source: postlfs/security/mitkrb.xml@ c1e7218

10.0 10.1 11.0 11.1 11.2 11.3 12.0 12.1 kea ken/TL2024 ken/inkscape-core-mods ken/tuningfonts lazarus lxqt plabs/newcss plabs/python-mods python3.11 qt5new rahul/power-profiles-daemon renodr/vulkan-addition trunk upgradedb xry111/intltool xry111/llvm18 xry111/soup3 xry111/test-20220226 xry111/xf86-video-removal
Last change on this file since c1e7218 was f8359b8, checked in by Douglas R. Reno <renodr@…>, 4 years ago

Add instructions to the krb5 instructions to allow kadmin to start correctly
Update to dhcpcd-9.0.1
Update to glib-networking-2.64.2
Update to libsecret-0.20.3
Update to audacious/audacious-plugins 4.0.2

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@23004 af4574ff-66df-0310-9fd7-8a98e5e911e0
  • Property mode set to 100644
File size: 31.4 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY mitkrb-download-http "https://kerberos.org/dist/krb5/&mitkrb-major-version;/krb5-&mitkrb-version;.tar.gz">
8 <!ENTITY mitkrb-download-ftp " ">
9 <!ENTITY mitkrb-md5sum "c682654484e1a492bd8c7e403132b020">
10 <!ENTITY mitkrb-size "8.3 MB">
11 <!ENTITY mitkrb-buildsize "143 MB (add 24 MB for tests)">
12 <!ENTITY mitkrb-time "0.9 SBU (add 4.2 SBU for tests)">
13]>
14
15<sect1 id="mitkrb" xreflabel="MIT Kerberos V5-&mitkrb-version;">
16 <?dbhtml filename="mitkrb.html"?>
17
18 <sect1info>
19 <othername>$LastChangedBy$</othername>
20 <date>$Date$</date>
21 </sect1info>
22
23 <title>MIT Kerberos V5-&mitkrb-version;</title>
24
25 <indexterm zone="mitkrb">
26 <primary sortas="a-MIT-Kerberos">MIT Kerberos V5</primary>
27 </indexterm>
28
29 <sect2 role="package">
30 <title>Introduction to MIT Kerberos V5</title>
31
32 <para>
33 <application>MIT Kerberos V5</application> is a free implementation
34 of Kerberos 5. Kerberos is a network authentication protocol. It
35 centralizes the authentication database and uses kerberized
36 applications to work with servers or services that support Kerberos
37 allowing single logins and encrypted communication over internal
38 networks or the Internet.
39 </para>
40
41 &lfs91_checked;
42
43 <bridgehead renderas="sect3">Package Information</bridgehead>
44 <itemizedlist spacing="compact">
45 <listitem>
46 <para>
47 Download (HTTP): <ulink url="&mitkrb-download-http;"/>
48 </para>
49 </listitem>
50 <listitem>
51 <para>
52 Download (FTP): <ulink url="&mitkrb-download-ftp;"/>
53 </para>
54 </listitem>
55 <listitem>
56 <para>
57 Download MD5 sum: &mitkrb-md5sum;
58 </para>
59 </listitem>
60 <listitem>
61 <para>
62 Download size: &mitkrb-size;
63 </para>
64 </listitem>
65 <listitem>
66 <para>
67 Estimated disk space required: &mitkrb-buildsize;
68 </para>
69 </listitem>
70 <listitem>
71 <para>
72 Estimated build time: &mitkrb-time;
73 </para>
74 </listitem>
75 </itemizedlist>
76
77 <bridgehead renderas="sect3">MIT Kerberos V5 Dependencies</bridgehead>
78
79 <bridgehead renderas="sect4">Optional</bridgehead>
80 <para role="optional">
81 <xref linkend="dejagnu"/> (for full test coverage),
82 <xref linkend="gnupg2"/> (to authenticate the package),
83 <xref linkend="keyutils"/>,
84 <xref linkend="openldap"/>,
85 <xref linkend="rpcbind"/> (used during the testsuite),
86 <xref linkend="valgrind"/> (used during the testsuite),
87 <ulink url="https://www.cs.utah.edu/~bigler/code/libedit.html">libedit</ulink>,
