     [file definitions.texinfo not included]

This file describes how to use the PRODUCT client programs.

Copyright
*********

     [file copyright.texinfo not included]

Introduction
************

Kerberos is named for the three-headed watchdog from Greek mythology, who guarded the entrance to the underworld.

Under Kerberos, a client (generally either a user or a service) sends a request for a ticket to the Key Distribution Center (KDC).  The KDC creates a ticket-granting ticket (TGT) for the client, encrypts it using the client's password as the key, and sends the encrypted TGT back to the client.  The client then attempts to decrypt the TGT, using its password.  If the client successfully decrypts the TGT (i.e., if the client gave the correct password), it keeps the decrypted TGT, which indicates proof of the client's identity.

The TGT, which expires at a specified time, permits the client to obtain additional tickets, which give permission for specific services.  The requesting and granting of these additional tickets is user-transparent.

Since Kerberos negotiates authenticated, and optionally encrypted, communications between two points anywhere on the internet, it provides a layer of security that is not dependent on which side of a firewall either client is on.  Since studies have shown that half of the computer security breaches in industry happen from inside firewalls, COMPANY's PRODUCT plays a vital role in maintaining your network security.

The PRODUCT package is designed to be easy to use.  Most of the commands are nearly identical to UNIX network programs you already use.  PRODUCT is a single-sign-on system, which means that you have to type your password only once per session, and Kerberos does the authenticating and encrypting transparently.

What is a Ticket?
=================

Your Kerberos credentials, or ``tickets'', are a set of electronic information that can be used to verify your identity.  Your Kerberos tickets may be stored in a file, or they may exist only in memory.

The first ticket you obtain is a ticket-granting ticket, which permits you to obtain additional tickets.  These additional tickets give you permission for specific services.  The requesting and granting of these additional tickets happens transparently.

A good analogy for the ticket-granting ticket is a three-day ski pass that is good at four different resorts.  You show the pass at whichever resort you decide to go to (until it expires), and you receive a lift ticket for that resort.  Once you have the lift ticket, you can ski all you want at that resort.  If you go to another resort the next day, you once again show your pass, and you get an additional lift ticket for the new resort.  The difference is that the PRODUCT programs notice that you have the weekend ski pass, and get the lift ticket for you, so you don't have to perform the transactions yourself.

What is a Kerberos Principal?
=============================

A Kerberos principal is a unique identity to which Kerberos can assign tickets.  Principals can have an arbitrary number of components.  Each component is separated by a component separator, generally `/'.  The last component is the realm, separated from the rest of the principal by the realm separator, generally `@'.  If there is no realm component in the principal, then it will be assumed that the principal is in the default realm for the context in which it is being used.

Traditionally, a principal is divided into three parts:  the primary, the instance, and the realm.  The format of a typical Kerberos V5 principal is primary/instance@REALM.

  * The primary is the first part of the principal.  In the case of a user, it's the same as your username.  For a host, the primary is the word host.

  * The instance is an optional string that qualifies the primary.  The instance is separated from the primary by a slash (/).  In the case of a user, the instance is usually null, but a user might also have an additional principal, with an instance called admin, which he/she uses to administrate a database.  The principal RANDOMUSER1@PRIMARYREALM is completely separate from the principal RANDOMUSER1/admin@PRIMARYREALM, with a separate password, and separate permissions.  In the case of a host, the instance is the fully qualified hostname, e.g., RANDOMHOST1.PRIMARYDOMAIN.

  * The realm is your Kerberos realm.  In most cases, your Kerberos realm is your domain name, in upper-case letters.  For example, the machine RANDOMHOST1.SECONDDOMAIN would be in the realm SECONDREALM.

Kerberos V5 Tutorial
********************

This tutorial is intended to familiarize you with the PRODUCT client programs.  We will represent your prompt as ``shell%''. So an instruction to type the ``ls'' command would be represented as follows:

     shell% ls

In these examples, we will use sample usernames, such as RANDOMUSER1 and RANDOMUSER2, sample hostnames, such as RANDOMHOST1 and RANDOMHOST2, and sample domain names, such as PRIMARYDOMAIN and SECONDDOMAIN.  When you see one of these, substitute your username, hostname, or domain name accordingly.

