source: postlfs/security/mitkrb.xml@ f5f17d5

trunk
Last change on this file since f5f17d5 was f5f17d5, checked in by Douglas R. Reno <renodr@…>, 3 months ago

krb5: Remove instructions for moving libraries to /lib and binaries to
/bin.

  • Property mode set to 100644
File size: 31.4 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY mitkrb-download-http "https://kerberos.org/dist/krb5/&mitkrb-major-version;/krb5-&mitkrb-version;.tar.gz">
8 <!ENTITY mitkrb-download-ftp " ">
9 <!ENTITY mitkrb-md5sum "81257292f8243f735654d4fd5d1fef6a">
10 <!ENTITY mitkrb-size "8.3 MB">
11 <!ENTITY mitkrb-buildsize "138 MB (add 24 MB for tests)">
12 <!ENTITY mitkrb-time "0.8 SBU (add 1.4 SBU for tests)">
13]>
14
15<sect1 id="mitkrb" xreflabel="MIT Kerberos V5-&mitkrb-version;">
16 <?dbhtml filename="mitkrb.html"?>
17
18 <sect1info>
19 <date>$Date$</date>
20 </sect1info>
21
22 <title>MIT Kerberos V5-&mitkrb-version;</title>
23
24 <indexterm zone="mitkrb">
25 <primary sortas="a-MIT-Kerberos">MIT Kerberos V5</primary>
26 </indexterm>
27
28 <sect2 role="package">
29 <title>Introduction to MIT Kerberos V5</title>
30
31 <para>
32 <application>MIT Kerberos V5</application> is a free implementation
33 of Kerberos 5. Kerberos is a network authentication protocol. It
34 centralizes the authentication database and uses kerberized
35 applications to work with servers or services that support Kerberos
36 allowing single logins and encrypted communication over internal
37 networks or the Internet.
38 </para>
39
40 &lfs101_checked;
41
42 <bridgehead renderas="sect3">Package Information</bridgehead>
43 <itemizedlist spacing="compact">
44 <listitem>
45 <para>
46 Download (HTTP): <ulink url="&mitkrb-download-http;"/>
47 </para>
48 </listitem>
49 <listitem>
50 <para>
51 Download (FTP): <ulink url="&mitkrb-download-ftp;"/>
52 </para>
53 </listitem>
54 <listitem>
55 <para>
56 Download MD5 sum: &mitkrb-md5sum;
57 </para>
58 </listitem>
59 <listitem>
60 <para>
61 Download size: &mitkrb-size;
62 </para>
63 </listitem>
64 <listitem>
65 <para>
66 Estimated disk space required: &mitkrb-buildsize;
67 </para>
68 </listitem>
69 <listitem>
70 <para>
71 Estimated build time: &mitkrb-time;
72 </para>
73 </listitem>
74 </itemizedlist>
75
76 <bridgehead renderas="sect3">MIT Kerberos V5 Dependencies</bridgehead>
77
78 <bridgehead renderas="sect4">Optional</bridgehead>
79 <para role="optional">
80 <!-- <xref linkend="dejagnu"/> (for full test coverage), -->
81 <xref linkend="bind-utils"/>,
82 <xref linkend="gnupg2"/> (to authenticate the package),
83 <xref linkend="keyutils"/>,
84 <xref linkend="openldap"/>,<!-- Seems so that mit has its own
85 implementation of rpc now.