88 <ulink url="https://cmocka.org/">cmocka</ulink>,
89 <ulink url="https://pypi.org/project/pyrad/">pyrad</ulink>, and
90 <ulink url="https://cwrap.org/resolv_wrapper.html">resolv_wrapper</ulink>
91 </para>
92
93 <note>
94 <para>
95 Some sort of time synchronization facility on your system (like
96 <xref linkend="ntp"/>) is required since Kerberos won't authenticate
97 if there is a time difference between a kerberized client and the
98 KDC server.
99 </para>
100 </note>
101
102 <para condition="html" role="usernotes">User Notes:
103 <ulink url="&blfs-wiki;/mitkrb"/>
104 </para>
105 </sect2>
106
107 <sect2 role="installation">
108 <title>Installation of MIT Kerberos V5</title>
109
110 <para>
111 Build <application>MIT Kerberos V5</application> by running the
112 following commands:
113 </para>
114
115<screen><userinput>cd src &amp;&amp;
116
117sed -i -e 's@\^u}@^u cols 300}@' tests/dejagnu/config/default.exp &amp;&amp;
118sed -i -e '/eq 0/{N;s/12 //}' plugins/kdb/db2/libdb2/test/run.test &amp;&amp;
119
120./configure --prefix=/usr \
121 --sysconfdir=/etc \
122 --localstatedir=/var/lib \
123 --with-system-et \
124 --with-system-ss \
125 --with-system-verto=no \
126 --enable-dns-for-realm &amp;&amp;
127make</userinput></screen>
128
129 <para>
130 To test the build, issue as the <systemitem
131 class="username">root</systemitem> user: <command>make -k check</command>.
132 You need at least <xref linkend="tcl"/>, which is used to drive the
133 testsuite. Furthermore, <xref linkend="dejagnu"/> must be available for
134 some of the tests to run. If you have a former version of MIT Kerberos V5
135 installed, it may happen that the test suite pick up the installed
136 versions of the libraries, rather than the newly built ones. If so, it is
137 better to run the tests after the installation.
138 </para>
139
140 <para>
141 Now, as the <systemitem class="username">root</systemitem> user:
142 </para>
143
144<screen role="root"><userinput>make install &amp;&amp;
145
146for f in gssapi_krb5 gssrpc k5crypto kadm5clnt kadm5srv \
147 kdb5 kdb_ldap krad krb5 krb5support verto ; do
148
149 find /usr/lib -type f -name "lib$f*.so*" -exec chmod -v 755 {} \;
150done &amp;&amp;
151
152mv -v /usr/lib/libkrb5.so.3* /lib &amp;&amp;
153mv -v /usr/lib/libk5crypto.so.3* /lib &amp;&amp;
154mv -v /usr/lib/libkrb5support.so.0* /lib &amp;&amp;
155
156ln -v -sf ../../lib/libkrb5.so.3.3 /usr/lib/libkrb5.so &amp;&amp;
157ln -v -sf ../../lib/libk5crypto.so.3.1 /usr/lib/libk5crypto.so &amp;&amp;
158ln -v -sf ../../lib/libkrb5support.so.0.1 /usr/lib/libkrb5support.so &amp;&amp;
159
160mv -v /usr/bin/ksu /bin &amp;&amp;
161chmod -v 755 /bin/ksu &amp;&amp;
162
163install -v -dm755 /usr/share/doc/krb5-&mitkrb-version; &amp;&amp;
164cp -vfr ../doc/* /usr/share/doc/krb5-&mitkrb-version;</userinput></screen>
165
166 </sect2>
167
168 <sect2 role="commands">
169 <title>Command Explanations</title>
170
171 <para>
172 The first sed increases the width of the virtual terminal used for some
173 tests to prevent some spurious text in the output which is taken as a
174 failure. The second <command>sed</command> removes a test that is known
175 to fail.
176 </para>
177
178 <para>
179 <parameter>--localstatedir=/var/lib</parameter>: This option is
180 used so that the Kerberos variable run-time data is located in
181 <filename class="directory">/var/lib</filename> instead of
182 <filename class="directory">/usr/var</filename>.
183 </para>
184
185 <para>
186 <parameter>--with-system-et</parameter>: This switch causes the build
187 to use the system-installed versions of the error-table support
188 software.
