done &amp;&amp;
177
178mv -v /usr/lib/libkrb5.so.3* /lib &amp;&amp;
179mv -v /usr/lib/libk5crypto.so.3* /lib &amp;&amp;
180mv -v /usr/lib/libkrb5support.so.0* /lib &amp;&amp;
181
182ln -v -sf ../../lib/libkrb5.so.3.3 /usr/lib/libkrb5.so &amp;&amp;
183ln -v -sf ../../lib/libk5crypto.so.3.1 /usr/lib/libk5crypto.so &amp;&amp;
184ln -v -sf ../../lib/libkrb5support.so.0.1 /usr/lib/libkrb5support.so &amp;&amp;
185
186mv -v /usr/bin/ksu /bin &amp;&amp;
187chmod -v 755 /bin/ksu &amp;&amp;
188
189install -v -dm755 /usr/share/doc/krb5-&mitkrb-version; &amp;&amp;
190cp -vfr ../doc/* /usr/share/doc/krb5-&mitkrb-version;</userinput></screen>
191
192 </sect2>
193
194 <sect2 role="commands">
195 <title>Command Explanations</title>
196
197 <para>
198 <command>sed -e ...</command>: The first <command>sed</command> fixes
199 <application>Python</application> detection. The second one increases
200 the width of the virtual terminal used for some tests to prevent
201 some spurious text in the output which is taken as a failure. The
202 third <command>sed</command> removes a test that is known to fail.
203 </para>
204
205 <para>
206 <parameter>--localstatedir=/var/lib</parameter>: This option is
207 used so that the Kerberos variable run-time data is located in
208 <filename class="directory">/var/lib</filename> instead of
209 <filename class="directory">/usr/var</filename>.
210 </para>
211
212 <para>
213 <parameter>--with-system-et</parameter>: This switch causes the build
214 to use the system-installed versions of the error-table support
215 software.
216 </para>
217
218 <para>
219 <parameter>--with-system-ss</parameter>: This switch causes the build
220 to use the system-installed versions of the subsystem command-line
221 interface software.
222 </para>
223
224 <para>
225 <parameter>--with-system-verto=no</parameter>: This switch fixes a bug in
226 the package: it does not recognize its own verto library installed
227 previously. This is not a problem, if reinstalling the same version,
228 but if you are updating, the old library is used as system's one,
229 instead of installing the new version.
230 </para>
231
232 <para>
233 <parameter>--enable-dns-for-realm</parameter>: This switch allows
234 realms to be resolved using the DNS server.
235 </para>
236
237 <para>
238 <option>--with-ldap</option>: Use this switch if you want to compile the
239 <application>OpenLDAP</application> database backend module.
240 </para>
241
242 <para>
243 <command>mv -v /usr/lib/libk... /lib </command> and
244 <command>ln -v -sf ../../lib/libk... /usr/lib/libk...</command>:
245 Move critical libraries to the
246 <filename class="directory">/lib</filename> directory so that they are
247 available when the <filename class="directory">/usr</filename>
248 filesystem is not mounted.
249 </para>
250
251 <para>
252 <command>find /usr/lib -type f -name "lib$f*.so*" -exec chmod -v 755 {} \;</command>:
253 This command changes the permisison of installed libraries.
254 </para>
255
256 <para>
257 <command>mv -v /usr/bin/ksu /bin</command>: Moves the
258 <command>ksu</command> program to the
259 <filename class="directory">/bin</filename> directory so that it is
260 available when the <filename class="directory">/usr</filename>
261 filesystem is not mounted.
