source: postlfs/security/mitkrb.xml@ bf7a21dd

10.0 10.1 11.0 7.10 7.5 7.6 7.6-blfs 7.6-systemd 7.7 7.8 7.9 8.0 8.1 8.2 8.3 8.4 9.0 9.1 basic bdubbs/svn elogind gnome kde5-13430 kde5-14269 kde5-14686 ken/refactor-virt krejzi/svn lazarus nosym perl-modules qt5new systemd-11177 systemd-13485 trunk xry111/git-date xry111/git-date-for-trunk xry111/git-date-test
Last change on this file since bf7a21dd was bf7a21dd, checked in by Pierre Labastie <pieere@…>, 8 years ago

Update to MIT Kerberos 1.12.1. Fixes #4565.

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@12684 af4574ff-66df-0310-9fd7-8a98e5e911e0

  • Property mode set to 100644
File size: 27.5 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY mitkrb-download-http "http://web.mit.edu/kerberos/www/dist/krb5/&mitkrb-major-version;/krb5-&mitkrb-version;-signed.tar">
8 <!ENTITY mitkrb-download-ftp " ">
9 <!ENTITY mitkrb-md5sum "524b1067b619cb5bf780759b6884c3f5">
10 <!ENTITY mitkrb-size "11.4 MB">
11 <!ENTITY mitkrb-buildsize "165 MB (Additional 25 MB if running the testsuite)">
12 <!ENTITY mitkrb-time "0.9 SBU (additional 3.5 SBU if running the testsuite)">
13]>
14
15<sect1 id="mitkrb" xreflabel="MIT Kerberos V5-&mitkrb-version;">
16 <?dbhtml filename="mitkrb.html"?>
17
18 <sect1info>
19 <othername>$LastChangedBy$</othername>
20 <date>$Date$</date>
21 </sect1info>
22
23 <title>MIT Kerberos V5-&mitkrb-version;</title>
24
25 <indexterm zone="mitkrb">
26 <primary sortas="a-MIT-Kerberos">MIT Kerberos V5</primary>
27 </indexterm>
28
29 <sect2 role="package">
30 <title>Introduction to MIT Kerberos V5</title>
31
32 <para>
33 <application>MIT Kerberos V5</application> is a free implementation
34 of Kerberos 5. Kerberos is a network authentication protocol. It
35 centralizes the authentication database and uses kerberized
36 applications to work with servers or services that support Kerberos
37 allowing single logins and encrypted communication over internal
38 networks or the Internet.
39 </para>
40
41 &lfs74_checked;
42
43 <bridgehead renderas="sect3">Package Information</bridgehead>
44 <itemizedlist spacing="compact">
45 <listitem>
46 <para>
47 Download (HTTP): <ulink url="&mitkrb-download-http;"/>
48 </para>
49 </listitem>
50 <listitem>
51 <para>
52 Download (FTP): <ulink url="&mitkrb-download-ftp;"/>
53 </para>
54 </listitem>
55 <listitem>
56 <para>
57 Download MD5 sum: &mitkrb-md5sum;
58 </para>
59 </listitem>
60 <listitem>
61 <para>
62 Download size: &mitkrb-size;
63 </para>
64 </listitem>
65 <listitem>
66 <para>
67 Estimated disk space required: &mitkrb-buildsize;
68 </para>
69 </listitem>
70 <listitem>
71 <para>
72 Estimated build time: &mitkrb-time;
73 </para>
74 </listitem>
75 </itemizedlist>
76
77 <bridgehead renderas="sect3">MIT Kerberos V5 Dependencies</bridgehead>
78
79 <bridgehead renderas="sect4">Optional</bridgehead>
80 <para role="optional">
81 <xref linkend="dejagnu"/> (for full test coverage),
82 <xref linkend="gnupg2"/> (to authenticate the package),
83 <xref linkend="keyutils"/>,
84 <xref linkend="openldap"/>,
85 <xref linkend="python2"/> (used during the testsuite) and
86 <xref linkend="rpcbind"/> (used during the testsuite)
87 </para>
88
89 <note>
90 <para>
91 Some sort of time synchronization facility on your system (like
92 <xref linkend="ntp"/>) is required since Kerberos won't authenticate
93 if there is a time difference between a kerberized client and the
94 KDC server.
95 </para>
96 </note>
97
98 <para condition="html" role="usernotes">User Notes:
99 <ulink url="&blfs-wiki;/mitkrb"/>
100 </para>
101 </sect2>
102
103 <sect2 role="installation">
104 <title>Installation of MIT Kerberos V5</title>
105
106 <para>
107 <application>MIT Kerberos V5</application> is distributed in a
108 TAR file containing a compressed TAR package and a detached PGP
109 <filename class="extension">ASC</filename> file. You'll need to unpack
110 the distribution tar file, then unpack the compressed tar file before
111 starting the build.