189 </para>
190
191 <para>
192 <parameter>--with-system-ss</parameter>: This switch causes the build
193 to use the system-installed versions of the subsystem command-line
194 interface software.
195 </para>
196
197 <para>
198 <parameter>--with-system-verto=no</parameter>: This switch fixes a bug in
199 the package: it does not recognize its own verto library installed
200 previously. This is not a problem, if reinstalling the same version,
201 but if you are updating, the old library is used as system's one,
202 instead of installing the new version.
203 </para>
204
205 <para>
206 <parameter>--enable-dns-for-realm</parameter>: This switch allows
207 realms to be resolved using the DNS server.
208 </para>
209
210 <para>
211 <option>--with-ldap</option>: Use this switch if you want to compile the
212 <application>OpenLDAP</application> database backend module.
213 </para>
214
215 <para>
216 <command>mv -v /usr/lib/libk... /lib </command> and
217 <command>ln -v -sf ../../lib/libk... /usr/lib/libk...</command>:
218 Move critical libraries to the
219 <filename class="directory">/lib</filename> directory so that they are
220 available when the <filename class="directory">/usr</filename>
221 filesystem is not mounted.
222 </para>
223
224 <para>
225 <command>find /usr/lib -type f -name "lib$f*.so*" -exec chmod -v 755 {} \;</command>:
226 This command changes the permisison of installed libraries.
227 </para>
228
229 <para>
230 <command>mv -v /usr/bin/ksu /bin</command>: Moves the
231 <command>ksu</command> program to the
232 <filename class="directory">/bin</filename> directory so that it is
233 available when the <filename class="directory">/usr</filename>
234 filesystem is not mounted.
235 </para>
236
237 </sect2>
238
239 <sect2 role="configuration">
240 <title>Configuring MIT Kerberos V5</title>
241
242 <sect3 id="krb5-config">
243 <title>Config Files</title>
244
245 <para>
246 <filename>/etc/krb5.conf</filename> and
247 <filename>/var/lib/krb5kdc/kdc.conf</filename>
248 </para>
249
250 <indexterm zone="mitkrb krb5-config">
251 <primary sortas="e-etc-krb5.conf">/etc/krb5.conf</primary>
252 </indexterm>
253
254 <indexterm zone="mitkrb krb5-config">
255 <primary sortas="e-var-lib-krb5kdc-kdc.conf">/var/lib/krb5kdc/kdc.conf</primary>
256 </indexterm>
257
258 </sect3>
259
260 <sect3>
261 <title>Configuration Information</title>
262
263 <sect4>
264 <title>Kerberos Configuration</title>
265
266 <tip>
267 <para>
268 You should consider installing some sort of password checking
269 dictionary so that you can configure the installation to only
270 accept strong passwords. A suitable dictionary to use is shown in
271 the <xref linkend="cracklib"/> instructions. Note that only one
272 file can be used, but you can concatenate many files into one. The
273 configuration file shown below assumes you have installed a
274 dictionary to <filename>/usr/share/dict/words</filename>.
275 </para>
276 </tip>
277
278 <para>
279 Create the Kerberos configuration file with the following
280 commands issued by the <systemitem class="username">root</systemitem>
281 user:
282 </para>
283
284<screen role="root"><userinput>cat &gt; /etc/krb5.conf &lt;&lt; "EOF"
285<literal># Begin /etc/krb5.conf
286
287[libdefaults]
288 default_realm = <replaceable>&lt;EXAMPLE.ORG&gt;</replaceable>
289 encrypt = true
290
291[realms]
292 <replaceable>&lt;EXAMPLE.ORG&gt;</replaceable> = {
293 kdc = <replaceable>&lt;belgarath.example.org&gt;</replaceable>
294 admin_server = <replaceable>&lt;belgarath.example.org&gt;</replaceable>
295 dict_file = /usr/share/dict/words
296 }
297
298[domain_realm]
299 .<replaceable>&lt;example.org&gt;</replaceable> = <replaceable>&lt;EXAMPLE.ORG&gt;</replaceable>
300
301[logging]
302 kdc = SYSLOG:INFO:AUTH
303 admin_server = SYSLOG:INFO:AUTH
304 default = SYSLOG:DEBUG:DAEMON
305
306# End /etc/krb5.conf</literal>
307EOF</userinput></screen>
308
309 <para>
310 You will need to substitute your domain and proper hostname for the
311 occurrences of the <replaceable>&lt;belgarath&gt;</replaceable> and
312 <replaceable>&lt;example.org&gt;</replaceable> names.