262 </para>
263
264 </sect2>
265
266 <sect2 role="configuration">
267 <title>Configuring MIT Kerberos V5</title>
268
269 <sect3 id="krb5-config">
270 <title>Config Files</title>
271
272 <para>
273 <filename>/etc/krb5.conf</filename> and
274 <filename>/var/lib/krb5kdc/kdc.conf</filename>
275 </para>
276
277 <indexterm zone="mitkrb krb5-config">
278 <primary sortas="e-etc-krb5.conf">/etc/krb5.conf</primary>
279 </indexterm>
280
281 <indexterm zone="mitkrb krb5-config">
282 <primary sortas="e-var-lib-krb5kdc-kdc.conf">/var/lib/krb5kdc/kdc.conf</primary>
283 </indexterm>
284
285 </sect3>
286
287 <sect3>
288 <title>Configuration Information</title>
289
290 <sect4>
291 <title>Kerberos Configuration</title>
292
293 <tip>
294 <para>
295 You should consider installing some sort of password checking
296 dictionary so that you can configure the installation to only
297 accept strong passwords. A suitable dictionary to use is shown in
298 the <xref linkend="cracklib"/> instructions. Note that only one
299 file can be used, but you can concatenate many files into one. The
300 configuration file shown below assumes you have installed a
301 dictionary to <filename>/usr/share/dict/words</filename>.
302 </para>
303 </tip>
304
305 <para>
306 Create the Kerberos configuration file with the following
307 commands issued by the <systemitem class="username">root</systemitem>
308 user:
309 </para>
310
311<screen role="root"><userinput>cat &gt; /etc/krb5.conf &lt;&lt; "EOF"
312<literal># Begin /etc/krb5.conf
313
314[libdefaults]
315 default_realm = <replaceable>&lt;EXAMPLE.ORG&gt;</replaceable>
316 encrypt = true
317
318[realms]
319 <replaceable>&lt;EXAMPLE.ORG&gt;</replaceable> = {
320 kdc = <replaceable>&lt;belgarath.example.org&gt;</replaceable>
321 admin_server = <replaceable>&lt;belgarath.example.org&gt;</replaceable>
322 dict_file = /usr/share/dict/words
323 }
324
325[domain_realm]
326 .<replaceable>&lt;example.org&gt;</replaceable> = <replaceable>&lt;EXAMPLE.ORG&gt;</replaceable>
327
328[logging]
329 kdc = SYSLOG:INFO:AUTH
330 admin_server = SYSLOG:INFO:AUTH
331 default = SYSLOG:DEBUG:DAEMON
332
333# End /etc/krb5.conf</literal>
334EOF</userinput></screen>
335
336 <para>
337 You will need to substitute your domain and proper hostname for the
338 occurrences of the <replaceable>&lt;belgarath&gt;</replaceable> and
339 <replaceable>&lt;example.org&gt;</replaceable> names.
340 </para>
341
342 <para>
343 <option>default_realm</option> should be the name of your
344 domain changed to ALL CAPS. This isn't required, but both
345 <application>Heimdal</application> and MIT recommend it.
346 </para>
347
348 <para>
349 <option>encrypt = true</option> provides encryption of all traffic
350 between kerberized clients and servers. It's not necessary and can
351 be left off. If you leave it off, you can encrypt all traffic from
352 the client to the server using a switch on the client program
353 instead.
354 </para>
355
356 <para>
357 The <option>[realms]</option> parameters tell the client programs
358 where to look for the KDC authentication services.
359 </para>
360
361 <para>
362 The <option>[domain_realm]</option> section maps a domain to a realm.
363 </para>
364
365 <para>
366 Create the KDC database:
367 </para>
368
369<screen role="root"><userinput>kdb5_util create -r <replaceable>&lt;EXAMPLE.ORG&gt;</replaceable> -s</userinput></screen>
370
371 <para>
372 Now you should populate the database with principals
373 (users). For now, just use your regular login name or
374 <systemitem class="username">root</systemitem>.
