1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
|
.\" $Id: kinit.1,v 1.8 2001/01/28 21:44:56 assar Exp $
.\"
.Dd May 29, 1998
.Dt KINIT 1
.Os HEIMDAL
.Sh NAME
.Nm kinit ,
.Nm kauth
.Nd acquire initial tickets
.Sh SYNOPSIS
.Nm kinit
.Op Fl 4 | Fl -524init
.Op Fl -afslog
.Oo Fl c Ar cachename \*(Ba Xo
.Fl -cache= Ns Ar cachename Oc
.Xc
.Op Fl f | Fl -forwardable
.Oo Fl t Ar keytabname \*(Ba Xo
.Fl -keytab= Ns Ar keytabname Oc
.Xc
.Oo Fl l Ar time \*(Ba Xo
.Fl -lifetime= Ns Ar time Oc
.Xc
.Op Fl p | Fl -proxiable
.Op Fl R | Fl -renew
.Op Fl -renewable
.Oo Fl r Ar time \*(Ba Xo
.Fl -renewable-life= Ns Ar time Oc
.Xc
.Oo Fl S Ar principal \*(Ba Xo
.Fl -server= Ns Ar principal Oc
.Xc
.Oo Fl s Ar time \*(Ba Xo
.Fl -start-time= Ns Ar time Oc
.Xc
.Op Fl k | Fl -use-keytab
.Op Fl v | Fl -validate
.Oo Fl e Ar enctype \*(Ba Xo
.Fl -enctypes= Ns Ar enctype Oc
.Xc
.Op Fl -fcache-version= Ns Ar integer
.Op Fl -no-addresses
.Op Fl -anonymous
.Op Fl -version
.Op Fl -help
.Op Ar principal
.Sh DESCRIPTION
.Nm
is used to authenticate to the kerberos server as
.Ar principal ,
or if none is given, a system generated default (typically your login
name at the default realm), and acquire a ticket granting ticket that
can later be used to obtain tickets for other services.
.Pp
If you have compiled kinit with Kerberos 4 support and you have a
Kerberos 4 server,
.Nm
will detect this and get you Kerberos 4 tickets.
.Pp
Supported options:
.Bl -tag -width Ds
.It Xo
.Fl c Ar cachename
.Fl -cache= Ns Ar cachename
.Xc
The credentials cache to put the acquired ticket in, if other than
default.
.It Xo
.Fl f Ns ,
.Fl -forwardable
.Xc
Get ticket that can be forwarded to another host.
.It Xo
.Fl t Ar keytabname Ns ,
.Fl -keytab= Ns Ar keytabname
.Xc
Don't ask for a password, but instead get the key from the specified
keytab.
.It Xo
.Fl l Ar time Ns ,
.Fl -lifetime= Ns Ar time
.Xc
Specifies the lifetime of the ticket. The argument can either be in
seconds, or a more human readable string like
.Sq 1h .
.It Xo
.Fl p Ns ,
.Fl -proxiable
.Xc
Request tickets with the proxiable flag set.
.It Xo
.Fl R Ns ,
.Fl -renew
.Xc
Try to renew ticket. The ticket must have the
.Sq renewable
flag set, and must not be expired.
.It Fl -renewable
The same as
.Fl -renewable-life ,
with an infinite time.
.It Xo
.Fl r Ar time Ns ,
.Fl -renewable-life= Ns Ar time
.Xc
The max renewable ticket life.
.It Xo
.Fl S Ar principal Ns ,
.Fl -server= Ns Ar principal
.Xc
Get a ticket for a service other than krbtgt/LOCAL.REALM.
.It Xo
.Fl s Ar time Ns ,
.Fl -start-time= Ns Ar time
.Xc
Obtain a ticket that starts to be valid
.Ar time
(which can really be a generic time specification, like
.Sq 1h )
seconds into the future.
.It Xo
.Fl k Ns ,
.Fl -use-keytab
.Xc
The same as
.Fl -keytab ,
but with the default keytab name (normally
.Ar FILE:/etc/krb5.keytab ) .
.It Xo
.Fl v Ns ,
.Fl -validate
.Xc
Try to validate an invalid ticket.
.It Xo
.Fl e ,
.Fl -enctypes= Ns Ar enctypes
.Xc
Request tickets with this particular enctype.
.It Xo
.Fl -fcache-version= Ns Ar version
.Xc
Create a credentials cache of version
.Nm version .
.It Xo
.Fl -no-addresses
.Xc
Request a ticket with no addresses.
.It Xo
.Fl -anonymous
.Xc
Request an anonymous ticket (which means that the ticket will be
issued to an anonymous principal, typically
.Dq anonymous@REALM).
.El
.Pp
The following options are only available if
.Nm
has been compiled with support for Kerberos 4. The
.Nm kauth
program is identical to
.Nm kinit ,
but has these options enabled by
default.
.Bl -tag -width Ds
.It Xo
.Fl 4 Ns ,
.Fl -524init
.Xc
Try to convert the obtained Kerberos 5 krbtgt to a version 4 compatible
ticket. It will store this ticket in the default Kerberos 4 ticket
file.
.It Fl -afslog
Gets AFS tickets, converts them to version 4 format, and stores them
in the kernel. Only useful if you have AFS.
.El
.Pp
The
.Ar forwardable ,
.Ar proxiable ,
.Ar ticket_life ,
and
.Ar renewable_life
options can be set to a default value from the
.Dv appdefaults
section in krb5.conf, see
.Xr krb5_appdefault 3 .
.Sh ENVIRONMENT
.Bl -tag -width Ds
.It Ev KRB5CCNAME
Specifies the default cache file.
.It Ev KRB5_CONFIG
The directory where the
.Pa krb5.conf
can be found, default is
.Pa /etc .
.It Ev KRBTKFILE
Specifies the Kerberos 4 ticket file to store version 4 tickets in.
.El
.\".Sh FILES
.\".Sh EXAMPLES
.\".Sh DIAGNOSTICS
.Sh SEE ALSO
.Xr kdestroy 1 ,
.Xr klist 1 ,
.Xr krb5.conf 5 ,
.Xr krb5_appdefault 3
.\".Sh STANDARDS
.\".Sh HISTORY
.\".Sh AUTHORS
.\".Sh BUGS
|