313 </para>
314
315 <para>
316 <option>default_realm</option> should be the name of your
317 domain changed to ALL CAPS. This isn't required, but both
318 <application>Heimdal</application> and MIT recommend it.
319 </para>
320
321 <para>
322 <option>encrypt = true</option> provides encryption of all traffic
323 between kerberized clients and servers. It's not necessary and can
324 be left off. If you leave it off, you can encrypt all traffic from
325 the client to the server using a switch on the client program
326 instead.
327 </para>
328
329 <para>
330 The <option>[realms]</option> parameters tell the client programs
331 where to look for the KDC authentication services.
332 </para>
333
334 <para>
335 The <option>[domain_realm]</option> section maps a domain to a realm.
336 </para>
337
338 <para>
339 Create the KDC database:
340 </para>
341
342<screen role="root"><userinput>kdb5_util create -r <replaceable>&lt;EXAMPLE.ORG&gt;</replaceable> -s</userinput></screen>
343
344 <para>
345 Now you should populate the database with principals
346 (users). For now, just use your regular login name or
347 <systemitem class="username">root</systemitem>.
348 </para>
349
350<screen role="root"><userinput>kadmin.local
351<prompt>kadmin.local:</prompt> add_policy dict-only
352<prompt>kadmin.local:</prompt> addprinc -policy dict-only <replaceable>&lt;loginname&gt;</replaceable></userinput></screen>
353
354 <para>
355 The KDC server and any machine running kerberized
356 server daemons must have a host key installed:
357 </para>
358
359<screen role="root"><userinput><prompt>kadmin.local:</prompt> addprinc -randkey host/<replaceable>&lt;belgarath.example.org&gt;</replaceable></userinput></screen>
360
361 <para>
362 After choosing the defaults when prompted, you will have to
363 export the data to a keytab file:
364 </para>
365
366<screen role="root"><userinput><prompt>kadmin.local:</prompt> ktadd host/<replaceable>&lt;belgarath.example.org&gt;</replaceable></userinput></screen>
367
368 <para>
369 This should have created a file in
370 <filename class="directory">/etc</filename> named
371 <filename>krb5.keytab</filename> (Kerberos 5). This file should
372 have 600 (<systemitem class="username">root</systemitem> rw only)
373 permissions. Keeping the keytab files from public access is crucial
374 to the overall security of the Kerberos installation.
375 </para>
376
377 <para>
378 Exit the <command>kadmin</command> program (use
379 <command>quit</command> or <command>exit</command>) and return
380 back to the shell prompt. Start the KDC daemon manually, just to
381 test out the installation:
382 </para>
383
384<screen role="root"><userinput>/usr/sbin/krb5kdc</userinput></screen>
385
386 <para>
387 Attempt to get a ticket with the following command:
388 </para>
389
390<screen><userinput>kinit <replaceable>&lt;loginname&gt;</replaceable></userinput></screen>
391
392 <para>
393 You will be prompted for the password you created. After you
394 get your ticket, you can list it with the following command:
395 </para>
396
397<screen><userinput>klist</userinput></screen>
398
399 <para>
400 Information about the ticket should be displayed on the
401 screen.
402 </para>
403
404 <para>
405 To test the functionality of the keytab file, issue the
406 following command as the
407 <systemitem class="username">root</systemitem> user:
408 </para>
409
410<screen role="root"><userinput>ktutil
411<prompt>ktutil:</prompt> rkt /etc/krb5.keytab
412<prompt>ktutil:</prompt> l</userinput></screen>
413
414 <para>
415 This should dump a list of the host principal, along with
416 the encryption methods used to access the principal.
417 </para>
418
419 <para>
420 Create an empty ACL file that can be modified later:
421 </para>
422
423<screen role="root"><userinput>touch /var/lib/krb5kdc/kadm5.acl</userinput></screen>
424
425 <para>
426 At this point, if everything has been successful so far, you
427 can feel fairly confident in the installation and configuration of
428 the package.