Setting Up to Use PRODUCT
=========================

Your system administrator will have installed the PRODUCT programs in whichever directory makes the most sense for your system. We will use ROOTDIR throughout this guide to refer to the top-level directory PRODUCT directory.  We will therefor use BINDIR to denote the location of the PRODUCT user programs.  In your installation, the directory name may be different, but whatever the directory name is, you should make sure it is included in your path.  You will probably want to put it ahead of the directories /bin and /usr/bin so you will get the PRODUCT network programs, rather than the standard UNIX versions, when you type their command names.

Ticket Management
=================

On many systems, Kerberos is built into the login program, and you get tickets automatically when you log in.  Other programs, such as rsh, rcp, telnet, and rlogin, can forward copies of your tickets to the remote host.  Most of these programs also automatically destroy your tickets when they exit.  However, COMPANY recommends that you explicitly destroy your Kerberos tickets when you are through with them, just to be sure.  One way to help ensure that this happens is to add the kdestroy command to your .logout file.  Additionally, if you are going to be away from your machine and are concerned about an intruder using your permissions, it is safest to either destroy all copies of your tickets, or use a screensaver that locks the screen.

Kerberos Ticket Properties
--------------------------

There are various properties that Kerberos tickets can have:

If a ticket is forwardable, then the KDC can issue a new ticket with a different network address based on the forwardable ticket.  This allows for authentication forwarding without requiring a password to be typed in again.  For example, if a user with a forwardable TGT logs into a remote system, the KDC could issue a new TGT for that user with the netword address of the remote system, allowing authentication on that host to work as though the user were logged in locally.

When the KDC creates a new ticket based on a forwardable ticket, it sets the forwarded flag on that new ticket.  Any tickets that are created based on a ticket with the forwarded flag set will also have their forwarded flags set.

A proxiable ticket is similar to a forwardable ticket in that it allows a service to take on the identity of the client.  Unlike a forwardable ticket, however, a proxiable ticket is only issued for specific services.  In other words, a ticket-granting ticket cannot be issued based on a ticket that is proxiable but not forwardable.

A proxy ticket is one that was issued based on a proxiable ticket.

A postdated ticket is issued with the invalid flag set. After the starting time listed on the ticket, it can be presented to the KDC to obtain valid tickets.

Tickets with the postdateable flag set can be used to issue postdated tickets.

Renewable tickets can be used to obtain new session keys without the user entering their password again.  A renewable ticket has two expiration times.  The first is the time at which this particular ticket expires.  The second is the latest possible expiration time for any ticket issued based on this renewable ticket.

A ticket with the initial flag set was issued based on the authentication protocol, and not on a ticket-granting ticket.   Clients that wish to ensure that the user's key has been recently presented for verification could specify that this flag must be set to accept the ticket.

An invalid ticket must be rejected by application servers.  Postdated tickets are usually issued with this flag set, and must be validated by the KDC before they can be used.

A preauthenticated ticket is one that was only issued after the client requesting the ticket had authenticated itself to the KDC.

The hardware authentication flag is set on a ticket which required the use of hardware for authentication.  The hardware is expected to be possessed only by the client which requested the tickets.

If a ticket has the transit policy checked flag set, then the KDC that issued this ticket implements the transited-realm check policy and checked the transited-realms list on the ticket.  The transited-realms list contains a list of all intermediate realms between the realm of the KDC that issued the first ticket and that of the one that issued the current ticket.  If this flag is not set, then the application server must check the transited realms itself or else reject the ticket.

The okay as delegate flag indicates that the server specified in the ticket is suitable as a delegate as determined by the policy of that realm.  A server that is acting as a delegate has been granted a proxy or a forwarded TGT.  This flag is a new addition to the PRODUCT protocol and is not yet implemented on MIT servers.

An anonymous  ticket is one in which the named principal is a generic principal for that realm; it does not actually specify the individual that will be using the ticket.  This ticket is meant only to securely distribute a session key.  This is a new addition to the PRODUCT protocol and is not yet implemented on MIT servers.

Obtaining Tickets with kinit
----------------------------

If your site is using the PRODUCT login program, you will get Kerberos tickets automatically when you log in.  If your site uses a different login program, you may need to explicitly obtain your Kerberos tickets, using the kinit program.  Similarly, if your Kerberos tickets expire, use the kinit program to obtain new ones.