375 </para>
376
377<screen role="root"><userinput>kadmin.local
378<prompt>kadmin.local:</prompt> add_policy dict-only
379<prompt>kadmin.local:</prompt> addprinc -policy dict-only <replaceable>&lt;loginname&gt;</replaceable></userinput></screen>
380
381 <para>
382 The KDC server and any machine running kerberized
383 server daemons must have a host key installed:
384 </para>
385
386<screen role="root"><userinput><prompt>kadmin.local:</prompt> addprinc -randkey host/<replaceable>&lt;belgarath.example.org&gt;</replaceable></userinput></screen>
387
388 <para>
389 After choosing the defaults when prompted, you will have to
390 export the data to a keytab file:
391 </para>
392
393<screen role="root"><userinput><prompt>kadmin.local:</prompt> ktadd host/<replaceable>&lt;belgarath.example.org&gt;</replaceable></userinput></screen>
394
395 <para>
396 This should have created a file in
397 <filename class="directory">/etc</filename> named
398 <filename>krb5.keytab</filename> (Kerberos 5). This file should
399 have 600 (<systemitem class="username">root</systemitem> rw only)
400 permissions. Keeping the keytab files from public access is crucial
401 to the overall security of the Kerberos installation.
402 </para>
403
404 <para>
405 Exit the <command>kadmin</command> program (use
406 <command>quit</command> or <command>exit</command>) and return
407 back to the shell prompt. Start the KDC daemon manually, just to
408 test out the installation:
409 </para>
410
411<screen role="root"><userinput>/usr/sbin/krb5kdc</userinput></screen>
412
413 <para>
414 Attempt to get a ticket with the following command:
415 </para>
416
417<screen><userinput>kinit <replaceable>&lt;loginname&gt;</replaceable></userinput></screen>
418
419 <para>
420 You will be prompted for the password you created. After you
421 get your ticket, you can list it with the following command:
422 </para>
423
424<screen><userinput>klist</userinput></screen>
425
426 <para>
427 Information about the ticket should be displayed on the
428 screen.
429 </para>
430
431 <para>
432 To test the functionality of the keytab file, issue the
433 following command:
434 </para>
435
436<screen><userinput>ktutil
437<prompt>ktutil:</prompt> rkt /etc/krb5.keytab
438<prompt>ktutil:</prompt> l</userinput></screen>
439
440 <para>
441 This should dump a list of the host principal, along with
442 the encryption methods used to access the principal.
443 </para>
444
445 <para>
446 At this point, if everything has been successful so far, you
447 can feel fairly confident in the installation and configuration of
448 the package.
449 </para>
450
451 </sect4>
452
453 <sect4>
454 <title>Additional Information</title>
455
456 <para>
457 For additional information consult the <ulink
458 url="http://web.mit.edu/kerberos/www/krb5-&mitkrb-major-version;/#documentation">
459 documentation for krb5-&mitkrb-version;</ulink> on which the above
460 instructions are based.
461 </para>
462
463 </sect4>
464
465 </sect3>
466
467 <sect3 id="mitkrb-init">
468 <title><phrase revision="sysv">Init Script</phrase>
469 <phrase revision="systemd">Systemd Unit</phrase></title>
470
471 <para revision="sysv">
472 If you want to start <application>Kerberos</application> services
473 at boot, install the <filename>/etc/rc.d/init.d/krb5</filename> init
474 script included in the <xref linkend="bootscripts"/> package using
475 the following command:
476 </para>
477
478 <para revision="systemd">
479 If you want to start <application>Kerberos</application> services
480 at boot, install the <filename>krb5.service</filename> unit included in
481 the <xref linkend="systemd-units"/> package using the following command:
482 </para>
483
484 <indexterm zone="mitkrb mitkrb-init">