112 </para>
113
114 <para>
115 After unpacking the distribution tarball and if you have
116 <xref linkend="gnupg2"/> installed, you can
117 authenticate the package. First, check the contents of the file
118 <filename>krb5-&mitkrb-version;.tar.gz.asc</filename>.
119 </para>
120
121<screen><userinput>gpg --verify krb5-&mitkrb-version;.tar.gz.asc krb5-&mitkrb-version;.tar.gz</userinput></screen>
122
123 <para>You will probably see output similar to:</para>
124
125<screen>gpg: Signature made Wed Aug 8 22:29:58 2012 GMT using RSA key ID F376813D
126gpg: Can't check signature: public key not found</screen>
127
128 <para>
129 You can import the public key with:
130 </para>
131
132<screen><userinput>gpg --keyserver pgp.mit.edu --recv-keys 0xF376813D</userinput></screen>
133
134 <para>
135 Now re-verify the package with the first command above. You should get a
136 indication of a good signature, but the key will still not be certified
137 with a trusted signature. Trusting the downloaded key is a separate
138 operation but it is up to you to determine the level of trust.
139 </para>
140
141 <para>
142 Build <application>MIT Kerberos V5</application> by running the
143 following commands:
144 </para>
145
146<screen><userinput>cd src &amp;&amp;
147sed -e "s@python2.5/Python.h@&amp; python2.7/Python.h@g" \
148 -e "s@-lpython2.5]@&amp;,\n AC_CHECK_LIB(python2.7,main,[PYTHON_LIB=-lpython2.7])@g" \
149 -i configure.in &amp;&amp;
150sed -e "s@interp->result@Tcl_GetStringResult(interp)@g" \
151 -i kadmin/testing/util/tcl_kadm5.c &amp;&amp;
152sed -e 's@\^u}@^u cols 300}@' \
153 -i tests/dejagnu/config/default.exp &amp;&amp;
154sed -e '/run\.test/d' \
155 -i plugins/kdb/db2/libdb2/test/Makefile.in &amp;&amp;
156autoconf &amp;&amp;
157./configure --prefix=/usr \
158 --sysconfdir=/etc \
159 --localstatedir=/var/lib \
160 --with-system-et \
161 --with-system-ss \
162 --enable-dns-for-realm &amp;&amp;
163make</userinput></screen>
164
165 <para>
166 To test the build, issue: <command>make check</command>. You need at
167 least <xref linkend="tcl"/>, which is used to drive the testsuite.
168 Furthermore, <xref linkend="dejagnu"/> must be available for some
169 of the tests to run. If you have a former version of MIT Kerberos V5
170 installed, it may happen that the test suite pick up the installed
171 versions of the libraries, rather than the newly built ones. If so,
172 it is better to run the tests after the installation.