To use the kinit program, simply type kinit and then type your password at the prompt.  For example, Jennifer (whose username is RANDOMUSER1) works for Bleep, Inc. (a fictitious company with the domain name PRIMARYDOMAIN and the Kerberos realm PRIMARYREALM).  She would type:

     shell% kinit
     Password for RANDOMUSER1@PRIMARYREALM: <-- [Type RANDOMUSER1's password here.]
     shell%

If you type your password incorrectly, kinit will give you the following error message:

     shell% kinit
     Password for RANDOMUSER1@PRIMARYREALM: <-- [Type the wrong password here.]
     kinit: Password incorrect
     shell%

and you won't get Kerberos tickets.

Notice that kinit assumes you want tickets for your own username in your default realm. Suppose Jennifer's friend David is visiting, and he wants to borrow a window to check his mail.  David needs to get tickets for himself in his own realm, SECONDREALM. (Note:  the realm
SECONDREALM must be listed in your computer's Kerberos
configuration file, /etc/krb5.conf.)  He would type:

     shell% kinit RANDOMUSER2@SECONDREALM
     Password for RANDOMUSER2@SECONDREALM: <-- [Type RANDOMUSER2's password here.]
     shell%

David would then have tickets which he could use to log onto his own machine.  Note that he typed his password locally on Jennifer's machine, but it never went over the network.  Kerberos on the local host performed the authentication to the KDC in the other realm.

If you want to be able to forward your tickets to another host, you need to request forwardable tickets.  You do this by specifying the -f option:

     shell% kinit -f
     Password for RANDOMUSER1@PRIMARYREALM: <-- [Type your password here.]
     shell%

Note that kinit does not tell you that it obtained forwardable tickets; you can verify this using the klist command (see Viewing Your Tickets with klist).

Normally, your tickets are good for your system's default ticket lifetime, which is ten hours on many systems.  You can specify a different ticket lifetime with the -l option.  Add the letter s to the value for seconds, m for minutes, h for hours, or d for days. For example, to obtain forwardable tickets for RANDOMUSER2@SECONDREALM that would be good for three hours, you would type:

     shell% kinit -f -l 3h RANDOMUSER2@SECONDREALM
     Password for RANDOMUSER2@SECONDREALM: <-- [Type RANDOMUSER2's password here.]
     shell%

You cannot mix units; specifying a lifetime of 3h30m would result in an error.  Note also that most systems specify a maximum ticket lifetime.  If you request a longer ticket lifetime, it will be automatically truncated to the maximum lifetime.

Viewing Your Tickets with klist
-------------------------------

The klist command shows your tickets.  When you first obtain tickets, you will have only the ticket-granting ticket.  (see What is a Ticket?.)  The listing would look like this:

     shell% klist
     Ticket cache: /tmp/krb5cc_ttypa
     Default principal: RANDOMUSER1@PRIMARYREALM

     Valid starting     Expires            Service principal
     06/07/04 19:49:21  06/08/04 05:49:19  krbtgt/PRIMARYREALM@PRIMARYREALM
     shell%

The ticket cache is the location of your ticket file.  In the above example, this file is named /tmp/krb5cc_ttypa.  The default principal is your kerberos principal.  (see What is a Kerberos Principal?)

The ``valid starting'' and ``expires'' fields describe the period of time during which the ticket is valid.  The service principal describes each ticket.  The ticket-granting ticket has the primary krbtgt, and the instance is the realm name.

Now, if RANDOMUSER1 connected to the machine RANDOMHOST1.PRIMARYDOMAIN, and then typed klist again, she would have gotten the following result:

     shell% klist
     Ticket cache: /tmp/krb5cc_ttypa
     Default principal: RANDOMUSER1@PRIMARYREALM

     Valid starting     Expires            Service principal
     06/07/04 19:49:21  06/08/04 05:49:19  krbtgt/PRIMARYREALM@PRIMARYREALM
     06/07/04 20:22:30  06/08/04 05:49:19  host/RANDOMHOST1.PRIMARYDOMAIN@PRIMARYREALM
     shell%

Here's what happened:  when RANDOMUSER1 used telnet to connect to the host RANDOMHOST1.PRIMARYDOMAIN, the telnet program presented her ticket-granting ticket to the KDC and requested a host ticket for the host RANDOMHOST1.PRIMARYDOMAIN.  The KDC sent the host ticket, which telnet then presented to the host RANDOMHOST1.PRIMARYDOMAIN, and she was allowed to log in without typing her password.