485 <primary sortas="f-krb5">krb5</primary>
486 </indexterm>
487
488<screen role="root"><userinput>make install-krb5</userinput></screen>
489
490 </sect3>
491
492 </sect2>
493
494 <sect2 role="content">
495
496 <title>Contents</title>
497 <para></para>
498
499 <segmentedlist>
500 <segtitle>Installed Programs</segtitle>
501 <segtitle>Installed Libraries</segtitle>
502 <segtitle>Installed Directories</segtitle>
503
504 <seglistitem>
505 <seg>
506 gss-client, gss-server, k5srvutil, kadmin, kadmin.local,
507 kadmind, kdb5_ldap_util (optional), kdb5_util, kdestroy, kinit, klist,
508 kpasswd, kprop, kpropd, kproplog, krb5-config, krb5kdc, krb5-send-pr,
509 ksu, kswitch, ktutil, kvno, sclient, sim_client, sim_server,
510 sserver, uuclient and uuserver
511 </seg>
512 <seg>
513 libgssapi_krb5.so, libgssrpc.so, libk5crypto.so, libkadm5clnt_mit.so,
514 libkadm5clnt.so, libkadm5srv_mit.so, libkadm5srv.so, libkdb_ldap.so
515 (optional), libkdb5.so, libkrad.so, libkrb5.so, libkrb5support.so,
516 libverto.so, and some plugins under the /usr/lib/krb5 tree
517 </seg>
518 <seg>
519 /usr/include/{gssapi,gssrpc,kadm5,krb5},
520 /usr/lib/krb5,
521 /usr/share/{doc/krb5-&mitkrb-version;,examples/krb5},
522 /var/lib/krb5kdc, and
523 /var/lib/run/krb5kdc
524 </seg>
525 </seglistitem>
526 </segmentedlist>
527
528 <variablelist>
529 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
530 <?dbfo list-presentation="list"?>
531 <?dbhtml list-presentation="table"?>
532
533 <varlistentry id="gss-client">
534 <term><command>gss-client</command></term>
535 <listitem>
536 <para>
537 is a GSSAPI test client.
538 </para>
539 <indexterm zone="mitkrb gss-client">
540 <primary sortas="b-gss-client">gss-client</primary>
541 </indexterm>
542 </listitem>
543 </varlistentry>
544
545 <varlistentry id="gss-server">
546 <term><command>gss-server</command></term>
547 <listitem>
548 <para>
549 is a GSSAPI test server.
550 </para>
551 <indexterm zone="mitkrb gss-server">
552 <primary sortas="b-gss-server">gss-server</primary>
553 </indexterm>
554 </listitem>
555 </varlistentry>
556
557 <varlistentry id="k5srvutil">
558 <term><command>k5srvutil</command></term>
559 <listitem>
560 <para>
561 is a host keytable manipulation utility.
562 </para>
563 <indexterm zone="mitkrb k5srvutil">
564 <primary sortas="b-k5srvutil">k5srvutil</primary>
565 </indexterm>
566 </listitem>
567 </varlistentry>
568
569 <varlistentry id="kadmin">
570 <term><command>kadmin</command></term>
571 <listitem>
572 <para>
573 is an utility used to make modifications
574 to the Kerberos database.
575 </para>
576 <indexterm zone="mitkrb kadmin">
577 <primary sortas="b-kadmin">kadmin</primary>
578 </indexterm>
579 </listitem>
580 </varlistentry>
581
582 <varlistentry id="kadmin.local">
583 <term><command>kadmin.local</command></term>
584 <listitem>
585 <para>
586 is an utility similar to <command>kadmin</command>, but if the
587 database is db2, the local client <command>kadmin.local</command>,
588 is intended to run directly on the master KDC without Kerberos
589 authentication.
590 </para>
591 <indexterm zone="mitkrb kadmin.local">
592 <primary sortas="b-kadmin.local">kadmin.local</primary>
593 </indexterm>
594 </listitem>
595 </varlistentry>
596
597 <varlistentry id="kadmind">
598 <term><command>kadmind</command></term>
599 <listitem>
600 <para>
601 is a server for administrative access
602 to a Kerberos database.
603 </para>
604 <indexterm zone="mitkrb kadmind">
605 <primary sortas="b-kadmind">kadmind</primary>
606 </indexterm>
607 </listitem>
608 </varlistentry>
609
610 <varlistentry id="kdb5_ldap_util">
611 <term><command>kdb5_ldap_util (optional)</command></term>
612 <listitem>
613 <para>
614 allows an administrator to manage realms, Kerberos services
615 and ticket policies.