429 </para>
430
431 </sect4>
432
433 <sect4>
434 <title>Additional Information</title>
435
436 <para>
437 For additional information consult the <ulink
438 url="http://web.mit.edu/kerberos/www/krb5-&mitkrb-major-version;/#documentation">
439 documentation for krb5-&mitkrb-version;</ulink> on which the above
440 instructions are based.
441 </para>
442
443 </sect4>
444
445 </sect3>
446
447 <sect3 id="mitkrb-init">
448 <title><phrase revision="sysv">Init Script</phrase>
449 <phrase revision="systemd">Systemd Unit</phrase></title>
450
451 <para revision="sysv">
452 If you want to start <application>Kerberos</application> services
453 at boot, install the <filename>/etc/rc.d/init.d/krb5</filename> init
454 script included in the <xref linkend="bootscripts"/> package using
455 the following command:
456 </para>
457
458 <para revision="systemd">
459 If you want to start <application>Kerberos</application> services
460 at boot, install the <filename>krb5.service</filename> unit included in
461 the <xref linkend="systemd-units"/> package using the following command:
462 </para>
463
464 <indexterm zone="mitkrb mitkrb-init">
465 <primary sortas="f-krb5">krb5</primary>
466 </indexterm>
467
468<screen role="root"><userinput>make install-krb5</userinput></screen>
469
470 </sect3>
471
472 </sect2>
473
474 <sect2 role="content">
475
476 <title>Contents</title>
477
478 <segmentedlist>
479 <segtitle>Installed Programs</segtitle>
480 <segtitle>Installed Libraries</segtitle>
481 <segtitle>Installed Directories</segtitle>
482
483 <seglistitem>
484 <seg>
485 gss-client, gss-server, k5srvutil, kadmin, kadmin.local,
486 kadmind, kdb5_ldap_util (optional), kdb5_util, kdestroy, kinit, klist,
487 kpasswd, kprop, kpropd, kproplog, krb5-config, krb5-send-pr, krb5kdc,
488 ksu, kswitch, ktutil, kvno, sclient, sim_client, sim_server,
489 sserver, uuclient, and uuserver
490 </seg>
491 <seg>
492 libgssapi_krb5.so, libgssrpc.so, libk5crypto.so, libkadm5clnt_mit.so,
493 libkadm5clnt.so, libkadm5srv_mit.so, libkadm5srv.so, libkdb_ldap.so
494 (optional), libkdb5.so, libkrad.so, libkrb5.so, libkrb5support.so,
495 libverto.so, and some plugins under the /usr/lib/krb5 tree
496 </seg>
497 <seg>
498 /usr/include/{gssapi,gssrpc,kadm5,krb5},
499 /usr/lib/krb5,
500 /usr/share/{doc/krb5-&mitkrb-version;,examples/krb5},
501 /var/lib/krb5kdc, and
502 /run/krb5kdc
503 </seg>
504 </seglistitem>
505 </segmentedlist>
506
507 <variablelist>
508 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
509 <?dbfo list-presentation="list"?>
510 <?dbhtml list-presentation="table"?>
511
512 <varlistentry id="gss-client">
513 <term><command>gss-client</command></term>
514 <listitem>
515 <para>
516 is a GSSAPI test client.
517 </para>
518 <indexterm zone="mitkrb gss-client">
519 <primary sortas="b-gss-client">gss-client</primary>
520 </indexterm>
521 </listitem>
522 </varlistentry>
523
524 <varlistentry id="gss-server">
525 <term><command>gss-server</command></term>
526 <listitem>
527 <para>
528 is a GSSAPI test server.
529 </para>
530 <indexterm zone="mitkrb gss-server">
531 <primary sortas="b-gss-server">gss-server</primary>
532 </indexterm>
533 </listitem>
534 </varlistentry>
535
536 <varlistentry id="k5srvutil">
537 <term><command>k5srvutil</command></term>
538 <listitem>
539 <para>
540 is a host keytable manipulation utility.
541 </para>
542 <indexterm zone="mitkrb k5srvutil">
543 <primary sortas="b-k5srvutil">k5srvutil</primary>
544 </indexterm>
545 </listitem>
546 </varlistentry>
547
548 <varlistentry id="kadmin">
549 <term><command>kadmin</command></term>
550 <listitem>
551 <para>
552 is an utility used to make modifications
553 to the Kerberos database.