Suppose your Kerberos tickets allow you to log into a host in another domain, such as RANDOMHOST2.SECONDDOMAIN, which is also in another Kerberos realm, SECONDREALM.  If you telnet to this host, you will receive a ticket-granting ticket for the realm SECONDREALM, plus the new host ticket for RANDOMHOST2.SECONDDOMAIN.  klist will now show:

     shell% klist
     Ticket cache: /tmp/krb5cc_ttypa
     Default principal: RANDOMUSER1@PRIMARYREALM

     Valid starting     Expires            Service principal
     06/07/04 19:49:21  06/08/04 05:49:19  krbtgt/PRIMARYREALM@PRIMARYREALM
     06/07/04 20:22:30  06/08/04 05:49:19  host/RANDOMHOST1.PRIMARYDOMAIN@PRIMARYREALM
     06/07/04 20:24:18  06/08/04 05:49:19  krbtgt/SECONDREALM@PRIMARYREALM
     06/07/04 20:24:18  06/08/04 05:49:19  host/RANDOMHOST2.SECONDDOMAIN@PRIMARYREALM
     shell%

You can use the -f option to view the flags that apply to your tickets.  The flags are:

F
     Forwardable
f
     forwarded
P
     Proxiable
p
     proxy
D
     postDateable
d
     postdated
R
     Renewable
I
     Initial
i
     invalid
H
     Hardware authenticated
A
     preAuthenticated
T
     Transit policy checked
O
     Okay as delegate
a
     anonymous

Here is a sample listing.  In this example, the user RANDOMUSER1 obtained her initial tickets (I), which are forwardable (F) and postdated (d) but not yet validated (i). (see kinit Reference, for more information about postdated tickets.)

     shell% klist -f
     Ticket cache: /tmp/krb5cc_320
     Default principal: RANDOMUSER1@PRIMARYREALM

     Valid starting      Expires             Service principal
     31/07/05 19:06:25  31/07/05 19:16:25  krbtgt/PRIMARYREALM@PRIMARYREALM
             Flags: FdiI
     shell%

In the following example, the user RANDOMUSER2's tickets were forwarded (f) to this host from another host.  The tickets are reforwardable (F).

     shell% klist -f
     Ticket cache: /tmp/krb5cc_p11795
     Default principal: RANDOMUSER2@SECONDREALM

     Valid starting     Expires            Service principal
     07/31/05 11:52:29  07/31/05 21:11:23  krbtgt/SECONDREALM@SECONDREALM
             Flags: Ff
     07/31/05 12:03:48  07/31/05 21:11:23  host/RANDOMHOST2.SECONDDOMAIN@SECONDREALM
             Flags: Ff
     shell%

Destroying Your Tickets with kdestroy
-------------------------------------

Your Kerberos tickets are proof that you are indeed yourself, and tickets can be stolen.  If this happens, the person who has them can masquerade as you until they expire.  For this reason, you should destroy your Kerberos tickets when you are away from your computer.

Destroying your tickets is easy.  Simply type kdestroy.

     shell% kdestroy
     shell%

If kdestroy fails to destroy your tickets, it will beep and give an error message.  For example, if kdestroy can't find any tickets to destroy, it will give the following message:

     shell% kdestroy
     kdestroy: No credentials cache file found while destroying cache
     shell%

Password Management
===================

Your password is the only way Kerberos has of verifying your identity. If someone finds out your password, that person can masquerade as you---send email that comes from you, read, edit, or delete your files, or log into other hosts as you---and no one will be able to tell the difference.  For this reason, it is important that you choose a good password (see Password Advice), and keep it secret.  If you need to give access to your account to someone else, you can do so through Kerberos.  (see Granting Access to Your Account.)  You should never tell your password to anyone, including your system administrator, for any reason.  You should change your password frequently, particularly any time you think someone may have found out what it is.

Changing Your Password
----------------------

To change your Kerberos password, use the kpasswd command.  It will ask you for your old password (to prevent someone else from walking up to your computer when you're not there and changing your password), and then prompt you for the new one twice.  (The reason you have to type it twice is to make sure you have typed it correctly.)  For example, user RANDOMUSER2 would do the following:

     shell% kpasswd
     Password for RANDOMUSER2:    <- Type your old password.
     Enter new password:    <- Type your new password.
     Enter it again:  <- Type the new password again.
     Password changed.
     shell%

If RANDOMUSER2 typed the incorrect old password, he would get the following message:

     shell% kpasswd
     Password for RANDOMUSER2:  <- Type the incorrect old password.
     kpasswd: Password incorrect while getting initial ticket
     shell%

If you make a mistake and don't type the new password the same way twice, kpasswd will ask you to try again:

     shell% kpasswd
     Password for RANDOMUSER2:  <- Type the old password.
     Enter new password:  <- Type the new password.
     Enter it again: <- Type a different new password.
     kpasswd: Password mismatch while reading password
     shell%

Once you change your password, it takes some time for the change to propagate through the system.  Depending on how your system is set up, this might be anywhere from a few minutes to an hour or more.  If you need to get new Kerberos tickets shortly after changing your password, try the new password.  If the new password doesn't work, try again using the old one.