173 </para>
174
175 <para>
176 Now, as the <systemitem class="username">root</systemitem> user:
177 </para>
178
179<screen role="root"><userinput>make install &amp;&amp;
180
181for LIBRARY in gssapi_krb5 gssrpc k5crypto kadm5clnt kadm5srv \
182 kdb5 kdb_ldap krad krb5 krb5support verto ; do
183 [ -e /usr/lib/lib$LIBRARY.so ] &amp;&amp; chmod -v 755 /usr/lib/lib$LIBRARY.so
184done &amp;&amp;
185
186mv -v /usr/lib/libkrb5.so.3* /lib &amp;&amp;
187mv -v /usr/lib/libk5crypto.so.3* /lib &amp;&amp;
188mv -v /usr/lib/libkrb5support.so.0* /lib &amp;&amp;
189
190ln -v -sf ../../lib/libkrb5.so.3.3 /usr/lib/libkrb5.so &amp;&amp;
191ln -v -sf ../../lib/libk5crypto.so.3.1 /usr/lib/libk5crypto.so &amp;&amp;
192ln -v -sf ../../lib/libkrb5support.so.0.1 /usr/lib/libkrb5support.so &amp;&amp;
193
194mv -v /usr/bin/ksu /bin &amp;&amp;
195chmod -v 755 /bin/ksu &amp;&amp;
196
197install -v -dm755 /usr/share/doc/krb5-&mitkrb-version; &amp;&amp;
198cp -vfr ../doc/* /usr/share/doc/krb5-&mitkrb-version; &amp;&amp;
199
200unset LIBRARY</userinput></screen>
201
202
203 </sect2>
204
205 <sect2 role="commands">
206 <title>Command Explanations</title>
207
208 <para>
209 <command>sed -e ...</command>: The first <command>sed</command> fixes
210 <application>Python</application> detection. The second one fixes
211 building with <application>Tcl</application> 8.6. The third one increases
212 the width of the virtual terminal used for some tests, to prevent
213 some spurious characters to be echoed, which is taken as a failure. The
214 last one disables one test, which may hang under certain circumstances.
215 </para>
216
217 <para>
218 <parameter>--localstatedir=/var/lib</parameter>: This parameter is
219 used so that the Kerberos variable run-time data is located in
220 <filename class="directory">/var/lib</filename> instead of
221 <filename class="directory">/usr/var</filename>.
222 </para>
223
224 <para>
225 <parameter>--with-system-et</parameter>: This switch causes the build
226 to use the system-installed versions of the error-table support
227 software.
228 </para>
229
230 <para>
231 <parameter>--with-system-ss</parameter>: This switch causes the build
232 to use the system-installed versions of the subsystem command-line
233 interface software.
234 </para>
235
236 <para>
237 <parameter>--enable-dns-for-realm</parameter>: This switch allows
238 realms to be resolved using the DNS server.
239 </para>
240
241 <para>
242 <command>mv -v /usr/bin/ksu /bin</command>: Moves the
243 <command>ksu</command> program to the
244 <filename class="directory">/bin</filename> directory so that it is
245 available when the <filename class="directory">/usr</filename>
246 filesystem is not mounted.
247 </para>
248
249 <para>
250 <option>--with-ldap</option>: Use this switch if you want to compile
251 <application>OpenLDAP</application> database backend module.
252 </para>
253
254 </sect2>
255
256 <sect2 role="configuration">
257 <title>Configuring MIT Kerberos V5</title>
258
259 <sect3 id="krb5-config">
260 <title>Config Files</title>
261
262 <para>
263 <filename>/etc/krb5.conf</filename> and
264 <filename>/var/lib/krb5kdc/kdc.conf</filename>
265 </para>
266
267 <indexterm zone="mitkrb krb5-config">
268 <primary sortas="e-etc-krb5.conf">/etc/krb5.conf</primary>
269 </indexterm>
270
271 <indexterm zone="mitkrb krb5-config">
272 <primary sortas="e-var-lib-krb5kdc-kdc.conf">/var/lib/krb5kdc/kdc.conf</primary>
273 </indexterm>
274
275 </sect3>
276
277 <sect3>
278 <title>Configuration Information</title>
279
280 <sect4>
281 <title>Kerberos Configuration</title>
282
283 <tip>
284 <para>
285 You should consider installing some sort of password checking
286 dictionary so that you can configure the installation to only
287 accept strong passwords. A suitable dictionary to use is shown in
288 the <xref linkend="cracklib"/> instructions. Note that only one
289 file can be used, but you can concatenate many files into one. The
290 configuration file shown below assumes you have installed a
291 dictionary to <filename>/usr/share/dict/words</filename>.