86 <xref linkend="rpcbind"/> (used during the testsuite),-->
87 <xref linkend="valgrind"/> (used during the testsuite),
88 <xref linkend="yasm"/>,
89 <ulink url="http://thrysoee.dk/editline/">libedit</ulink>,
90 <ulink url="https://cmocka.org/">cmocka</ulink>,
91 <ulink url="https://pypi.org/project/pyrad/">pyrad</ulink>, and
92 <ulink url="https://cwrap.org/resolv_wrapper.html">resolv_wrapper</ulink>
93 </para>
94
95 <note>
96 <para>
97 Some sort of time synchronization facility on your system (like
98 <xref linkend="ntp"/>) is required since Kerberos won't authenticate
99 if there is a time difference between a kerberized client and the
100 KDC server.
101 </para>
102 </note>
103
104 <para condition="html" role="usernotes">User Notes:
105 <ulink url="&blfs-wiki;/mitkrb"/>
106 </para>
107 </sect2>
108
109 <sect2 role="installation">
110 <title>Installation of MIT Kerberos V5</title>
111
112 <para>
113 Build <application>MIT Kerberos V5</application> by running the
114 following commands:
115 </para>
116
117<screen><userinput>cd src &amp;&amp;
118
119sed -i -e 's@\^u}@^u cols 300}@' tests/dejagnu/config/default.exp &amp;&amp;
120sed -i -e '/eq 0/{N;s/12 //}' plugins/kdb/db2/libdb2/test/run.test &amp;&amp;
121sed -i '/t_iprop.py/d' tests/Makefile.in &amp;&amp;
122
123./configure --prefix=/usr \
124 --sysconfdir=/etc \
125 --localstatedir=/var/lib \
126 --runstatedir=/run \
127 --with-system-et \
128 --with-system-ss \
129 --with-system-verto=no \
130 --enable-dns-for-realm &amp;&amp;
131make</userinput></screen>
132
133 <para>
134 To test the build, issue as the <systemitem
135 class="username">root</systemitem> user: <command>make -k -j1 check</command>.
136 <!-- You need at least <xref link end="tcl"/>, which is used to drive the
137 testsuite. Furthermore, <xref link end="dejagnu"/> must be available for
138 some of the tests to run.--> If you have a former version of MIT Kerberos V5
139 installed, it may happen that the test suite may pick up the installed
140 versions of the libraries, rather than the newly built ones. If so, it is
141 better to run the tests after the installation.
142 <!-- Note: on my laptop -j8 fails but -j1 passes -->
143 </para>
144
145 <para>
146 Now, as the <systemitem class="username">root</systemitem> user:
147 </para>
148
149<screen role="root"><userinput>make install &amp;&amp;
150
151install -v -dm755 /usr/share/doc/krb5-&mitkrb-version; &amp;&amp;
152cp -vfr ../doc/* /usr/share/doc/krb5-&mitkrb-version;</userinput></screen>
153
154 </sect2>
155
156 <sect2 role="commands">
157 <title>Command Explanations</title>
158
159 <para>
160 The first <command>sed</command> increases the width of the virtual
161 terminal used for some tests to prevent some spurious text in the output
162 which is taken as a failure. The second <command>sed</command> removes a
163 test that is known to fail. The third <command>sed</command> removes a
164 test that is known to hang.
165 </para>
166
167 <para>
168 <parameter>--localstatedir=/var/lib</parameter>: This option is
169 used so that the Kerberos variable runtime data is located in
170 <filename class="directory">/var/lib</filename> instead of
171 <filename class="directory">/usr/var</filename>.
172 </para>
173
174 <para>
175 <parameter>--runstatedir=/run</parameter>: This option is used so that
176 the Kerberos runtime state information is located in
177 <filename class="directory">/run</filename> instead of the deprecated
178 <filename class="directory">/var/run</filename>.
179 </para>
180
181 <para>
182 <parameter>--with-system-et</parameter>: This switch causes the build
183 to use the system-installed versions of the error-table support
184 software.
185 </para>
186
187 <para>
188 <parameter>--with-system-ss</parameter>: This switch causes the build
189 to use the system-installed versions of the subsystem command-line
190 interface software.
191 </para>
192
193 <para>
194 <parameter>--with-system-verto=no</parameter>: This switch fixes a bug in
195 the package: it does not recognize its own verto library installed
196 previously. This is not a problem, if reinstalling the same version,
197 but if you are updating, the old library is used as system's one,
198 instead of installing the new version.
199 </para>
200
201 <para>
202 <parameter>--enable-dns-for-realm</parameter>: This switch allows
203 realms to be resolved using the DNS server.
204 </para>
205
206 <para>
207 <option>--with-ldap</option>: Use this switch if you want to compile the
208 <application>OpenLDAP</application> database backend module.