Password Advice
---------------

Your password can include almost any character you can type (except control keys and the ``enter'' key).  A good password is one you can remember, but that no one else can easily guess.  Examples of bad passwords are words that can be found in a dictionary, any common or popular name, especially a famous person (or cartoon character), your name or username in any form (e.g., forward, backward, repeated twice, etc.), your spouse's, child's, or pet's name, your birth date, your social security number, and any sample password that appears in this (or any other) manual.

COMPANY recommends that your password be at least 6 characters long, and contain UPPER- and lower-case letters, numbers, and/or punctuation marks.  Some passwords that would be good if they weren't listed in this manual include:

  * some initials, like ``GykoR-66.'' for ``Get your kicks on Route 66.''

  * an easy-to-pronounce nonsense word, like ``slaRooBey'' or ``krang-its''

  * a misspelled phrase, like ``2HotPeetzas!'' or ``ItzAGurl!!!''

Note:  don't actually use any of the above passwords.  They're only meant to show you how to make up a good password.  Passwords that appear in a manual are the first ones intruders will try.

PRODUCT allows your system administrators to automatically reject bad passwords, based on certain criteria, such as a password dictionary or a minimum length.  For example, if the user RANDOMUSER1, who had a policy "strict" that required a minimum of 8 characaters, chose a password that was less than 8 characters, Kerberos would give an error message like the following:

     shell% kpasswd
     Password for RANDOMUSER1:  <- Type your old password here.

     RANDOMUSER1's password is controlled by the policy strict, which
     requires a minimum of 8 characters from at least 3 classes (the five classes
     are lowercase, uppercase, numbers, punctuation, and all other characters).

     Enter new password:  <- Type an insecure new password.
     Enter it again:  <- Type it again.

     kpasswd: Password is too short while attempting to change password.
     Please choose another password.

     Enter new password:  <- Type a good password here.
     Enter it again:  <- Type it again.
     Password changed.
     shell%

Your system administrators can choose the message that is displayed if you choose a bad password, so the message you see may be different from the above example.

Granting Access to Your Account
-------------------------------

If you need to give someone access to log into your account, you can do so through Kerberos, without telling the person your password.  Simply create a file called .k5login in your home directory.  This file should contain the Kerberos principal (see What is a Kerberos Principal?.) of each person to whom you wish to give access.  Each principal must be on a separate line.  Here is a sample .k5login file:

     RANDOMUSER1@PRIMARYREALM
     RANDOMUSER2@SECONDREALM

This file would allow the users RANDOMUSER1 and RANDOMUSER2 to use your user ID, provided that they had Kerberos tickets in their respective realms.  If you will be logging into other hosts across a network, you will want to include your own Kerberos principal in your .k5login file on each of these hosts.

Using a .k5login file is much safer than giving out your password, because:

  * You can take access away any time simply by removing the principal from your .k5login file.

  * Although the user has full access to your account on one particular host (or set of hosts if your .k5login file is shared, e.g., over NFS), that user does not inherit your network privileges.

  * Kerberos keeps a log of who obtains tickets, so a system administrator could find out, if necessary, who was capable of using your user ID at a particular time.

One common application is to have a .k5login file in root's home directory, giving root access to that machine to the Kerberos principals listed.  This allows system administrators to allow users to become root locally, or to log in remotely as root, without their having to give out the root password, and without anyone having to type the root password over the network.

Kerberos V5 Applications
========================

PRODUCT is a single-sign-on system.  This means that you only have to type your password once, and the PRODUCT programs do the authenticating (and optionally encrypting) for you.  The way this works is that Kerberos has been built into each of a suite of network programs.  For example, when you use a PRODUCT program to connect to a remote host, the program, the KDC, and the remote host perform a set of rapid negotiations.  When these negotiations are completed, your program has proven your identity on your behalf to the remote host, and the remote host has granted you access, all in the space of a few seconds.

The PRODUCT applications are versions of existing UNIX network programs with the Kerberos features added.