292 </para>
293 </tip>
294
295 <para>
296 Create the Kerberos configuration file with the following
297 commands issued by the <systemitem class="username">root</systemitem>
298 user:
299 </para>
300
301<screen role="root"><userinput>cat &gt; /etc/krb5.conf &lt;&lt; "EOF"
302<literal># Begin /etc/krb5.conf
303
304[libdefaults]
305 default_realm = <replaceable>&lt;LFS.ORG&gt;</replaceable>
306 encrypt = true
307
308[realms]
309 <replaceable>&lt;LFS.ORG&gt;</replaceable> = {
310 kdc = <replaceable>&lt;belgarath.lfs.org&gt;</replaceable>
311 admin_server = <replaceable>&lt;belgarath.lfs.org&gt;</replaceable>
312 dict_file = /usr/share/dict/words
313 }
314
315[domain_realm]
316 .<replaceable>&lt;lfs.org&gt;</replaceable> = <replaceable>&lt;LFS.ORG&gt;</replaceable>
317
318[logging]
319 kdc = SYSLOG[:INFO[:AUTH]]
320 admin_server = SYSLOG[INFO[:AUTH]]
321 default = SYSLOG[[:SYS]]
322
323# End /etc/krb5.conf</literal>
324EOF</userinput></screen>
325
326 <para>
327 You will need to substitute your domain and proper hostname for the
328 occurrences of the <replaceable>&lt;belgarath&gt;</replaceable> and
329 <replaceable>&lt;lfs.org&gt;</replaceable> names.
330 </para>
331
332 <para>
333 <option>default_realm</option> should be the name of your
334 domain changed to ALL CAPS. This isn't required, but both
335 <application>Heimdal</application> and MIT recommend it.
336 </para>
337
338 <para>
339 <option>encrypt = true</option> provides encryption of all traffic
340 between kerberized clients and servers. It's not necessary and can
341 be left off. If you leave it off, you can encrypt all traffic from
342 the client to the server using a switch on the client program
343 instead.
344 </para>
345
346 <para>
347 The <option>[realms]</option> parameters tell the client programs
348 where to look for the KDC authentication services.
349 </para>
350
351 <para>
352 The <option>[domain_realm]</option> section maps a domain to a realm.
353 </para>
354
355 <para>
356 Create the KDC database:
357 </para>
358
359<screen role="root"><userinput>kdb5_util create -r <replaceable>&lt;LFS.ORG&gt;</replaceable> -s</userinput></screen>
360
361 <para>
362 Now you should populate the database with principals
363 (users). For now, just use your regular login name or
364 <systemitem class="username">root</systemitem>.
365 </para>
366
367<screen role="root"><userinput>kadmin.local
368<prompt>kadmin.local:</prompt> add_policy dict-only
369<prompt>kadmin.local:</prompt> addprinc -policy dict-only <replaceable>&lt;loginname&gt;</replaceable></userinput></screen>
370
371 <para>
372 The KDC server and any machine running kerberized
373 server daemons must have a host key installed:
374 </para>
375
376<screen role="root"><userinput><prompt>kadmin.local:</prompt> addprinc -randkey host/<replaceable>&lt;belgarath.lfs.org&gt;</replaceable></userinput></screen>
377
378 <para>
379 After choosing the defaults when prompted, you will have to
380 export the data to a keytab file:
381 </para>
382
383<screen role="root"><userinput><prompt>kadmin.local:</prompt> ktadd host/<replaceable>&lt;belgarath.lfs.org&gt;</replaceable></userinput></screen>
384
385 <para>
386 This should have created a file in
387 <filename class="directory">/etc</filename> named
388 <filename>krb5.keytab</filename> (Kerberos 5). This file should
389 have 600 (<systemitem class="username">root</systemitem> rw only)
390 permissions. Keeping the keytab files from public access is crucial
391 to the overall security of the Kerberos installation.
392 </para>
393
394 <para>
395 Exit the <command>kadmin</command> program (use
396 <command>quit</command> or <command>exit</command>) and return
397 back to the shell prompt. Start the KDC daemon manually, just to
398 test out the installation:
399 </para>
400
401<screen role="root"><userinput>/usr/sbin/krb5kdc</userinput></screen>
402
403 <para>
404 Attempt to get a ticket with the following command:
405 </para>
406
407<screen><userinput>kinit <replaceable>&lt;loginname&gt;</replaceable></userinput></screen>
408
409 <para>
410 You will be prompted for the password you created. After you
411 get your ticket, you can list it with the following command:
412 </para>
413
414<screen><userinput>klist</userinput></screen>
415
416 <para>
417 Information about the ticket should be displayed on the
418 screen.
419 </para>
420
421 <para>
422 To test the functionality of the keytab file, issue the
423 following command:
424 </para>
425
426<screen><userinput>ktutil
427<prompt>ktutil:</prompt> rkt /etc/krb5.keytab
428<prompt>ktutil:</prompt> l</userinput></screen>
429
430 <para>
431 This should dump a list of the host principal, along with
432 the encryption methods used to access the principal.