209 </para>
210
211 <!-- FIXME: Removed due to merged-/usr setup
212 <para>
213 <command>mv -v /usr/lib/libk... /lib </command> and
214 <command>ln -v -sf ../../lib/libk... /usr/lib/libk...</command>:
215 Move critical libraries to the
216 <filename class="directory">/lib</filename> directory so that they are
217 available when the <filename class="directory">/usr</filename>
218 filesystem is not mounted.
219 </para>
220
221 <para>
222 <command>find /usr/lib -type f -name "lib$f*.so*" -exec chmod -v 755 {} \;</command>:
223 This command changes the permisison of installed libraries.
224 </para>
225
226 <para>
227 <command>mv -v /usr/bin/ksu /bin</command>: Moves the
228 <command>ksu</command> program to the
229 <filename class="directory">/bin</filename> directory so that it is
230 available when the <filename class="directory">/usr</filename>
231 filesystem is not mounted.
232 </para>
233 -->
234
235 </sect2>
236
237 <sect2 role="configuration">
238 <title>Configuring MIT Kerberos V5</title>
239
240 <sect3 id="krb5-config">
241 <title>Config Files</title>
242
243 <para>
244 <filename>/etc/krb5.conf</filename> and
245 <filename>/var/lib/krb5kdc/kdc.conf</filename>
246 </para>
247
248 <indexterm zone="mitkrb krb5-config">
249 <primary sortas="e-etc-krb5.conf">/etc/krb5.conf</primary>
250 </indexterm>
251
252 <indexterm zone="mitkrb krb5-config">
253 <primary sortas="e-var-lib-krb5kdc-kdc.conf">/var/lib/krb5kdc/kdc.conf</primary>
254 </indexterm>
255
256 </sect3>
257
258 <sect3>
259 <title>Configuration Information</title>
260
261 <sect4>
262 <title>Kerberos Configuration</title>
263
264 <tip>
265 <para>
266 You should consider installing some sort of password checking
267 dictionary so that you can configure the installation to only
268 accept strong passwords. A suitable dictionary to use is shown in
269 the <xref linkend="cracklib"/> instructions. Note that only one
270 file can be used, but you can concatenate many files into one. The
271 configuration file shown below assumes you have installed a
272 dictionary to <filename>/usr/share/dict/words</filename>.
273 </para>
274 </tip>
275
276 <para>
277 Create the Kerberos configuration file with the following
278 commands issued by the <systemitem class="username">root</systemitem>
279 user:
280 </para>
281
282<screen role="root"><userinput>cat &gt; /etc/krb5.conf &lt;&lt; "EOF"
283<literal># Begin /etc/krb5.conf
284
285[libdefaults]
286 default_realm = <replaceable>&lt;EXAMPLE.ORG&gt;</replaceable>
287 encrypt = true
288
289[realms]
290 <replaceable>&lt;EXAMPLE.ORG&gt;</replaceable> = {
291 kdc = <replaceable>&lt;belgarath.example.org&gt;</replaceable>
292 admin_server = <replaceable>&lt;belgarath.example.org&gt;</replaceable>
293 dict_file = /usr/share/dict/words
294 }
295
296[domain_realm]
297 .<replaceable>&lt;example.org&gt;</replaceable> = <replaceable>&lt;EXAMPLE.ORG&gt;</replaceable>
298
299[logging]
300 kdc = SYSLOG:INFO:AUTH
301 admin_server = SYSLOG:INFO:AUTH
302 default = SYSLOG:DEBUG:DAEMON
303
304# End /etc/krb5.conf</literal>
305EOF</userinput></screen>
306
307 <para>
308 You will need to substitute your domain and proper hostname for the
309 occurrences of the <replaceable>&lt;belgarath&gt;</replaceable> and
310 <replaceable>&lt;example.org&gt;</replaceable> names.
311 </para>
312
313 <para>
314 <option>default_realm</option> should be the name of your
315 domain changed to ALL CAPS. This isn't required, but both
316 <application>Heimdal</application> and MIT recommend it.
317 </para>
318
319 <para>
320 <option>encrypt = true</option> provides encryption of all traffic
321 between kerberized clients and servers. It's not necessary and can
322 be left off. If you leave it off, you can encrypt all traffic from
323 the client to the server using a switch on the client program
324 instead.
