1 .\" Copyright (c) 1998 - 2002 Kungliga Tekniska Högskolan
2 .\" (Royal Institute of Technology, Stockholm, Sweden).
3 .\" All rights reserved.
5 .\" Redistribution and use in source and binary forms, with or without
6 .\" modification, are permitted provided that the following conditions
9 .\" 1. Redistributions of source code must retain the above copyright
10 .\" notice, this list of conditions and the following disclaimer.
12 .\" 2. Redistributions in binary form must reproduce the above copyright
13 .\" notice, this list of conditions and the following disclaimer in the
14 .\" documentation and/or other materials provided with the distribution.
16 .\" 3. Neither the name of the Institute nor the names of its contributors
17 .\" may be used to endorse or promote products derived from this software
18 .\" without specific prior written permission.
20 .\" THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
21 .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23 .\" ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
24 .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25 .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26 .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27 .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28 .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32 .\" $Id: kinit.1,v 1.23 2003/04/06 17:49:05 lha Exp $
40 .Nd acquire initial tickets
43 .Op Fl 4 | Fl -524init
44 .Op Fl 9 | Fl -524convert
46 .Oo Fl c Ar cachename \*(Ba Xo
47 .Fl -cache= Ns Ar cachename
50 .Op Fl f | Fl -forwardable
51 .Oo Fl t Ar keytabname \*(Ba Xo
52 .Fl -keytab= Ns Ar keytabname
55 .Oo Fl l Ar time \*(Ba Xo
56 .Fl -lifetime= Ns Ar time
59 .Op Fl p | Fl -proxiable
62 .Oo Fl r Ar time \*(Ba Xo
63 .Fl -renewable-life= Ns Ar time
66 .Oo Fl S Ar principal \*(Ba Xo
67 .Fl -server= Ns Ar principal
70 .Oo Fl s Ar time \*(Ba Xo
71 .Fl -start-time= Ns Ar time
74 .Op Fl k | Fl -use-keytab
75 .Op Fl v | Fl -validate
76 .Oo Fl e Ar enctypes \*(Ba Xo
77 .Fl -enctypes= Ns Ar enctypes
80 .Oo Fl a Ar addresses \*(Ba Xo
81 .Fl -extra-addresses= Ns Ar addresses
84 .Op Fl -fcache-version= Ns Ar integer
89 .Op Ar principal Op Ar command
92 is used to authenticate to the Kerberos server as
94 or if none is given, a system generated default (typically your login
95 name at the default realm), and acquire a ticket granting ticket that
96 can later be used to obtain tickets for other services.
100 with Kerberos 4 support and you have a
103 will detect this and get you Kerberos 4 tickets.
109 .Fl -cache= Ns Ar cachename
111 The credentials cache to put the acquired ticket in, if other than
117 Get ticket that can be forwarded to another host.
119 .Fl t Ar keytabname ,
120 .Fl -keytab= Ns Ar keytabname
122 Don't ask for a password, but instead get the key from the specified
126 .Fl -lifetime= Ns Ar time
128 Specifies the lifetime of the ticket. The argument can either be in
129 seconds, or a more human readable string like
135 Request tickets with the proxiable flag set.
140 Try to renew ticket. The ticket must have the
142 flag set, and must not be expired.
145 .Fl -renewable-life ,
146 with an infinite time.
149 .Fl -renewable-life= Ns Ar time
151 The max renewable ticket life.
154 .Fl -server= Ns Ar principal
156 Get a ticket for a service other than krbtgt/LOCAL.REALM.
159 .Fl -start-time= Ns Ar time
161 Obtain a ticket that starts to be valid
163 (which can really be a generic time specification, like
165 seconds into the future.
172 but with the default keytab name (normally
173 .Ar FILE:/etc/krb5.keytab ) .
178 Try to validate an invalid ticket.
181 .Fl -enctypes= Ns Ar enctypes
183 Request tickets with this particular enctype.
185 .Fl -fcache-version= Ns Ar version
187 Create a credentials cache of version
191 .Fl -extra-addresses= Ns Ar enctypes
193 Adds a set of addresses that will, in addition to the systems local
194 addresses, be put in the ticket. This can be useful if all addresses a
195 client can use can't be automatically figured out. One such example is
196 if the client is behind a firewall. Also settable via
197 .Li libdefaults/extra_addresses
203 Request a ticket with no addresses.
207 Request an anonymous ticket (which means that the ticket will be
208 issued to an anonymous principal, typically
209 .Dq anonymous@REALM ) .
212 The following options are only available if
214 has been compiled with support for Kerberos 4.
220 Try to convert the obtained Kerberos 5 krbtgt to a version 4
221 compatible ticket. It will store this ticket in the default Kerberos 4
227 only convert ticket to version 4
229 Gets AFS tickets, converts them to version 4 format, and stores them
230 in the kernel. Only useful if you have AFS.
239 options can be set to a default value from the
241 section in krb5.conf, see
242 .Xr krb5_appdefault 3 .
248 will setup new credentials caches, and AFS PAG, and then run the given
249 command. When it finishes the credentials will be removed.
253 Specifies the default credentials cache.
260 Specifies the Kerberos 4 ticket file to store version 4 tickets in.
268 .Xr krb5_appdefault 3 ,