heimdal-kinit (1) - Linux Manuals

heimdal-kinit: acquire initial tickets

Command to display heimdal-kinit manual in Linux: $ man 1 heimdal-kinit

NAME

kinit - acquire initial tickets

SYNOPSIS

kinit [--afslog ] [-c cachename | --cache= cachename ] [-f | --no-forwardable ] [-t keytabname | --keytab= keytabname ] [-l time | --lifetime= time ] [-p | --proxiable ] [-R | --renew ] [--renewable ] [-r time | --renewable-life= time ] [-S principal | --server= principal ] [-s time | --start-time= time ] [-k | --use-keytab ] [-v | --validate ] [-e enctypes | --enctypes= enctypes ] [-a addresses | --extra-addresses= addresses ] [--password-file= filename ] [--fcache-version= version-number ] [-A | --no-addresses ] [--anonymous ] [--enterprise ] [--version ] [--help ] [principal [command ] ]

DESCRIPTION

kinit is used to authenticate to the Kerberos server as principal or if none is given, a system generated default (typically your login name at the default realm), and acquire a ticket granting ticket that can later be used to obtain tickets for other services.

Supported options:

-c cachename --cache= cachename: The credentials cache to put the acquired ticket in, if other than default.
-f --forwardable: Obtain a ticket than can be forwarded to another host.
-F --no-forwardable: Do not obtain a forwardable ticket.
-t keytabname , --keytab= keytabname: Don't ask for a password, but instead get the key from the specified keytab.
-l time , --lifetime= time: Specifies the lifetime of the ticket. The argument can either be in seconds, or a more human readable string like `1h'
-p , --proxiable: Request tickets with the proxiable flag set.
-R , --renew: Try to renew ticket. The ticket must have the `renewable' flag set, and must not be expired.
--renewable: The same as --renewable-life with an infinite time.
-r time , --renewable-life= time: The max renewable ticket life.
-S principal , --server= principal: Get a ticket for a service other than krbtgt/LOCAL.REALM.
-s time , --start-time= time: Obtain a ticket that starts to be valid time (which can really be a generic time specification, like `1h' seconds into the future.
-k , --use-keytab: The same as --keytab but with the default keytab name (normally FILE:/etc/krb5.keytab )
-v , --validate: Try to validate an invalid ticket.
-e , --enctypes= enctypes: Request tickets with this particular enctype.
--password-file= filename: read the password from the first line of filename If the filename is STDIN the password will be read from the standard input.
--fcache-version= version-number: Create a credentials cache of version version-number
-a , --extra-addresses= enctypes: Adds a set of addresses that will, in addition to the systems local addresses, be put in the ticket. This can be useful if all addresses a client can use can't be automatically figured out. One such example is if the client is behind a firewall. Also settable via libdefaults/extra_addresses in krb5.conf5.
-A , --no-addresses: Request a ticket with no addresses.
--anonymous: Request an anonymous ticket (which means that the ticket will be issued to an anonymous principal, typically ``anonymous [at] REALM )''
--enterprise: Parse principal as a enterprise (KRB5-NT-ENTERPRISE) name. Enterprise names are email like principals that are stored in the name part of the principal, and since there are two @ characters the parser needs to know that the first is not a realm. An example of an enterprise name is ``lha [at] e.kth.se@KTH.SE'' and this option is usually used with canonicalize so that the principal returned from the KDC will typically be the real principal name.
--afslog: Gets AFS tickets, converts them to version 4 format, and stores them in the kernel. Only useful if you have AFS.

The forwardable proxiable ticket_life and renewable_life options can be set to a default value from the appdefaults section in krb5.conf, see krb5_appdefault3.

If a command is given, kinit will set up new credentials caches, and AFS PAG, and then run the given command. When it finishes the credentials will be removed.

ENVIRONMENT

KRB5CCNAME: Specifies the default credentials cache.
KRB5_CONFIG: The file name of krb5.conf the default being /etc/krb5.conf
KRBTKFILE: Specifies the Kerberos 4 ticket file to store version 4 tickets in.