616 </para>
617 <indexterm zone="mitkrb kdb5_ldap_util">
618 <primary sortas="b-kdb5_ldap_util">kdb5_ldap_util</primary>
619 </indexterm>
620 </listitem>
621 </varlistentry>
622
623 <varlistentry id="kdb5_util">
624 <term><command>kdb5_util</command></term>
625 <listitem>
626 <para>
627 is the KDC database utility.
628 </para>
629 <indexterm zone="mitkrb kdb5_util">
630 <primary sortas="b-kdb5_util">kdb5_util</primary>
631 </indexterm>
632 </listitem>
633 </varlistentry>
634
635 <varlistentry id="kdestroy">
636 <term><command>kdestroy</command></term>
637 <listitem>
638 <para>
639 removes the current set of tickets.
640 </para>
641 <indexterm zone="mitkrb kdestroy">
642 <primary sortas="b-kdestroy">kdestroy</primary>
643 </indexterm>
644 </listitem>
645 </varlistentry>
646
647 <varlistentry id="kinit">
648 <term><command>kinit</command></term>
649 <listitem>
650 <para>
651 is used to authenticate to the Kerberos server as a
652 principal and acquire a ticket granting ticket that can
653 later be used to obtain tickets for other services.
654 </para>
655 <indexterm zone="mitkrb kinit">
656 <primary sortas="b-kinit">kinit</primary>
657 </indexterm>
658 </listitem>
659 </varlistentry>
660
661 <varlistentry id="klist">
662 <term><command>klist</command></term>
663 <listitem>
664 <para>
665 reads and displays the current tickets in
666 the credential cache.
667 </para>
668 <indexterm zone="mitkrb klist">
669 <primary sortas="b-klist">klist</primary>
670 </indexterm>
671 </listitem>
672 </varlistentry>
673
674 <varlistentry id="kpasswd">
675 <term><command>kpasswd</command></term>
676 <listitem>
677 <para>
678 is a program for changing Kerberos 5 passwords.
679 </para>
680 <indexterm zone="mitkrb kpasswd">
681 <primary sortas="b-kpasswd">kpasswd</primary>
682 </indexterm>
683 </listitem>
684 </varlistentry>
685
686 <varlistentry id="kprop">
687 <term><command>kprop</command></term>
688 <listitem>
689 <para>
690 takes a principal database in a specified format and
691 converts it into a stream of database records.
692 </para>
693 <indexterm zone="mitkrb kprop">
694 <primary sortas="b-kprop">kprop</primary>
695 </indexterm>
696 </listitem>
697 </varlistentry>
698
699 <varlistentry id="kpropd">
700 <term><command>kpropd</command></term>
701 <listitem>
702 <para>
703 receives a database sent by <command>kprop</command>
704 and writes it as a local database.
705 </para>
706 <indexterm zone="mitkrb kpropd">
707 <primary sortas="b-kpropd">kpropd</primary>
708 </indexterm>
709 </listitem>
710 </varlistentry>
711
712 <varlistentry id="kproplog">
713 <term><command>kproplog</command></term>
714 <listitem>
715 <para>
716 displays the contents of the KDC database update log to standard
717 output.
718 </para>
719 <indexterm zone="mitkrb kproplog">
720 <primary sortas="b-kproplog">kproplog</primary>
721 </indexterm>
722 </listitem>
723 </varlistentry>
724
725 <varlistentry id="krb5-config-prog2">
726 <term><command>krb5-config</command></term>
727 <listitem>
728 <para>
729 gives information on how to link programs against
730 libraries.