433 </para>
434
435 <para>
436 At this point, if everything has been successful so far, you
437 can feel fairly confident in the installation and configuration of
438 the package.
439 </para>
440
441 </sect4>
442
443 <sect4>
444 <title>Additional Information</title>
445
446 <para>
447 For additional information consult the <ulink
448 url="http://web.mit.edu/kerberos/www/krb5-&mitkrb-major-version;/#documentation">
449 documentation for krb5-&mitkrb-version;</ulink> on which the above
450 instructions are based.
451 </para>
452
453 </sect4>
454
455 </sect3>
456
457 <sect3 id="mitkrb-init">
458 <title>Init Script</title>
459
460 <para>
461 If you want to start <application>Kerberos</application> services
462 at boot, install the <filename>/etc/rc.d/init.d/krb5</filename> init
463 script included in the <xref linkend="bootscripts"/> package using
464 the following command:
465 </para>
466
467 <indexterm zone="mitkrb mitkrb-init">
468 <primary sortas="f-krb5">krb5</primary>
469 </indexterm>
470
471<screen role="root"><userinput>make install-krb5</userinput></screen>
472
473 </sect3>
474
475 </sect2>
476
477 <sect2 role="content">
478
479 <title>Contents</title>
480 <para></para>
481
482 <segmentedlist>
483 <segtitle>Installed Programs</segtitle>
484 <segtitle>Installed Libraries</segtitle>
485 <segtitle>Installed Directories</segtitle>
486
487 <seglistitem>
488 <seg>
489 gss-client, gss-server, k5srvutil, kadmin, kadmin.local,
490 kadmind, kdb5_ldap_util (optional), kdb5_util, kdestroy, kinit, klist,
491 kpasswd, kprop, kpropd, kproplog, krb5-config, krb5kdc, krb5-send-pr,
492 ksu, kswitch, ktutil, kvno, sclient, sim_client, sim_server,
493 sserver, uuclient and uuserver
494 </seg>
495 <seg>
496 libgssapi_krb5.so, libgssrpc.so, libk5crypto.so,
497 libkadm5clnt.so, libkadm5srv.so, libkdb5.so, libkdb_ldap.so
498 (optional), libkrad.so, libkrb5.so, libkrb5support.so, and
499 libverto.so
500 </seg>
501 <seg>
502 /usr/include/gssapi,
503 /usr/include/gssrpc,
504 /usr/include/kadm5,
505 /usr/include/krb5,
506 /usr/lib/krb5,
507 /usr/share/doc/krb5-&mitkrb-version;,
508 /usr/share/examples/krb5 and
509 /var/lib/krb5kdc
510 </seg>
511 </seglistitem>
512 </segmentedlist>
513
514 <variablelist>
515 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
516 <?dbfo list-presentation="list"?>
517 <?dbhtml list-presentation="table"?>
518
519 <varlistentry id="k5srvutil">
520 <term><command>k5srvutil</command></term>
521 <listitem>
522 <para>
523 is a host keytable manipulation utility.
524 </para>
525 <indexterm zone="mitkrb k5srvutil">
526 <primary sortas="b-k5srvutil">k5srvutil</primary>
527 </indexterm>
528 </listitem>
529 </varlistentry>
530
531 <varlistentry id="kadmin">
532 <term><command>kadmin</command></term>
533 <listitem>
534 <para>
535 is an utility used to make modifications
536 to the Kerberos database.
537 </para>
538 <indexterm zone="mitkrb kadmin">
539 <primary sortas="b-kadmin">kadmin</primary>
540 </indexterm>
541 </listitem>
542 </varlistentry>
543
544 <varlistentry id="kadmind">
545 <term><command>kadmind</command></term>
546 <listitem>
547 <para>
548 is a server for administrative access
549 to a Kerberos database.
550 </para>
551 <indexterm zone="mitkrb kadmind">
552 <primary sortas="b-kadmind">kadmind</primary>
553 </indexterm>
554 </listitem>
555 </varlistentry>
556
557 <varlistentry id="kdb5_util">
558 <term><command>kdb5_util</command></term>
559 <listitem>
560 <para>
561 is the KDC database utility.