Overview of Additional Features
-------------------------------

The PRODUCT network programs are those programs that connect to another host somewhere on the internet.  These programs include rlogin, telnet, ftp, rsh, rcp, and ksu.  These programs have all of the original features of the corresponding non-Kerberos rlogin, telnet, ftp, rsh, rcp, and su programs, plus additional features that transparently use your Kerberos tickets for negotiating authentication and optional encryption with the remote host. In most cases, all you'll notice is that you no longer have to type your password, because Kerberos has already proven your identity.

The PRODUCT network programs allow you the options of forwarding your tickets to the remote host (if you obtained forwardable tickets with the kinit program; see Obtaining Tickets with kinit), and encrypting data transmitted between you and the remote host.

This section of the tutorial assumes you are familiar with the non-Kerberos versions of these programs, and highlights the Kerberos functions added in the PRODUCT package.

telnet
------

The PRODUCT telnet command works exactly like the standard UNIX telnet program, with the following Kerberos options added:

-f
     forwards a copy of your tickets to the remote host.

-F
     forwards a copy of your tickets to the remote host, and marks them re-forwardable from the remote host.

-k realm
     requests tickets for the remote host in the specified realm, instead of determining the realm itself.

-K
     uses your tickets to authenticate to the remote host, but does not log you in.

-a
     attempt automatic login using your tickets.  telnet will assume the same username unless you explicitly specify another.

-x
     turns on encryption.

For example, if RANDOMUSER2 wanted to use the standard UNIX telnet to connect to the machine RANDOMHOST1.PRIMARYDOMAIN, he would type:

     shell% telnet RANDOMHOST1.SECONDDOMAIN
     Trying 128.0.0.5 ...
     Connected to RANDOMHOST1.SECONDDOMAIN.
     Escape character is '^]'.

     NetBSD/i386 (daffodil) (ttyp3)

     login: RANDOMUSER2
     Password:    <- RANDOMUSER2 types his password here
     Last login: Fri Jun 21 17:13:11 from RANDOMHOST2.PRIMARYDOMAIN
     Copyright (c) 1980, 1983, 1986, 1988, 1990, 1991, 1993, 1994
             The Regents of the University of California.   All rights reserved.

     NetBSD 1.1: Tue May 21 00:31:42 EDT 1996

     Welcome to NetBSD!
     shell%

Note that the machine RANDOMHOST1.SECONDDOMAIN asked for RANDOMUSER2's password.  When he typed it, his password was sent over the network unencrypted.  If an intruder were watching network traffic at the time, that intruder would know RANDOMUSER2's password.

If, on the other hand, RANDOMUSER1 wanted to use the PRODUCT telnet to connect to the machine RANDOMHOST2.PRIMARYDOMAIN, she could forward a copy of her tickets, request an encrypted session, and log on as herself as follows:

     shell% telnet -a -f -x RANDOMHOST2.PRIMARYDOMAIN
     Trying 128.0.0.5...
     Connected to RANDOMHOST2.PRIMARYDOMAIN.
     Escape character is '^]'.
     [ Kerberos V5 accepts you as ``RANDOMUSER1@PRIMARYDOMAIN'' ]
     [ Kerberos V5 accepted forwarded credentials ]
     What you type is protected by encryption.
     Last login: Tue Jul 30 18:47:44 from RANDOMHOST.SECONDDOMAIN
     Athena Server (sun4) Version 9.1.11 Tue Jul 30 14:40:08 EDT 2002

     shell%

Note that RANDOMUSER1's machine used Kerberos to authenticate her to RANDOMHOST2.PRIMARYDOMAIN, and logged her in automatically as herself.  She had an encrypted session, a copy of her tickets already waiting for her, and she never typed her password.

If you forwarded your Kerberos tickets, telnet automatically destroys them when it exits.  The full set of options to PRODUCT telnet are discussed in the Reference section of this manual. (see telnet Reference)

rlogin
------

The PRODUCT rlogin command works exactly like the standard UNIX rlogin program, with the following Kerberos options added:

-f
     forwards a copy of your tickets to the remote host.

-F
     forwards a copy of your tickets to the remote host, and marks them re-forwardable from the remote host.

-k realm
     requests tickets for the remote host in the specified realm, instead of determining the realm itself.