554 </para>
555 <indexterm zone="mitkrb kadmin">
556 <primary sortas="b-kadmin">kadmin</primary>
557 </indexterm>
558 </listitem>
559 </varlistentry>
560
561 <varlistentry id="kadmin.local">
562 <term><command>kadmin.local</command></term>
563 <listitem>
564 <para>
565 is an utility similar to <command>kadmin</command>, but if the
566 database is db2, the local client <command>kadmin.local</command>,
567 is intended to run directly on the master KDC without Kerberos
568 authentication.
569 </para>
570 <indexterm zone="mitkrb kadmin.local">
571 <primary sortas="b-kadmin.local">kadmin.local</primary>
572 </indexterm>
573 </listitem>
574 </varlistentry>
575
576 <varlistentry id="kadmind">
577 <term><command>kadmind</command></term>
578 <listitem>
579 <para>
580 is a server for administrative access
581 to a Kerberos database.
582 </para>
583 <indexterm zone="mitkrb kadmind">
584 <primary sortas="b-kadmind">kadmind</primary>
585 </indexterm>
586 </listitem>
587 </varlistentry>
588
589 <varlistentry id="kdb5_ldap_util">
590 <term><command>kdb5_ldap_util (optional)</command></term>
591 <listitem>
592 <para>
593 allows an administrator to manage realms, Kerberos services
594 and ticket policies.
595 </para>
596 <indexterm zone="mitkrb kdb5_ldap_util">
597 <primary sortas="b-kdb5_ldap_util">kdb5_ldap_util</primary>
598 </indexterm>
599 </listitem>
600 </varlistentry>
601
602 <varlistentry id="kdb5_util">
603 <term><command>kdb5_util</command></term>
604 <listitem>
605 <para>
606 is the KDC database utility.
607 </para>
608 <indexterm zone="mitkrb kdb5_util">
609 <primary sortas="b-kdb5_util">kdb5_util</primary>
610 </indexterm>
611 </listitem>
612 </varlistentry>
613
614 <varlistentry id="kdestroy">
615 <term><command>kdestroy</command></term>
616 <listitem>
617 <para>
618 removes the current set of tickets.
619 </para>
620 <indexterm zone="mitkrb kdestroy">
621 <primary sortas="b-kdestroy">kdestroy</primary>
622 </indexterm>
623 </listitem>
624 </varlistentry>
625
626 <varlistentry id="kinit">
627 <term><command>kinit</command></term>
628 <listitem>
629 <para>
630 is used to authenticate to the Kerberos server as a
631 principal and acquire a ticket granting ticket that can
632 later be used to obtain tickets for other services.
633 </para>
634 <indexterm zone="mitkrb kinit">
635 <primary sortas="b-kinit">kinit</primary>
636 </indexterm>
637 </listitem>
638 </varlistentry>
639
640 <varlistentry id="klist">
641 <term><command>klist</command></term>
642 <listitem>
643 <para>
644 reads and displays the current tickets in
645 the credential cache.
646 </para>
647 <indexterm zone="mitkrb klist">
648 <primary sortas="b-klist">klist</primary>
649 </indexterm>
650 </listitem>
651 </varlistentry>
652
653 <varlistentry id="kpasswd">
654 <term><command>kpasswd</command></term>
655 <listitem>
656 <para>
657 is a program for changing Kerberos 5 passwords.
658 </para>
659 <indexterm zone="mitkrb kpasswd">
660 <primary sortas="b-kpasswd">kpasswd</primary>
661 </indexterm>
662 </listitem>
663 </varlistentry>
664
665 <varlistentry id="kprop">
666 <term><command>kprop</command></term>
667 <listitem>
668 <para>
669 takes a principal database in a specified format and
670 converts it into a stream of database records.
671 </para>
672 <indexterm zone="mitkrb kprop">
673 <primary sortas="b-kprop">kprop</primary>
674 </indexterm>
675 </listitem>
676 </varlistentry>
677
678 <varlistentry id="kpropd">
679 <term><command>kpropd</command></term>
680 <listitem>
681 <para>
682 receives a database sent by <command>kprop</command>
683 and writes it as a local database.
684 </para>
685 <indexterm zone="mitkrb kpropd">
686 <primary sortas="b-kpropd">kpropd</primary>
687 </indexterm>
688 </listitem>
689 </varlistentry>
690
691 <varlistentry id="kproplog">
692 <term><command>kproplog</command></term>
693 <listitem>
694 <para>
695 displays the contents of the KDC database update log to standard
696 output.