325 </para>
326
327 <para>
328 The <option>[realms]</option> parameters tell the client programs
329 where to look for the KDC authentication services.
330 </para>
331
332 <para>
333 The <option>[domain_realm]</option> section maps a domain to a realm.
334 </para>
335
336 <para>
337 Create the KDC database:
338 </para>
339
340<screen role="root"><userinput>kdb5_util create -r <replaceable>&lt;EXAMPLE.ORG&gt;</replaceable> -s</userinput></screen>
341
342 <para>
343 Now you should populate the database with principals
344 (users). For now, just use your regular login name or
345 <systemitem class="username">root</systemitem>.
346 </para>
347
348<screen role="root"><userinput>kadmin.local
349<prompt>kadmin.local:</prompt> add_policy dict-only
350<prompt>kadmin.local:</prompt> addprinc -policy dict-only <replaceable>&lt;loginname&gt;</replaceable></userinput></screen>
351
352 <para>
353 The KDC server and any machine running kerberized
354 server daemons must have a host key installed:
355 </para>
356
357<screen role="root"><userinput><prompt>kadmin.local:</prompt> addprinc -randkey host/<replaceable>&lt;belgarath.example.org&gt;</replaceable></userinput></screen>
358
359 <para>
360 After choosing the defaults when prompted, you will have to
361 export the data to a keytab file:
362 </para>
363
364<screen role="root"><userinput><prompt>kadmin.local:</prompt> ktadd host/<replaceable>&lt;belgarath.example.org&gt;</replaceable></userinput></screen>
365
366 <para>
367 This should have created a file in
368 <filename class="directory">/etc</filename> named
369 <filename>krb5.keytab</filename> (Kerberos 5). This file should
370 have 600 (<systemitem class="username">root</systemitem> rw only)
371 permissions. Keeping the keytab files from public access is crucial
372 to the overall security of the Kerberos installation.
373 </para>
374
375 <para>
376 Exit the <command>kadmin</command> program (use
377 <command>quit</command> or <command>exit</command>) and return
378 back to the shell prompt. Start the KDC daemon manually, just to
379 test out the installation:
380 </para>
381
382<screen role="root"><userinput>/usr/sbin/krb5kdc</userinput></screen>
383
384 <para>
385 Attempt to get a ticket with the following command:
386 </para>
387
388<screen><userinput>kinit <replaceable>&lt;loginname&gt;</replaceable></userinput></screen>
389
390 <para>
391 You will be prompted for the password you created. After you
392 get your ticket, you can list it with the following command:
393 </para>
394
395<screen><userinput>klist</userinput></screen>
396
397 <para>
398 Information about the ticket should be displayed on the
399 screen.
400 </para>
401
402 <para>
403 To test the functionality of the keytab file, issue the
404 following command as the
405 <systemitem class="username">root</systemitem> user:
406 </para>
407
408<screen role="root"><userinput>ktutil
409<prompt>ktutil:</prompt> rkt /etc/krb5.keytab
410<prompt>ktutil:</prompt> l</userinput></screen>
411
412 <para>
413 This should dump a list of the host principal, along with
414 the encryption methods used to access the principal.
415 </para>
416
417 <para>
418 Create an empty ACL file that can be modified later:
419 </para>
420
421<screen role="root"><userinput>touch /var/lib/krb5kdc/kadm5.acl</userinput></screen>
422
423 <para>
424 At this point, if everything has been successful so far, you
425 can feel fairly confident in the installation and configuration of
426 the package.
427 </para>
428
429 </sect4>
430
431 <sect4>
432 <title>Additional Information</title>
433
434 <para>
435 For additional information consult the <ulink
436 url="http://web.mit.edu/kerberos/www/krb5-&mitkrb-major-version;/#documentation">
437 documentation for krb5-&mitkrb-version;</ulink> on which the above
438 instructions are based.
