1.\" $NetBSD: kinit.1,v 1.3 2014/04/24 13:45:34 pettai Exp $ 2.\" 3.\" Copyright (c) 1998 - 2003, 2006 Kungliga Tekniska Högskolan 4.\" (Royal Institute of Technology, Stockholm, Sweden). 5.\" All rights reserved. 6.\" 7.\" Redistribution and use in source and binary forms, with or without 8.\" modification, are permitted provided that the following conditions 9.\" are met: 10.\" 11.\" 1. Redistributions of source code must retain the above copyright 12.\" notice, this list of conditions and the following disclaimer. 13.\" 14.\" 2. Redistributions in binary form must reproduce the above copyright 15.\" notice, this list of conditions and the following disclaimer in the 16.\" documentation and/or other materials provided with the distribution. 17.\" 18.\" 3. Neither the name of the Institute nor the names of its contributors 19.\" may be used to endorse or promote products derived from this software 20.\" without specific prior written permission. 21.\" 22.\" THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 23.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 24.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 25.\" ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 26.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 27.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 28.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 29.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 30.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 31.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 32.\" SUCH DAMAGE. 33.\" 34.\" Id 35.\" 36.Dd April 25, 2006 37.Dt KINIT 1 38.Os 39.Sh NAME 40.Nm kinit 41.Nd acquire initial tickets 42.Sh SYNOPSIS 43.Nm kinit 44.Op Fl Fl afslog 45.Oo Fl c Ar cachename \*(Ba Xo 46.Fl Fl cache= Ns Ar cachename 47.Xc 48.Oc 49.Op Fl f | Fl Fl no-forwardable 50.Oo Fl t Ar keytabname \*(Ba Xo 51.Fl Fl keytab= Ns Ar keytabname 52.Xc 53.Oc 54.Oo Fl l Ar time \*(Ba Xo 55.Fl Fl lifetime= Ns Ar time 56.Xc 57.Oc 58.Op Fl p | Fl Fl proxiable 59.Op Fl R | Fl Fl renew 60.Op Fl Fl renewable 61.Oo Fl r Ar time \*(Ba Xo 62.Fl Fl renewable-life= Ns Ar time 63.Xc 64.Oc 65.Oo Fl S Ar principal \*(Ba Xo 66.Fl Fl server= Ns Ar principal 67.Xc 68.Oc 69.Oo Fl s Ar time \*(Ba Xo 70.Fl Fl start-time= Ns Ar time 71.Xc 72.Oc 73.Op Fl k | Fl Fl use-keytab 74.Op Fl v | Fl Fl validate 75.Oo Fl e Ar enctypes \*(Ba Xo 76.Fl Fl enctypes= Ns Ar enctypes 77.Xc 78.Oc 79.Oo Fl a Ar addresses \*(Ba Xo 80.Fl Fl extra-addresses= Ns Ar addresses 81.Xc 82.Oc 83.Op Fl Fl password-file= Ns Ar filename 84.Op Fl Fl fcache-version= Ns Ar version-number 85.Op Fl A | Fl Fl no-addresses 86.Op Fl Fl anonymous 87.Op Fl Fl enterprise 88.Op Fl Fl version 89.Op Fl Fl help 90.Op Ar principal Op Ar command 91.Sh DESCRIPTION 92.Nm 93is used to authenticate to the Kerberos server as 94.Ar principal , 95or if none is given, a system generated default (typically your login 96name at the default realm), and acquire a ticket granting ticket that 97can later be used to obtain tickets for other services. 98.Pp 99Supported options: 100.Bl -tag -width Ds 101.It Fl c Ar cachename Fl Fl cache= Ns Ar cachename 102The credentials cache to put the acquired ticket in, if other than 103default. 104.It Fl f Fl Fl no-forwardable 105Get ticket that can be forwarded to another host, or if the negative 106flags use, don't get a forwardable flag. 107.It Fl t Ar keytabname , Fl Fl keytab= Ns Ar keytabname 108Don't ask for a password, but instead get the key from the specified 109keytab. 110.It Fl l Ar time , Fl Fl lifetime= Ns Ar time 111Specifies the lifetime of the ticket. 