697 </para>
698 <indexterm zone="mitkrb kproplog">
699 <primary sortas="b-kproplog">kproplog</primary>
700 </indexterm>
701 </listitem>
702 </varlistentry>
703
704 <varlistentry id="krb5-config-prog2">
705 <term><command>krb5-config</command></term>
706 <listitem>
707 <para>
708 gives information on how to link programs against
709 libraries.
710 </para>
711 <indexterm zone="mitkrb krb5-config-prog2">
712 <primary sortas="b-krb5-config">krb5-config</primary>
713 </indexterm>
714 </listitem>
715 </varlistentry>
716
717 <varlistentry id="krb5kdc">
718 <term><command>krb5kdc</command></term>
719 <listitem>
720 <para>
721 is the <application>Kerberos 5</application> server.
722 </para>
723 <indexterm zone="mitkrb krb5kdc">
724 <primary sortas="b-krb5kdc">krb5kdc</primary>
725 </indexterm>
726 </listitem>
727 </varlistentry>
728
729 <varlistentry id="krb5-send-pr">
730 <term><command>krb5-send-pr</command></term>
731 <listitem>
732 <para>
733 sends a problem report (PR) to a central support site.
734 </para>
735 <indexterm zone="mitkrb krb5-send-pr">
736 <primary sortas="b-krb-send-pr">krb5-send-pr</primary>
737 </indexterm>
738 </listitem>
739 </varlistentry>
740
741 <varlistentry id="ksu">
742 <term><command>ksu</command></term>
743 <listitem>
744 <para>
745 is the super user program using Kerberos protocol.
746 Requires a properly configured
747 <filename>/etc/shells</filename> and
748 <filename>~/.k5login</filename> containing principals
749 authorized to become super users.
750 </para>
751 <indexterm zone="mitkrb ksu">
752 <primary sortas="b-ksu">ksu</primary>
753 </indexterm>
754 </listitem>
755 </varlistentry>
756
757 <varlistentry id="kswitch">
758 <term><command>kswitch</command></term>
759 <listitem>
760 <para>
761 makes the specified credential cache the
762 primary cache for the collection, if a cache
763 collection is available.
764 </para>
765 <indexterm zone="mitkrb kswitch">
766 <primary sortas="b-kswitch">kswitch</primary>
767 </indexterm>
768 </listitem>
769 </varlistentry>
770
771 <varlistentry id="ktutil">
772 <term><command>ktutil</command></term>
773 <listitem>
774 <para>
775 is a program for managing Kerberos keytabs.
776 </para>
777 <indexterm zone="mitkrb ktutil">
778 <primary sortas="b-ktutil">ktutil</primary>
779 </indexterm>
780 </listitem>
781 </varlistentry>
782
783 <varlistentry id="kvno">
784 <term><command>kvno</command></term>
785 <listitem>
786 <para>
787 prints keyversion numbers of Kerberos principals.
788 </para>
789 <indexterm zone="mitkrb kvno">
790 <primary sortas="b-kvno">kvno</primary>
791 </indexterm>
792 </listitem>
793 </varlistentry>
794
795 <varlistentry id="sclient">
796 <term><command>sclient</command></term>
797 <listitem>
798 <para>
799 is used to contact a sample server and authenticate to it
800 using Kerberos 5 tickets, then display the server's
801 response.
802 </para>
803 <indexterm zone="mitkrb sclient">
804 <primary sortas="b-sclient">sclient</primary>
805 </indexterm>
806 </listitem>
807 </varlistentry>
808
809 <varlistentry id="sim_client">
810 <term><command>sim_client</command></term>
811 <listitem>
812 <para>
813 is a simple UDP-based sample client program, for
814 demonstration.
815 </para>
816 <indexterm zone="mitkrb sim_client">
817 <primary sortas="b-sim_client">sim_client</primary>
818 </indexterm>
819 </listitem>
820 </varlistentry>
821
822 <varlistentry id="sim_server">
823 <term><command>sim_server</command></term>
824 <listitem>
825 <para>
826 is a simple UDP-based server application, for
827 demonstration.