439 </para>
440
441 </sect4>
442
443 </sect3>
444
445 <sect3 id="mitkrb-init">
446 <title><phrase revision="sysv">Init Script</phrase>
447 <phrase revision="systemd">Systemd Unit</phrase></title>
448
449 <para revision="sysv">
450 If you want to start <application>Kerberos</application> services
451 at boot, install the <filename>/etc/rc.d/init.d/krb5</filename> init
452 script included in the <xref linkend="bootscripts"/> package using
453 the following command:
454 </para>
455
456 <para revision="systemd">
457 If you want to start <application>Kerberos</application> services
458 at boot, install the <filename>krb5.service</filename> unit included in
459 the <xref linkend="systemd-units"/> package using the following command:
460 </para>
461
462 <indexterm zone="mitkrb mitkrb-init">
463 <primary sortas="f-krb5">krb5</primary>
464 </indexterm>
465
466<screen role="root"><userinput>make install-krb5</userinput></screen>
467
468 </sect3>
469
470 </sect2>
471
472 <sect2 role="content">
473
474 <title>Contents</title>
475
476 <segmentedlist>
477 <segtitle>Installed Programs</segtitle>
478 <segtitle>Installed Libraries</segtitle>
479 <segtitle>Installed Directories</segtitle>
480
481 <seglistitem>
482 <seg>
483 gss-client, gss-server, k5srvutil, kadmin, kadmin.local,
484 kadmind, kdb5_ldap_util (optional), kdb5_util, kdestroy, kinit, klist,
485 kpasswd, kprop, kpropd, kproplog, krb5-config, krb5-send-pr, krb5kdc,
486 ksu, kswitch, ktutil, kvno, sclient, sim_client, sim_server,
487 sserver, uuclient, and uuserver
488 </seg>
489 <seg>
490 libgssapi_krb5.so, libgssrpc.so, libk5crypto.so, libkadm5clnt_mit.so,
491 libkadm5clnt.so, libkadm5srv_mit.so, libkadm5srv.so, libkdb_ldap.so
492 (optional), libkdb5.so, libkrad.so, libkrb5.so, libkrb5support.so,
493 libverto.so, and some plugins under the /usr/lib/krb5 tree
494 </seg>
495 <seg>
496 /usr/include/{gssapi,gssrpc,kadm5,krb5},
497 /usr/lib/krb5,
498 /usr/share/{doc/krb5-&mitkrb-version;,examples/krb5},
499 /var/lib/krb5kdc, and
500 /run/krb5kdc
501 </seg>
502 </seglistitem>
503 </segmentedlist>
504
505 <variablelist>
506 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
507 <?dbfo list-presentation="list"?>
508 <?dbhtml list-presentation="table"?>
509
510 <varlistentry id="gss-client">
511 <term><command>gss-client</command></term>
512 <listitem>
513 <para>
514 is a GSSAPI test client
515 </para>
516 <indexterm zone="mitkrb gss-client">
517 <primary sortas="b-gss-client">gss-client</primary>
518 </indexterm>
519 </listitem>
520 </varlistentry>
521
522 <varlistentry id="gss-server">
523 <term><command>gss-server</command></term>
524 <listitem>
525 <para>
526 is a GSSAPI test server
527 </para>
528 <indexterm zone="mitkrb gss-server">
529 <primary sortas="b-gss-server">gss-server</primary>
530 </indexterm>
531 </listitem>
532 </varlistentry>
533
534 <varlistentry id="k5srvutil">
535 <term><command>k5srvutil</command></term>
536 <listitem>
537 <para>
538 is a host keytable manipulation utility
539 </para>
540 <indexterm zone="mitkrb k5srvutil">
541 <primary sortas="b-k5srvutil">k5srvutil</primary>
542 </indexterm>
543 </listitem>
544 </varlistentry>
545
546 <varlistentry id="kadmin">
547 <term><command>kadmin</command></term>
548 <listitem>
549 <para>
550 is an utility used to make modifications
551 to the Kerberos database
552 </para>
553 <indexterm zone="mitkrb kadmin">
554 <primary sortas="b-kadmin">kadmin</primary>
555 </indexterm>
556 </listitem>
557 </varlistentry>
558
559 <varlistentry id="kadmin.local">
560 <term><command>kadmin.local</command></term>
561 <listitem>
562 <para>
563 is an utility similar to <command>kadmin</command>, but if the
