diff options
| -rw-r--r-- | eBones/usr.bin/rkinit/Makefile | 11 | ||||
| -rw-r--r-- | eBones/usr.bin/rkinit/rkinit.1 | 206 | ||||
| -rw-r--r-- | eBones/usr.bin/rkinit/rkinit.c | 216 |
3 files changed, 433 insertions, 0 deletions
diff --git a/eBones/usr.bin/rkinit/Makefile b/eBones/usr.bin/rkinit/Makefile new file mode 100644 index 0000000..b910742 --- /dev/null +++ b/eBones/usr.bin/rkinit/Makefile @@ -0,0 +1,11 @@ +# Makefile,v 1.2 1995/01/20 22:08:14 wollman Exp + +PROG= rkinit +SRCS= ${RKINITOBJDIR}/rkinit_err.h rkinit.c +CFLAGS+= -I${KRBOBJDIR} -I${RKINITOBJDIR} +LDADD+= -L${RKINITOBJDIR} -lrkinit -L${KRBOBJDIR} -lkrb -L${DESOBJDIR} -ldes +LDADD+= -lss -lcom_err + +MAN1= rkinit.1 + +.include <bsd.prog.mk> diff --git a/eBones/usr.bin/rkinit/rkinit.1 b/eBones/usr.bin/rkinit/rkinit.1 new file mode 100644 index 0000000..5634d2b --- /dev/null +++ b/eBones/usr.bin/rkinit/rkinit.1 @@ -0,0 +1,206 @@ +.\" +.\" $Header: /local/cvsfiles/kerberos/src/appl/rkinit/man/rkinit.1,v 1.1 1991/12/03 23:21:25 eichin Exp $ +.\" $Source: /local/cvsfiles/kerberos/src/appl/rkinit/man/rkinit.1,v $ +.\" $Author: eichin $ +.\" +.\" +.TH RKINIT 1 "November 12, 1989" +.UC 4 +.SH NAME +rkinit \- establish kerberos tickets safely on a remote host +.SH SYNOPSIS +.B rkinit [ host ] +[ -p +.B principal +] [ -l +.B username +] [ -k +.B kerberos_realm +] [ -f +.B ticket_file +] [ -h +.B remote_host +] [ -t +.B ticket_lifetime +] [ +.B \-notimeout +] + +A host name must be specified either as the first command line +argument or following a \-h flag. If redundant command line +arguments are given, the last one to appear takes precedence. + +.SH DESCRIPTION +.I rkinit +is a program that allows a user to establish kerberos tickets on +a remote host registered for +rlogin service. This can be done without the user's kerberos +password ever leaving the client machine. + +In order to establish tickets remotely +without the use of something like +.I rkinit, +one would have to log in to the +remote host and run +.IR kinit (1). +.I rkinit +followed by +.I rlogin +can be thought of as a safe substitute for +.I rlogin +followed +.I kinit. + +.I rkinit +uses the same access checking mechanism as +.I rlogin. +That means that +.I rkinit +can be used to create any tickets for user +.I A +on remote host +.I B +if and only if +.IR A 's +tickets would entitle a login to +.I B. +This means that one can create remote tickets for himself or for +another user if he is in that user's .klogin file. + +.I rkinit +understands the following command line options: + +.TP 4 +.B \-p \fIprincipal\fR +If +.I principal, +in the format +.I name[.inst][@realm] +is specified, the tickets created on the remote host will be the +tickets indicated by the +.I principal +field. If this option is not given, the following defaults are +used: If the user running +.I rkinit +does not have tickets on the client machine, +.I rkinit +will prompt for a password and behave effectively as if the user +had invoked +.I kinit +on the specified +remote host; i.e., +the tickets established will be owned on the remote host +by the user who invoked +.I rkinit +and will be for the local realm of the +remote host. +If the user running +.I rkinit +already has tickets, +.I rkinit +will prompt for a password and create tickets whose principal +matches that of the +tickets that the user already has. + + +.TP +.B \-l \fIusername\fR +If +.I username +is specified, the ticket file on the remote host will be owned by the +user +.I username. +If it is not specified, the tickets will be owned by +the remote user whose login name matches that of the user invoking +.I rkinit. + +.TP +.B \-r \fIrealm\fR +.I realm +is used to tell +.I rkinit +what realm the remote host is in. This +option should not