562 </para>
563 <indexterm zone="mitkrb kdb5_util">
564 <primary sortas="b-kdb5_util">kdb5_util</primary>
565 </indexterm>
566 </listitem>
567 </varlistentry>
568
569 <varlistentry id="kdestroy">
570 <term><command>kdestroy</command></term>
571 <listitem>
572 <para>
573 removes the current set of tickets.
574 </para>
575 <indexterm zone="mitkrb kdestroy">
576 <primary sortas="b-kdestroy">kdestroy</primary>
577 </indexterm>
578 </listitem>
579 </varlistentry>
580
581 <varlistentry id="kinit">
582 <term><command>kinit</command></term>
583 <listitem>
584 <para>
585 is used to authenticate to the Kerberos server as a
586 principal and acquire a ticket granting ticket that can
587 later be used to obtain tickets for other services.
588 </para>
589 <indexterm zone="mitkrb kinit">
590 <primary sortas="b-kinit">kinit</primary>
591 </indexterm>
592 </listitem>
593 </varlistentry>
594
595 <varlistentry id="klist">
596 <term><command>klist</command></term>
597 <listitem>
598 <para>
599 reads and displays the current tickets in
600 the credential cache.
601 </para>
602 <indexterm zone="mitkrb klist">
603 <primary sortas="b-klist">klist</primary>
604 </indexterm>
605 </listitem>
606 </varlistentry>
607
608 <varlistentry id="kpasswd">
609 <term><command>kpasswd</command></term>
610 <listitem>
611 <para>
612 is a program for changing Kerberos 5 passwords.
613 </para>
614 <indexterm zone="mitkrb kpasswd">
615 <primary sortas="b-kpasswd">kpasswd</primary>
616 </indexterm>
617 </listitem>
618 </varlistentry>
619
620 <varlistentry id="kprop">
621 <term><command>kprop</command></term>
622 <listitem>
623 <para>
624 takes a principal database in a specified format and
625 converts it into a stream of database records.
626 </para>
627 <indexterm zone="mitkrb kprop">
628 <primary sortas="b-kprop">kprop</primary>
629 </indexterm>
630 </listitem>
631 </varlistentry>
632
633 <varlistentry id="kpropd">
634 <term><command>kpropd</command></term>
635 <listitem>
636 <para>
637 receives a database sent by <command>kprop</command>
638 and writes it as a local database.
639 </para>
640 <indexterm zone="mitkrb kpropd">
641 <primary sortas="b-kpropd">kpropd</primary>
642 </indexterm>
643 </listitem>
644 </varlistentry>
645
646 <varlistentry id="krb5-config-prog2">
647 <term><command>krb5-config</command></term>
648 <listitem>
649 <para>
650 gives information on how to link programs against
651 libraries.
652 </para>
653 <indexterm zone="mitkrb krb5-config-prog2">
654 <primary sortas="b-krb5-config">krb5-config</primary>
655 </indexterm>
656 </listitem>
657 </varlistentry>
658
659 <varlistentry id="krb5kdc">
660 <term><command>krb5kdc</command></term>
661 <listitem>
662 <para>
663 is the <application>Kerberos 5</application> server.
664 </para>
665 <indexterm zone="mitkrb krb5kdc">
666 <primary sortas="b-krb5kdc">krb5kdc</primary>
667 </indexterm>
668 </listitem>
669 </varlistentry>
670
671 <varlistentry id="ksu">
672 <term><command>ksu</command></term>
673 <listitem>
674 <para>
675 is the super user program using Kerberos protocol.
676 Requires a properly configured
677 <filename>/etc/shells</filename> and
678 <filename>~/.k5login</filename> containing principals
679 authorized to become super users.
680 </para>
681 <indexterm zone="mitkrb ksu">
682 <primary sortas="b-ksu">ksu</primary>
683 </indexterm>
684 </listitem>
685 </varlistentry>
686
687 <varlistentry id="kswitch">
688 <term><command>kswitch</command></term>
689 <listitem>
690 <para>
691 makes the specified credential cache the
692 primary cache for the collection, if a cache
693 collection is available.
694 </para>
695 <indexterm zone="mitkrb kswitch">
696 <primary sortas="b-kswitch">kswitch</primary>
697 </indexterm>
698 </listitem>
699 </varlistentry>
700
701 <varlistentry id="ktutil">
702 <term><command>ktutil</command></term>
703 <listitem>
704 <para>
705 is a program for managing Kerberos keytabs.