564 database is db2, the local client <command>kadmin.local</command>,
565 is intended to run directly on the master KDC without Kerberos
566 authentication
567 </para>
568 <indexterm zone="mitkrb kadmin.local">
569 <primary sortas="b-kadmin.local">kadmin.local</primary>
570 </indexterm>
571 </listitem>
572 </varlistentry>
573
574 <varlistentry id="kadmind">
575 <term><command>kadmind</command></term>
576 <listitem>
577 <para>
578 is a server for administrative access
579 to a Kerberos database
580 </para>
581 <indexterm zone="mitkrb kadmind">
582 <primary sortas="b-kadmind">kadmind</primary>
583 </indexterm>
584 </listitem>
585 </varlistentry>
586
587 <varlistentry id="kdb5_ldap_util">
588 <term><command>kdb5_ldap_util (optional)</command></term>
589 <listitem>
590 <para>
591 allows an administrator to manage realms, Kerberos services
592 and ticket policies
593 </para>
594 <indexterm zone="mitkrb kdb5_ldap_util">
595 <primary sortas="b-kdb5_ldap_util">kdb5_ldap_util</primary>
596 </indexterm>
597 </listitem>
598 </varlistentry>
599
600 <varlistentry id="kdb5_util">
601 <term><command>kdb5_util</command></term>
602 <listitem>
603 <para>
604 is the KDC database utility
605 </para>
606 <indexterm zone="mitkrb kdb5_util">
607 <primary sortas="b-kdb5_util">kdb5_util</primary>
608 </indexterm>
609 </listitem>
610 </varlistentry>
611
612 <varlistentry id="kdestroy">
613 <term><command>kdestroy</command></term>
614 <listitem>
615 <para>
616 removes the current set of tickets
617 </para>
618 <indexterm zone="mitkrb kdestroy">
619 <primary sortas="b-kdestroy">kdestroy</primary>
620 </indexterm>
621 </listitem>
622 </varlistentry>
623
624 <varlistentry id="kinit">
625 <term><command>kinit</command></term>
626 <listitem>
627 <para>
628 is used to authenticate to the Kerberos server as a
629 principal and acquire a ticket granting ticket that can
630 later be used to obtain tickets for other services
631 </para>
632 <indexterm zone="mitkrb kinit">
633 <primary sortas="b-kinit">kinit</primary>
634 </indexterm>
635 </listitem>
636 </varlistentry>
637
638 <varlistentry id="klist">
639 <term><command>klist</command></term>
640 <listitem>
641 <para>
642 reads and displays the current tickets in
643 the credential cache
644 </para>
645 <indexterm zone="mitkrb klist">
646 <primary sortas="b-klist">klist</primary>
647 </indexterm>
648 </listitem>
649 </varlistentry>
650
651 <varlistentry id="kpasswd">
652 <term><command>kpasswd</command></term>
653 <listitem>
654 <para>
655 is a program for changing Kerberos 5 passwords
656 </para>
657 <indexterm zone="mitkrb kpasswd">
658 <primary sortas="b-kpasswd">kpasswd</primary>
659 </indexterm>
660 </listitem>
661 </varlistentry>
662
663 <varlistentry id="kprop">
664 <term><command>kprop</command></term>
665 <listitem>
666 <para>
667 takes a principal database in a specified format and
668 converts it into a stream of database records
669 </para>
670 <indexterm zone="mitkrb kprop">
671 <primary sortas="b-kprop">kprop</primary>
672 </indexterm>
673 </listitem>
674 </varlistentry>
675
676 <varlistentry id="kpropd">
677 <term><command>kpropd</command></term>
678 <listitem>
679 <para>
680 receives a database sent by <command>kprop</command>
681 and writes it as a local database
682 </para>
683 <indexterm zone="mitkrb kpropd">
684 <primary sortas="b-kpropd">kpropd</primary>
685 </indexterm>
686 </listitem>
687 </varlistentry>
688
689 <varlistentry id="kproplog">
690 <term><command>kproplog</command></term>
691 <listitem>
692 <para>
693 displays the contents of the KDC database update log to standard
694 output
695 </para>
