1.\" $NetBSD: kcm.8,v 1.7 2023/06/19 21:41:41 christos Exp $ 2.\" 3.\" Copyright (c) 2005 Kungliga Tekniska Högskolan 4.\" (Royal Institute of Technology, Stockholm, Sweden). 5.\" All rights reserved. 6.\" 7.\" Redistribution and use in source and binary forms, with or without 8.\" modification, are permitted provided that the following conditions 9.\" are met: 10.\" 11.\" 1. Redistributions of source code must retain the above copyright 12.\" notice, this list of conditions and the following disclaimer. 13.\" 14.\" 2. Redistributions in binary form must reproduce the above copyright 15.\" notice, this list of conditions and the following disclaimer in the 16.\" documentation and/or other materials provided with the distribution. 17.\" 18.\" 3. Neither the name of the Institute nor the names of its contributors 19.\" may be used to endorse or promote products derived from this software 20.\" without specific prior written permission. 21.\" 22.\" THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 23.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 24.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 25.\" ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 26.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 27.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 28.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 29.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 30.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 31.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 32.\" SUCH DAMAGE. 33.\" 34.\" Id 35.\" 36.Dd May 29, 2005 37.Dt KCM 8 38.Os 39.Sh NAME 40.Nm kcm 41.Nd process-based credential cache for Kerberos tickets. 42.Sh SYNOPSIS 43.Nm 44.Op Fl Fl cache-name= Ns Ar cachename 45.Oo Fl c Ar file \*(Ba Xo 46.Fl Fl config-file= Ns Ar file 47.Xc 48.Oc 49.Oo Fl g Ar group \*(Ba Xo 50.Fl Fl group= Ns Ar group 51.Xc 52.Oc 53.Op Fl Fl max-request= Ns Ar size 54.Op Fl Fl disallow-getting-krbtgt 55.Op Fl Fl detach 56.Op Fl h | Fl Fl help 57.Oo Fl k Ar principal \*(Ba Xo 58.Fl Fl system-principal= Ns Ar principal 59.Xc 60.Oc 61.Oo Fl l Ar time \*(Ba Xo 62.Fl Fl lifetime= Ns Ar time 63.Xc 64.Oc 65.Oo Fl m Ar mode \*(Ba Xo 66.Fl Fl mode= Ns Ar mode 67.Xc 68.Oc 69.Op Fl n | Fl Fl no-name-constraints 70.Oo Fl r Ar time \*(Ba Xo 71.Fl Fl renewable-life= Ns Ar time 72.Xc 73.Oc 74.Oo Fl s Ar path \*(Ba Xo 75.Fl Fl socket-path= Ns Ar path 76.Xc 77.Oc 78.Oo Xo 79.Fl Fl door-path= Ns Ar path 80.Xc 81.Oc 82.Oo Fl S Ar principal \*(Ba Xo 83.Fl Fl server= Ns Ar principal 84.Xc 85.Oc 86.Oo Fl t Ar keytab \*(Ba Xo 87.Fl Fl keytab= Ns Ar keytab 88.Xc 89.Oc 90.Oo Fl u Ar user \*(Ba Xo 91.Fl Fl user= Ns Ar user 92.Xc 93.Oc 94.Op Fl v | Fl Fl version 95.Sh DESCRIPTION 96.Nm 97is a process based credential cache. 98To use it, set the 99.Ev KRB5CCNAME 100environment variable to 101.Ql KCM: Ns Ar uid 102or add the stanza 103.Bd -literal 104 105[libdefaults] 106 default_cc_name = KCM:%{uid} 107 108.Ed 109to the 110.Pa /etc/krb5.conf 111configuration file and make sure 112.Nm kcm 113is started in the system startup files. 114.Pp 115The 116.Nm 117daemon can hold the credentials for all users in the system. Access 118control is done with Unix-like permissions. The daemon checks the 119access on all operations based on the uid and gid of the user. The 120tickets are renewed as long as is permitted by the KDC's policy. 121.Pp 122The 123.Nm 124daemon can also keep a SYSTEM credential that server processes can 125use to access services. One example of usage might be an nss_ldap 126module that quickly needs to get credentials and doesn't want to renew 127the ticket itself. 128.Pp 129Supported options: 130.Bl -tag -width Ds 131.It Fl Fl cache-name= Ns Ar cachename 132system cache name 133.It Fl c Ar file , Fl Fl config-file= Ns Ar file 134location of config file 135.It Fl g Ar group , Fl Fl group= Ns Ar group 136system cache group 137.It Fl Fl max-request= Ns Ar size 138max size for a kcm-request 139.It Fl Fl disallow-getting-krbtgt 140disallow extracting any krbtgt from the 141.Nm kcm 142daemon. 143.It Fl Fl detach 144detach from console 145.It Fl h , Fl Fl help 146.It Fl k Ar principal , Fl Fl system-principal= Ns Ar principal 147system principal name 148.It Fl l Ar time , Fl Fl lifetime= Ns Ar time 149lifetime of system tickets 150.It Fl m Ar mode , Fl Fl mode= Ns Ar mode 151octal mode of system cache 152.It Fl n , Fl Fl no-name-constraints 153disable credentials cache name constraints 154.It Fl r Ar time , Fl Fl renewable-life= Ns Ar time 155renewable lifetime of system tickets 156.It Fl s Ar path , Fl Fl socket-path= Ns Ar path 157path to kcm domain socket 158.It Fl Fl door-path= Ns Ar path 159path to kcm door socket 160.It Fl S Ar principal , Fl Fl server= Ns Ar principal 161server to get system ticket for 162.It Fl t Ar keytab , Fl Fl keytab= Ns Ar keytab 163system keytab name 164.It Fl u Ar user , Fl Fl user= Ns Ar user 165system cache owner 166.It Fl v , Fl Fl version 167.El 168.\".Sh ENVIRONMENT 169.\".Sh FILES 170.\".Sh EXAMPLES 171.\".Sh DIAGNOSTICS 172.\".Sh SEE ALSO 173.\".Sh STANDARDS 174.\".Sh HISTORY 175.\".Sh AUTHORS 176.\".Sh BUGS 177