usually have to be used since +.I rkinit +uses +.IR krb_realmofhost (3) +to determine the remote host's kerberos realm. Note that this +is distinct from realm as specified in +.I principal, +which refers to the realm of the remote tickets. + +.TP +.B \-f \fIticket_file\fR +This option is used to specify the name of the ticket file that +should be used on the remote host. Note that if you +specify a location for the ticket file that is other +than the default, you will have to set the environment variable +KRBTKFILE to that filename once you get to the remote host in +order for you to use the tickets. +If a ticket file is not specified, the tickets will +be placed in the +default location as specified by +.IR tkt_file (3). +On a UNIX host, this is /tmp/tkt<uid>, where +<uid> is the user id of the person who owns the remote ticket file. + +.TP +.B \-h \fIremote_host\fR +.I remote host +is the host on which remote tickets are being obtained. This +option can be used in place of specifying the host as the first +command line argument. + +.TP +.B \-t \fIticket_lifetime\fR +.I ticket lifetime +is the lifetime in minutes of the remote tickets. If it is not +specified, the default ticket life time (as defined in krb.h) is +used. + +.TP +.B \-notimeout +prevents the client from timing out. This is mainly useful only +for debugging since the rkinit server also times out. + +.SH EXAMPLES + +In the following examples, +.B tabetha +and +.B soup +are machines in the +.B ATHENA.MIT.EDU +kerberos realm and +.B local +is a user who can log in +to +.B soup +and has +.B qjb.root@ATHENA.MIT.EDU +in his .klogin file. + + +% rkinit tabetha +.br +Kerberos initialization (tabetha) +.br +Password for qjb@ATHENA.MIT.EDU: +.br +% +.br + +.br +% rkinit soup -p qjb.root -l local +.br +Kerberos initialization (soup): tickets will be owned by local +.br +Password for qjb.root@ATHENA.MIT.EDU: +.br +% + +.SH SEE ALSO +rkinitd(8), kerberos(1), kerberos(3), kinit(1) + +.SH AUTHOR +Emanuel Jay Berkenbilt (MIT-Project Athena) diff --git a/eBones/usr.bin/rkinit/rkinit.c b/eBones/usr.bin/rkinit/rkinit.c new file mode 100644 index 0000000..35a0eeb --- /dev/null +++ b/eBones/usr.bin/rkinit/rkinit.c @@ -0,0 +1,216 @@ +/* + * $Id: rkinit.c,v 1.1 1993/12/10 18:41:00 dglo Exp gibbs $ + * $Source: /usr/src/eBones/rkinit/RCS/rkinit.c,v $ + * $Author: dglo $ + * + * This is an rkinit client + */ + +#if !defined(lint) && !defined(SABER) && !defined(LOCORE) && defined(RCS_HDRS) +static char *rcsid = "$Id: rkinit.c,v 1.1 1993/12/10 18:41:00 dglo Exp gibbs $"; +#endif /* lint || SABER || LOCORE || RCS_HDRS */ + +#include <stdio.h> +#include <stdlib.h> +#include <string.h> +#include <unistd.h> +#include <sys/types.h> +#include <netdb.h> +#include <pwd.h> +#include <krb.h> +#include <des.h> +#include <com_err.h> + +#include <rkinit.h> +#include <rkinit_err.h> + +#ifndef TRUE +#define TRUE 1 +#endif + +#ifndef FALSE +#define FALSE 0 +#endif + +#ifdef __STDC__ +static void usage(void) +#else +static void usage() +#endif /* __STDC__ */ +{ + fprintf(stderr,"Usage: rkinit [host] options\n"); + fprintf(stderr, + "Options: [-l username] [-k krb_realm] [-p principal] [-f tktfile]\n"); + fprintf(stderr, " [-t lifetime] [-h host] [-notimeout]\n"); + fprintf(stderr, "A host must be specified either with the -h option "); + fprintf(stderr, "or as the first argument.