-x
     encrypts the input and output data streams (the username is sent unencrypted)

For example, if RANDOMUSER2 wanted to use the standard UNIX rlogin to connect to the machine RANDOMHOST1.SECONDDOMAIN, he would type:

     shell% rlogin RANDOMHOST1.SECONDDOMAIN -l RANDOMUSER2
     Password:  <- RANDOMUSER2 types his password here
     Last login: Fri Jun 21 10:36:32 from :0.0
     Copyright (c) 1980, 1983, 1986, 1988, 1990, 1991, 1993, 1994
             The Regents of the University of California.   All rights reserved.

     NetBSD 1.1: Tue May 21 00:31:42 EDT 1996

     Welcome to NetBSD!
     shell%

Note that the machine RANDOMHOST1.SECONDDOMAIN asked for RANDOMUSER2's password.  When he typed it, his password was sent over the network unencrypted.  If an intruder were watching network traffic at the time, that intruder would know RANDOMUSER2's password.

If, on the other hand, RANDOMUSER1 wanted to use PRODUCT rlogin to connect to the machine RANDOMHOST2.PRIMARYDOMAIN, she could forward a copy of her tickets, mark them as not forwardable from the remote host, and request an encrypted session as follows:

     shell% rlogin RANDOMHOST2.PRIMARYDOMAIN -f -x
     This rlogin session is using DES encryption for all data transmissions.
     Last login: Thu Jun 20 16:20:50 from RANDOMHOST1
     Athena Server (sun4) Version 9.1.11 Tue Jul 30 14:40:08 EDT 2002
     shell%

Note that RANDOMUSER1's machine used Kerberos to authenticate her to RANDOMHOST2.PRIMARYDOMAIN, and logged her in automatically as herself.  She had an encrypted session, a copy of her tickets were waiting for her, and she never typed her password.

If you forwarded your Kerberos tickets, rlogin automatically destroys them when it exits.  The full set of options to PRODUCT rlogin are discussed in the Reference section of this manual. (see rlogin Reference)

FTP
---

The PRODUCT FTP program works exactly like the standard UNIX FTP program, with the following Kerberos features added:

-k realm
     requests tickets for the remote host in the specified realm, instead of determining the realm itself.

-f
     requests that your tickets be forwarded to the remote host.  The -f argument must be the last argument on the command line.

protect level
     (issued at the ftp> prompt) sets the protection level.  ``Clear'' is no protection; ``safe'' ensures data integrity by verifying the checksum, and ``private'' encrypts the data.  Encryption also ensures data integrity.

For example, suppose RANDOMUSER1 wants to get her RMAIL file from the directory ~RANDOMUSER1/Mail, on the host RANDOMHOST1.PRIMARYDOMAIN.  She wants to encrypt the file transfer.  The exchange would look like the following:

     shell% ftp RANDOMHOST1.PRIMARYDOMAIN
     Connected to RANDOMHOST1.PRIMARYDOMAIN.
     220 RANDOMHOST1.PRIMARYDOMAIN FTP server (Version 5.60) ready.
     334 Using authentication type GSSAPI; ADAT must follow
     GSSAPI accepted as authentication type
     GSSAPI authentication succeeded
     200 Data channel protection level set to private.
     Name (RANDOMHOST1.PRIMARYDOMAIN:RANDOMUSER1):
     232 GSSAPI user RANDOMUSER1@PRIMARYREALM is authorized as RANDOMUSER1
     230 User RANDOMUSER1 logged in.
     Remote system type is UNIX.
     Using binary mode to transfer files.
     ftp> protect private
     200 Protection level set to Private.
     ftp> cd ~RANDOMUSER1/MAIL
     250 CWD command successful.
     ftp> get RMAIL
     227 Entering Passive Mode (128,0,0,5,16,49)
     150 Opening BINARY mode data connection for RMAIL (361662 bytes).
     226 Transfer complete.
     361662 bytes received in 2.5 seconds (1.4e+02 Kbytes/s)
     ftp> quit
     shell%

The full set of options to PRODUCT FTP are discussed in the Reference section of this manual.  (see FTP Reference)

rsh
---

The PRODUCT rsh program works exactly like the standard UNIX rlogin program, with the following Kerberos features added:

-f
     forwards a copy of your tickets to the remote host.

-F
     forwards a copy of your tickets to the remote host, and marks them re-forwardable from the remote host.

-k realm
     requests tickets for the remote host in the specified realm, instead of determining the realm itself.