828 </para>
829 <indexterm zone="mitkrb sim_server">
830 <primary sortas="b-sim_server">sim_server</primary>
831 </indexterm>
832 </listitem>
833 </varlistentry>
834
835 <varlistentry id="sserver">
836 <term><command>sserver</command></term>
837 <listitem>
838 <para>
839 is the sample Kerberos 5 server.
840 </para>
841 <indexterm zone="mitkrb sserver">
842 <primary sortas="b-sserver">sserver</primary>
843 </indexterm>
844 </listitem>
845 </varlistentry>
846
847 <varlistentry id="uuclient">
848 <term><command>uuclient</command></term>
849 <listitem>
850 <para>
851 is another sample client.
852 </para>
853 <indexterm zone="mitkrb uuclient">
854 <primary sortas="b-uuclient">uuclient</primary>
855 </indexterm>
856 </listitem>
857 </varlistentry>
858
859 <varlistentry id="uuserver">
860 <term><command>uuserver</command></term>
861 <listitem>
862 <para>
863 is another sample server.
864 </para>
865 <indexterm zone="mitkrb uuserver">
866 <primary sortas="b-uuserver">uuserver</primary>
867 </indexterm>
868 </listitem>
869 </varlistentry>
870
871
872 <varlistentry id="libgssapi_krb5">
873 <term><filename class="libraryfile">libgssapi_krb5.so</filename></term>
874 <listitem>
875 <para>
876 contains the Generic Security Service Application Programming
877 Interface (GSSAPI) functions which provides security services
878 to callers in a generic fashion, supportable with a range of
879 underlying mechanisms and technologies and hence allowing
880 source-level portability of applications to different
881 environments.
882 </para>
883 <indexterm zone="mitkrb libgssapi_krb5">
884 <primary sortas="c-libgssapi_krb5">libgssapi_krb5.so</primary>
885 </indexterm>
886 </listitem>
887 </varlistentry>
888
889 <varlistentry id="libkadm5clnt">
890 <term><filename class="libraryfile">libkadm5clnt.so</filename></term>
891 <listitem>
892 <para>
893 contains the administrative authentication and password checking
894 functions required by Kerberos 5 client-side programs.
895 </para>
896 <indexterm zone="mitkrb libkadm5clnt">
897 <primary sortas="c-libkadm5clnt">libkadm5clnt.so</primary>
898 </indexterm>
899 </listitem>
900 </varlistentry>
901
902 <varlistentry id="libkadm5srv">
903 <term><filename class="libraryfile">libkadm5srv.so</filename></term>
904 <listitem>
905 <para>
906 contains the administrative authentication and password
907 checking functions required by Kerberos 5 servers.
908 </para>
909 <indexterm zone="mitkrb libkadm5srv">
910 <primary sortas="c-libkadm5srv">libkadm5srv.so</primary>
911 </indexterm>
912 </listitem>
913 </varlistentry>
914
915 <varlistentry id="libkdb5">
916 <term><filename class="libraryfile">libkdb5.so</filename></term>
917 <listitem>
918 <para>
919 is a Kerberos 5 authentication/authorization database
920 access library.
921 </para>
922 <indexterm zone="mitkrb libkdb5">
923 <primary sortas="c-libkdb5">libkdb5.so</primary>
924 </indexterm>
925 </listitem>
926 </varlistentry>
927
928 <varlistentry id="libkrad">
929 <term><filename class="libraryfile">libkrad.so</filename></term>
930 <listitem>
931 <para>
932 contains the internal support library for RADIUS functionality.
933 </para>
934 <indexterm zone="mitkrb libkrad">
935 <primary sortas="c-libkrad">libkrad.so</primary>
936 </indexterm>
937 </listitem>
938 </varlistentry>
939
940 <varlistentry id="libkrb5">
941 <term><filename class="libraryfile">libkrb5.so</filename></term>
942 <listitem>
943 <para>
944 is an all-purpose <application>Kerberos 5</application> library.
945 </para>
946 <indexterm zone="mitkrb libkrb5">
947 <primary sortas="c-libkrb5">libkrb5.so</primary>
948 </indexterm>
949 </listitem>
950 </varlistentry>
951
952 </variablelist>
953
954 </sect2>
955
956</sect1>
Note: See TracBrowser for help on using the repository browser.