731 </para>
732 <indexterm zone="mitkrb krb5-config-prog2">
733 <primary sortas="b-krb5-config">krb5-config</primary>
734 </indexterm>
735 </listitem>
736 </varlistentry>
737
738 <varlistentry id="krb5kdc">
739 <term><command>krb5kdc</command></term>
740 <listitem>
741 <para>
742 is the <application>Kerberos 5</application> server.
743 </para>
744 <indexterm zone="mitkrb krb5kdc">
745 <primary sortas="b-krb5kdc">krb5kdc</primary>
746 </indexterm>
747 </listitem>
748 </varlistentry>
749
750 <varlistentry id="krb5-send-pr">
751 <term><command>krb5-send-pr</command></term>
752 <listitem>
753 <para>
754 sends a problem report (PR) to a central support site.
755 </para>
756 <indexterm zone="mitkrb krb5-send-pr">
757 <primary sortas="b-krb-send-pr">krb5-send-pr</primary>
758 </indexterm>
759 </listitem>
760 </varlistentry>
761
762 <varlistentry id="ksu">
763 <term><command>ksu</command></term>
764 <listitem>
765 <para>
766 is the super user program using Kerberos protocol.
767 Requires a properly configured
768 <filename>/etc/shells</filename> and
769 <filename>~/.k5login</filename> containing principals
770 authorized to become super users.
771 </para>
772 <indexterm zone="mitkrb ksu">
773 <primary sortas="b-ksu">ksu</primary>
774 </indexterm>
775 </listitem>
776 </varlistentry>
777
778 <varlistentry id="kswitch">
779 <term><command>kswitch</command></term>
780 <listitem>
781 <para>
782 makes the specified credential cache the
783 primary cache for the collection, if a cache
784 collection is available.
785 </para>
786 <indexterm zone="mitkrb kswitch">
787 <primary sortas="b-kswitch">kswitch</primary>
788 </indexterm>
789 </listitem>
790 </varlistentry>
791
792 <varlistentry id="ktutil">
793 <term><command>ktutil</command></term>
794 <listitem>
795 <para>
796 is a program for managing Kerberos keytabs.
797 </para>
798 <indexterm zone="mitkrb ktutil">
799 <primary sortas="b-ktutil">ktutil</primary>
800 </indexterm>
801 </listitem>
802 </varlistentry>
803
804 <varlistentry id="kvno">
805 <term><command>kvno</command></term>
806 <listitem>
807 <para>
808 prints keyversion numbers of Kerberos principals.
809 </para>
810 <indexterm zone="mitkrb kvno">
811 <primary sortas="b-kvno">kvno</primary>
812 </indexterm>
813 </listitem>
814 </varlistentry>
815
816 <varlistentry id="sclient">
817 <term><command>sclient</command></term>
818 <listitem>
819 <para>
820 is used to contact a sample server and authenticate to it
821 using Kerberos 5 tickets, then display the server's
822 response.
823 </para>
824 <indexterm zone="mitkrb sclient">
825 <primary sortas="b-sclient">sclient</primary>
826 </indexterm>
827 </listitem>
828 </varlistentry>
829
830 <varlistentry id="sim_client">
831 <term><command>sim_client</command></term>
832 <listitem>
833 <para>
834 is a simple UDP-based sample client program, for
835 demonstration.
836 </para>
837 <indexterm zone="mitkrb sim_client">
838 <primary sortas="b-sim_client">sim_client</primary>
839 </indexterm>
840 </listitem>
841 </varlistentry>
842
843 <varlistentry id="sim_server">
844 <term><command>sim_server</command></term>
845 <listitem>
846 <para>
847 is a simple UDP-based server application, for
848 demonstration.
849 </para>
850 <indexterm zone="mitkrb sim_server">
851 <primary sortas="b-sim_server">sim_server</primary>
852 </indexterm>
853 </listitem>
854 </varlistentry>
855
856 <varlistentry id="sserver">
857 <term><command>sserver</command></term>
858 <listitem>
859 <para>
860 is the sample Kerberos 5 server.