696 <indexterm zone="mitkrb kproplog">
697 <primary sortas="b-kproplog">kproplog</primary>
698 </indexterm>
699 </listitem>
700 </varlistentry>
701
702 <varlistentry id="krb5-config-prog2">
703 <term><command>krb5-config</command></term>
704 <listitem>
705 <para>
706 gives information on how to link programs against
707 libraries
708 </para>
709 <indexterm zone="mitkrb krb5-config-prog2">
710 <primary sortas="b-krb5-config">krb5-config</primary>
711 </indexterm>
712 </listitem>
713 </varlistentry>
714
715 <varlistentry id="krb5kdc">
716 <term><command>krb5kdc</command></term>
717 <listitem>
718 <para>
719 is the <application>Kerberos 5</application> server
720 </para>
721 <indexterm zone="mitkrb krb5kdc">
722 <primary sortas="b-krb5kdc">krb5kdc</primary>
723 </indexterm>
724 </listitem>
725 </varlistentry>
726
727 <varlistentry id="krb5-send-pr">
728 <term><command>krb5-send-pr</command></term>
729 <listitem>
730 <para>
731 sends a problem report (PR) to a central support site
732 </para>
733 <indexterm zone="mitkrb krb5-send-pr">
734 <primary sortas="b-krb-send-pr">krb5-send-pr</primary>
735 </indexterm>
736 </listitem>
737 </varlistentry>
738
739 <varlistentry id="ksu">
740 <term><command>ksu</command></term>
741 <listitem>
742 <para>
743 is the super user program using Kerberos protocol.
744 Requires a properly configured
745 <filename>/etc/shells</filename> and
746 <filename>~/.k5login</filename> containing principals
747 authorized to become super users
748 </para>
749 <indexterm zone="mitkrb ksu">
750 <primary sortas="b-ksu">ksu</primary>
751 </indexterm>
752 </listitem>
753 </varlistentry>
754
755 <varlistentry id="kswitch">
756 <term><command>kswitch</command></term>
757 <listitem>
758 <para>
759 makes the specified credential cache the
760 primary cache for the collection, if a cache
761 collection is available
762 </para>
763 <indexterm zone="mitkrb kswitch">
764 <primary sortas="b-kswitch">kswitch</primary>
765 </indexterm>
766 </listitem>
767 </varlistentry>
768
769 <varlistentry id="ktutil">
770 <term><command>ktutil</command></term>
771 <listitem>
772 <para>
773 is a program for managing Kerberos keytabs
774 </para>
775 <indexterm zone="mitkrb ktutil">
776 <primary sortas="b-ktutil">ktutil</primary>
777 </indexterm>
778 </listitem>
779 </varlistentry>
780
781 <varlistentry id="kvno">
782 <term><command>kvno</command></term>
783 <listitem>
784 <para>
785 prints keyversion numbers of Kerberos principals
786 </para>
787 <indexterm zone="mitkrb kvno">
788 <primary sortas="b-kvno">kvno</primary>
789 </indexterm>
790 </listitem>
791 </varlistentry>
792
793 <varlistentry id="sclient">
794 <term><command>sclient</command></term>
795 <listitem>
796 <para>
797 is used to contact a sample server and authenticate to it
798 using Kerberos 5 tickets, then display the server's
799 response
800 </para>
801 <indexterm zone="mitkrb sclient">
802 <primary sortas="b-sclient">sclient</primary>
803 </indexterm>
804 </listitem>
805 </varlistentry>
806
807 <varlistentry id="sim_client">
808 <term><command>sim_client</command></term>
809 <listitem>
810 <para>
811 is a simple UDP-based sample client program, for
812 demonstration
813 </para>
814 <indexterm zone="mitkrb sim_client">
815 <primary sortas="b-sim_client">sim_client</primary>
816 </indexterm>
817 </listitem>
818 </varlistentry>
819
820 <varlistentry id="sim_server">
821 <term><command>sim_server</command></term>
822 <listitem>
823 <para>
824 is a simple UDP-based server application, for
825 demonstration
826 </para>
827 <indexterm zone="mitkrb sim_server">
828 <primary sortas="b-sim_server">sim_server</primary>
829 </indexterm>