706 </para>
707 <indexterm zone="mitkrb ktutil">
708 <primary sortas="b-ktutil">ktutil</primary>
709 </indexterm>
710 </listitem>
711 </varlistentry>
712
713 <varlistentry id="kvno">
714 <term><command>kvno</command></term>
715 <listitem>
716 <para>
717 prints keyversion numbers of Kerberos principals.
718 </para>
719 <indexterm zone="mitkrb kvno">
720 <primary sortas="b-kvno">kvno</primary>
721 </indexterm>
722 </listitem>
723 </varlistentry>
724
725 <varlistentry id="sclient">
726 <term><command>sclient</command></term>
727 <listitem>
728 <para>
729 used to contact a sample server and authenticate to it
730 using Kerberos 5 tickets, then display the server's
731 response.
732 </para>
733 <indexterm zone="mitkrb sclient">
734 <primary sortas="b-sclient">sclient</primary>
735 </indexterm>
736 </listitem>
737 </varlistentry>
738
739 <varlistentry id="sserver">
740 <term><command>sserver</command></term>
741 <listitem>
742 <para>
743 is the sample Kerberos 5 server.
744 </para>
745 <indexterm zone="mitkrb sserver">
746 <primary sortas="b-sserver">sserver</primary>
747 </indexterm>
748 </listitem>
749 </varlistentry>
750
751 <varlistentry id="libgssapi_krb5">
752 <term><filename class="libraryfile">libgssapi_krb5.so</filename></term>
753 <listitem>
754 <para>
755 contain the Generic Security Service Application Programming
756 Interface (GSSAPI) functions which provides security services
757 to callers in a generic fashion, supportable with a range of
758 underlying mechanisms and technologies and hence allowing
759 source-level portability of applications to different
760 environments.
761 </para>
762 <indexterm zone="mitkrb libgssapi_krb5">
763 <primary sortas="c-libgssapi_krb5">libgssapi_krb5.so</primary>
764 </indexterm>
765 </listitem>
766 </varlistentry>
767
768 <varlistentry id="libkadm5clnt">
769 <term><filename class="libraryfile">libkadm5clnt.so</filename></term>
770 <listitem>
771 <para>
772 contains the administrative authentication and password checking
773 functions required by Kerberos 5 client-side programs.
774 </para>
775 <indexterm zone="mitkrb libkadm5clnt">
776 <primary sortas="c-libkadm5clnt">libkadm5clnt.so</primary>
777 </indexterm>
778 </listitem>
779 </varlistentry>
780
781 <varlistentry id="libkadm5srv">
782 <term><filename class="libraryfile">libkadm5srv.so</filename></term>
783 <listitem>
784 <para>
785 contain the administrative authentication and password
786 checking functions required by Kerberos 5 servers.
787 </para>
788 <indexterm zone="mitkrb libkadm5srv">
789 <primary sortas="c-libkadm5srv">libkadm5srv.so</primary>
790 </indexterm>
791 </listitem>
792 </varlistentry>
793
794 <varlistentry id="libkdb5">
795 <term><filename class="libraryfile">libkdb5.so</filename></term>
796 <listitem>
797 <para>
798 is a Kerberos 5 authentication/authorization database
799 access library.
800 </para>
801 <indexterm zone="mitkrb libkdb5">
802 <primary sortas="c-libkdb5">libkdb5.so</primary>
803 </indexterm>
804 </listitem>
805 </varlistentry>
806
807 <varlistentry id="libkrad">
808 <term><filename class="libraryfile">libkrad.so</filename></term>
809 <listitem>
810 <para>
811 contains the internal support library for RADIUS functionality.
812 </para>
813 <indexterm zone="mitkrb libkrad">
814 <primary sortas="c-libkrad">libkrad.so</primary>
815 </indexterm>
816 </listitem>
817 </varlistentry>
818
819 <varlistentry id="libkrb5">
820 <term><filename class="libraryfile">libkrb5.so</filename></term>
821 <listitem>
822 <para>
823 is an all-purpose <application>Kerberos 5</application> library.
824 </para>
825 <indexterm zone="mitkrb libkrb5">
826 <primary sortas="c-libkrb5">libkrb5.so</primary>
827 </indexterm>
828 </listitem>
829 </varlistentry>
830
831 </variablelist>
832
833 </sect2>
834
835</sect1>
Note: See TracBrowser for help on using the repository browser.