112The argument can either be in seconds, or a more human readable string 113like 114.Sq 1h . 115.It Fl p , Fl Fl proxiable 116Request tickets with the proxiable flag set. 117.It Fl R , Fl Fl renew 118Try to renew ticket. 119The ticket must have the 120.Sq renewable 121flag set, and must not be expired. 122.It Fl Fl renewable 123The same as 124.Fl Fl renewable-life , 125with an infinite time. 126.It Fl r Ar time , Fl Fl renewable-life= Ns Ar time 127The max renewable ticket life. 128.It Fl S Ar principal , Fl Fl server= Ns Ar principal 129Get a ticket for a service other than krbtgt/LOCAL.REALM. 130.It Fl s Ar time , Fl Fl start-time= Ns Ar time 131Obtain a ticket that starts to be valid 132.Ar time 133(which can really be a generic time specification, like 134.Sq 1h ) 135seconds into the future. 136.It Fl k , Fl Fl use-keytab 137The same as 138.Fl Fl keytab , 139but with the default keytab name (normally 140.Ar FILE:/etc/krb5.keytab ) . 141.It Fl v , Fl Fl validate 142Try to validate an invalid ticket. 143.It Fl e , Fl Fl enctypes= Ns Ar enctypes 144Request tickets with this particular enctype. 145.It Fl Fl password-file= Ns Ar filename 146read the password from the first line of 147.Ar filename . 148If the 149.Ar filename 150is 151.Ar STDIN , 152the password will be read from the standard input. 153.It Fl Fl fcache-version= Ns Ar version-number 154Create a credentials cache of version 155.Ar version-number . 156.It Fl a , Fl Fl extra-addresses= Ns Ar enctypes 157Adds a set of addresses that will, in addition to the systems local 158addresses, be put in the ticket. 159This can be useful if all addresses a client can use can't be 160automatically figured out. 161One such example is if the client is behind a firewall. 162Also settable via 163.Li libdefaults/extra_addresses 164in 165.Xr krb5.conf 5 . 166.It Fl A , Fl Fl no-addresses 167Request a ticket with no addresses. 168.It Fl Fl anonymous 169Request an anonymous ticket (which means that the ticket will be 170issued to an anonymous principal, typically 171.Dq anonymous@REALM ) . 172.It Fl Fl enterprise 173Parse principal as a enterprise (KRB5-NT-ENTERPRISE) name. Enterprise 174names are email like principals that are stored in the name part of 175the principal, and since there are two @ characters the parser needs 176to know that the first is not a realm. 177An example of an enterprise name is 178.Dq lha@e.kth.se@KTH.SE , 179and this option is usually used with canonicalize so that the 180principal returned from the KDC will typically be the real principal 181name. 182.It Fl Fl afslog 183Gets AFS tickets, converts them to version 4 format, and stores them 184in the kernel. 185Only useful if you have AFS. 186.El 187.Pp 188The 189.Ar forwardable , 190.Ar proxiable , 191.Ar ticket_life , 192and 193.Ar renewable_life 194options can be set to a default value from the 195.Dv appdefaults 196section in krb5.conf, see 197.Xr krb5_appdefault 3 . 198.Pp 199If a 200.Ar command 201is given, 202.Nm 203will set up new credentials caches, and AFS PAG, and then run the given 204command. 205When it finishes the credentials will be removed. 206.Sh ENVIRONMENT 207.Bl -tag -width Ds 208.It Ev KRB5CCNAME 209Specifies the default credentials cache. 210.It Ev KRB5_CONFIG 211The file name of 212.Pa krb5.conf , 213the default being 214.Pa /etc/krb5.conf . 215.It Ev KRBTKFILE 216Specifies the Kerberos 4 ticket file to store version 4 tickets in. 217.El 218.\".Sh FILES 219.\".Sh EXAMPLES 220.\".Sh DIAGNOSTICS 221.Sh SEE ALSO 222.Xr kdestroy 1 , 223.Xr klist 1 , 224.Xr krb5_appdefault 3 , 225.Xr krb5.conf 5 226.\".Sh STANDARDS 227.\".Sh HISTORY 228.\".Sh AUTHORS 229.\".Sh BUGS 230