830 </listitem>
831 </varlistentry>
832
833 <varlistentry id="sserver">
834 <term><command>sserver</command></term>
835 <listitem>
836 <para>
837 is the sample Kerberos 5 server
838 </para>
839 <indexterm zone="mitkrb sserver">
840 <primary sortas="b-sserver">sserver</primary>
841 </indexterm>
842 </listitem>
843 </varlistentry>
844
845 <varlistentry id="uuclient">
846 <term><command>uuclient</command></term>
847 <listitem>
848 <para>
849 is another sample client
850 </para>
851 <indexterm zone="mitkrb uuclient">
852 <primary sortas="b-uuclient">uuclient</primary>
853 </indexterm>
854 </listitem>
855 </varlistentry>
856
857 <varlistentry id="uuserver">
858 <term><command>uuserver</command></term>
859 <listitem>
860 <para>
861 is another sample server
862 </para>
863 <indexterm zone="mitkrb uuserver">
864 <primary sortas="b-uuserver">uuserver</primary>
865 </indexterm>
866 </listitem>
867 </varlistentry>
868
869
870 <varlistentry id="libgssapi_krb5">
871 <term><filename class="libraryfile">libgssapi_krb5.so</filename></term>
872 <listitem>
873 <para>
874 contains the Generic Security Service Application Programming
875 Interface (GSSAPI) functions which provides security services
876 to callers in a generic fashion, supportable with a range of
877 underlying mechanisms and technologies and hence allowing
878 source-level portability of applications to different
879 environments
880 </para>
881 <indexterm zone="mitkrb libgssapi_krb5">
882 <primary sortas="c-libgssapi_krb5">libgssapi_krb5.so</primary>
883 </indexterm>
884 </listitem>
885 </varlistentry>
886
887 <varlistentry id="libkadm5clnt">
888 <term><filename class="libraryfile">libkadm5clnt.so</filename></term>
889 <listitem>
890 <para>
891 contains the administrative authentication and password checking
892 functions required by Kerberos 5 client-side programs
893 </para>
894 <indexterm zone="mitkrb libkadm5clnt">
895 <primary sortas="c-libkadm5clnt">libkadm5clnt.so</primary>
896 </indexterm>
897 </listitem>
898 </varlistentry>
899
900 <varlistentry id="libkadm5srv">
901 <term><filename class="libraryfile">libkadm5srv.so</filename></term>
902 <listitem>
903 <para>
904 contains the administrative authentication and password
905 checking functions required by Kerberos 5 servers
906 </para>
907 <indexterm zone="mitkrb libkadm5srv">
908 <primary sortas="c-libkadm5srv">libkadm5srv.so</primary>
909 </indexterm>
910 </listitem>
911 </varlistentry>
912
913 <varlistentry id="libkdb5">
914 <term><filename class="libraryfile">libkdb5.so</filename></term>
915 <listitem>
916 <para>
917 is a Kerberos 5 authentication/authorization database
918 access library
919 </para>
920 <indexterm zone="mitkrb libkdb5">
921 <primary sortas="c-libkdb5">libkdb5.so</primary>
922 </indexterm>
923 </listitem>
924 </varlistentry>
925
926 <varlistentry id="libkrad">
927 <term><filename class="libraryfile">libkrad.so</filename></term>
928 <listitem>
929 <para>
930 contains the internal support library for RADIUS functionality
931 </para>
932 <indexterm zone="mitkrb libkrad">
933 <primary sortas="c-libkrad">libkrad.so</primary>
934 </indexterm>
935 </listitem>
936 </varlistentry>
937
938 <varlistentry id="libkrb5">
939 <term><filename class="libraryfile">libkrb5.so</filename></term>
940 <listitem>
941 <para>
942 is an all-purpose <application>Kerberos 5</application> library
943 </para>
944 <indexterm zone="mitkrb libkrb5">
945 <primary sortas="c-libkrb5">libkrb5.so</primary>
946 </indexterm>
947 </listitem>
948 </varlistentry>
949
950 </variablelist>
951
952 </sect2>
953
954</sect1>
Note: See TracBrowser for help on using the repository browser.