\n"); + + exit(1); +} + +int +#ifdef __STDC__ +main(int argc, char *argv[]) +#else +main(argc, argv) + int argc; + char *argv[]; +#endif /* __STDC__ */ +{ + char *whoami; /* Name of this program */ + + char principal[MAX_K_NAME_SZ]; /* Principal for which to get tickets */ + char *host = NULL; /* Remote host */ + char *username = 0; /* Username of owner of ticket */ + char r_krealm[REALM_SZ]; /* Kerberos realm of remote host */ + char aname[ANAME_SZ]; /* Aname of remote ticket file */ + char inst[INST_SZ]; /* Instance of remote ticket file */ + char realm[REALM_SZ]; /* Realm of remote ticket file */ + char *tktfilename = NULL; /* Name of ticket file on remote host */ + u_long lifetime = DEFAULT_TKT_LIFE; /* Lifetime of remote tickets */ + int timeout = TRUE; /* Should we time out? */ + rkinit_info info; /* Information needed by rkinit */ + + struct passwd *localid; /* To determine local id */ + + int status = 0; /* general error number */ + + int i; + + bzero(r_krealm, sizeof(r_krealm)); + bzero(principal, sizeof(principal)); + bzero(aname, sizeof(aname)); + bzero(inst, sizeof(inst)); + bzero(realm, sizeof(realm)); + + /* Parse commandline arguements. */ + if ((whoami = rindex(argv[0], '/')) == 0) + whoami = argv[0]; + else + whoami++; + + if (argc < 2) usage(); + + if (argv[1][0] != '-') { + host = argv[1]; + i = 2; + } + else + i = 1; + + for (/* i initialized above */; i < argc; i++) { + if (strcmp(argv[i], "-h") == NULL) { + if (++i >= argc) + usage(); + else + host = argv[i]; + } + else if (strcmp(argv[i], "-l") == NULL) { + if (++i >= argc) + usage(); + else + username = argv[i]; + } + else if (strcmp(argv[i], "-k") == NULL) { + if (++i >= argc) + usage(); + else + strncpy(r_krealm, argv[i], sizeof(r_krealm) - 1); + } + else if (strcmp(argv[i], "-p") == NULL) { + if (++i >= argc) + usage(); + else + strncpy(principal, argv[i], sizeof(principal) - 1); + } + else if (strcmp(argv[i], "-f") == NULL) { + if (++i >= argc) + usage(); + else + tktfilename = argv[i]; + } + else if (strcmp(argv[i], "-t") == NULL) { + if (++i >= argc) + usage(); + else { + lifetime = atoi(argv[i])/5; + if (lifetime == 0) + lifetime = 1; + else if (lifetime > 255) + lifetime = 255; + } + } + else if (strcmp(argv[i], "-notimeout") == NULL) + timeout = FALSE; + else + usage(); + } + + if (host == NULL) + usage(); + + /* Initialize the realm of the remote host if necessary */ + if (r_krealm[0] == 0) { + /* + * Try to figure out the realm of the remote host. If the + * remote host is unknown, don't worry about it; the library + * will handle the error better and print a good error message. + */ + struct hostent *hp; + if ((hp = gethostbyname(host))) + strcpy(r_krealm, krb_realmofhost(hp->h_name)); + } + + /* If no username was specified, use local id on client host */ + if (username == 0) { + if ((localid = getpwuid(getuid())) == 0) { + fprintf(stderr, "You can not be found in the password file.\n"); + exit(1); + } + username = localid->pw_name; + } + + /* Find out who will go in the ticket file */ + if (! principal[0]) { + if ((status = krb_get_tf_fullname(TKT_FILE, aname, inst, realm)) + != KSUCCESS) { + /* + * If user has no ticket file and principal was not specified, + * we will try to get tickets for username@remote_realm + */ + strcpy(aname, username); + strcpy(realm, r_krealm); + } + } + else { + if ((status = kname_parse(aname, inst, realm, principal)) + != KSUCCESS) { + fprintf(stderr, "%s\n", krb_err_txt[status]); + exit(1); + } + if (strlen(realm) == 0) { + if (krb_get_lrealm(realm, 1) != KSUCCESS) + strcpy(realm, KRB_REALM); + } + } + + bzero((char *)&info, sizeof(info)); + + strcpy(info.aname, aname); + strcpy(info.inst, inst); + strcpy(info.realm, realm); + strcpy(info.sname, "krbtgt"); + strcpy(info.sinst, realm); + strncpy(info.username, username, sizeof(info.username) - 1); + if (tktfilename) + strncpy(info.tktfilename, tktfilename, sizeof(info.tktfilename) - 1); + info.lifetime = lifetime; + + if ((status = rkinit(host, r_krealm, &info, timeout))) { + com_err(whoami, status, "while obtaining remote tickets:"); + fprintf(stderr, "%s\n", rkinit_errmsg(0)); + exit(1); + } + + exit(0); +} |