861 </para>
862 <indexterm zone="mitkrb sserver">
863 <primary sortas="b-sserver">sserver</primary>
864 </indexterm>
865 </listitem>
866 </varlistentry>
867
868 <varlistentry id="uuclient">
869 <term><command>uuclient</command></term>
870 <listitem>
871 <para>
872 is another sample client.
873 </para>
874 <indexterm zone="mitkrb uuclient">
875 <primary sortas="b-uuclient">uuclient</primary>
876 </indexterm>
877 </listitem>
878 </varlistentry>
879
880 <varlistentry id="uuserver">
881 <term><command>uuserver</command></term>
882 <listitem>
883 <para>
884 is another sample server.
885 </para>
886 <indexterm zone="mitkrb uuserver">
887 <primary sortas="b-uuserver">uuserver</primary>
888 </indexterm>
889 </listitem>
890 </varlistentry>
891
892
893 <varlistentry id="libgssapi_krb5">
894 <term><filename class="libraryfile">libgssapi_krb5.so</filename></term>
895 <listitem>
896 <para>
897 contains the Generic Security Service Application Programming
898 Interface (GSSAPI) functions which provides security services
899 to callers in a generic fashion, supportable with a range of
900 underlying mechanisms and technologies and hence allowing
901 source-level portability of applications to different
902 environments.
903 </para>
904 <indexterm zone="mitkrb libgssapi_krb5">
905 <primary sortas="c-libgssapi_krb5">libgssapi_krb5.so</primary>
906 </indexterm>
907 </listitem>
908 </varlistentry>
909
910 <varlistentry id="libkadm5clnt">
911 <term><filename class="libraryfile">libkadm5clnt.so</filename></term>
912 <listitem>
913 <para>
914 contains the administrative authentication and password checking
915 functions required by Kerberos 5 client-side programs.
916 </para>
917 <indexterm zone="mitkrb libkadm5clnt">
918 <primary sortas="c-libkadm5clnt">libkadm5clnt.so</primary>
919 </indexterm>
920 </listitem>
921 </varlistentry>
922
923 <varlistentry id="libkadm5srv">
924 <term><filename class="libraryfile">libkadm5srv.so</filename></term>
925 <listitem>
926 <para>
927 contains the administrative authentication and password
928 checking functions required by Kerberos 5 servers.
929 </para>
930 <indexterm zone="mitkrb libkadm5srv">
931 <primary sortas="c-libkadm5srv">libkadm5srv.so</primary>
932 </indexterm>
933 </listitem>
934 </varlistentry>
935
936 <varlistentry id="libkdb5">
937 <term><filename class="libraryfile">libkdb5.so</filename></term>
938 <listitem>
939 <para>
940 is a Kerberos 5 authentication/authorization database
941 access library.
942 </para>
943 <indexterm zone="mitkrb libkdb5">
944 <primary sortas="c-libkdb5">libkdb5.so</primary>
945 </indexterm>
946 </listitem>
947 </varlistentry>
948
949 <varlistentry id="libkrad">
950 <term><filename class="libraryfile">libkrad.so</filename></term>
951 <listitem>
952 <para>
953 contains the internal support library for RADIUS functionality.
954 </para>
955 <indexterm zone="mitkrb libkrad">
956 <primary sortas="c-libkrad">libkrad.so</primary>
957 </indexterm>
958 </listitem>
959 </varlistentry>
960
961 <varlistentry id="libkrb5">
962 <term><filename class="libraryfile">libkrb5.so</filename></term>
963 <listitem>
964 <para>
965 is an all-purpose <application>Kerberos 5</application> library.
966 </para>
967 <indexterm zone="mitkrb libkrb5">
968 <primary sortas="c-libkrb5">libkrb5.so</primary>
969 </indexterm>
970 </listitem>
971 </varlistentry>
972
973 </variablelist>
974
975 </sect2>
976
977</sect1>
Note: See TracBrowser for help on using the repository browser.