-x
     encrypts the input and output data streams (the command line is not encrypted)

For example, if your Kerberos tickets allowed you to run programs on the host
 RANDOMHOST2@SECONDDOMAIN as root, you could run the date program as follows:

     shell% rsh RANDOMHOST2.SECONDDOMAIN -l root -x date
     This rsh session is using DES encryption for all data transmissions.
     Tue Jul 30 19:34:21 EDT 2002
     shell%

If you forwarded your Kerberos tickets, rsh automatically destroys them when it exits.  The full set of options to PRODUCT rsh are discussed in the Reference section of this manual. (see rsh Reference)

rcp
---

The PRODUCT rcp program works exactly like the standard UNIX rcp program, with the following Kerberos features added:

-k realm
     requests tickets for the remote host in the specified realm, instead of determining the realm itself.

-x
     turns on encryption.

For example, if you wanted to copy the file /etc/motd from the host RANDOMHOST1.PRIMARYDOMAIN into the current directory, via an encrypted connection, you would simply type:

     shell% rcp -x RANDOMHOST1.PRIMARYDOMAIN:/etc/motd .

The rcp program negotiates authentication and encryption transparently.  The full set of options to PRODUCT rcp are discussed in the Reference section of this manual.  (see rcp Reference)

ksu
---

The PRODUCT ksu program replaces the standard UNIX su program.  ksu first authenticates you to Kerberos.  Depending on the configuration of your system, ksu may ask for your Kerberos password if authentication fails.  Note that you should never type your password if you are remotely logged in using an unencrypted connection.

Once ksu has authenticated you, if your Kerberos principal appears in the target's .k5login file (see Granting Access to Your Account) or in the target's .k5users file (see below), it switches your user ID to the target user ID.

For example, RANDOMUSER2 has put RANDOMUSER1's Kerberos principal in his .k5login file.  If RANDOMUSER1 uses ksu to become RANDOMUSER2, the exchange would look like this.  (To differentiate between the two shells, RANDOMUSER1's prompt is represented as RANDOMUSER1% and RANDOMUSER2's prompt is represented as RANDOMUSER2%.)

     RANDOMUSER1% ksu RANDOMUSER2
     Account RANDOMUSER2: authorization for RANDOMUSER1@PRIMARYREALM successful
     Changing uid to RANDOMUSER2 (3382)
     RANDOMUSER2%

Note that the new shell has a copy of RANDOMUSER1's tickets.  The ticket filename contains RANDOMUSER2's UID with .1 appended to it:

     RANDOMUSER2% klist
     Ticket cache: /tmp/krb5cc_3382.1
     Default principal: RANDOMUSER1@PRIMARYREALM

     Valid starting      Expires             Service principal
     07/31/04 21:53:01  08/01/04 07:52:53  krbtgt/PRIMARYREALM@PRIMARYREALM
     07/31/04 21:53:39  08/01/04 07:52:53  host/RANDOMHOST1.PRIMARYDOMAIN@PRIMARYREALM
     RANDOMUSER2%

If RANDOMUSER1 had not appeared in RANDOMUSER2's .k5login file (and the system was configured to ask for a password), the exchange would have looked like this (assuming RANDOMUSER2 has taken appropriate precautions in protecting his password):

     RANDOMUSER1% ksu RANDOMUSER2
     WARNING: Your password may be exposed if you enter it here and are logged
              in remotely using an unsecure (non-encrypted) channel.
     Kerberos password for RANDOMUSER2@PRIMARYREALM:  <-  RANDOMUSER1 types the wrong password here.
     ksu: Password incorrect
     Authentication failed.
     RANDOMUSER1%

Now, suppose RANDOMUSER2 did not want to give RANDOMUSER1 full access to his account, but wanted to give her permission to list his files and use the "more" command to view them.  He could create a .k5users file giving her permission to run only those specific commands.

The .k5users file is like the .k5login file, except that each principal is optionally followed by a list of commands.  ksu will let those principals execute only the commands listed, using the -e option.  RANDOMUSER2's .k5users file might look like the following:

     RANDOMUSER1@PRIMARYREALM       /bin/ls /usr/bin/more
     ADMINUSER@PRIMARYREALM         /bin/ls
     ADMINUSER/admin@PRIMARYREALM   *
     RANDOMUSER2@SECONDREALM

The above .k5users file would let RANDOMUSER1 run only the commands /bin/ls and /usr/bin/more.  It would let ADMINUSER run only the command /bin/ls if he had regular tickets, but if he had tickets for his admin instance, ADMINUSER/admin@PRIMARYREALM, he would be able to execute any command.  The last line gives RANDOMUSER2 in the realm SECONDREALM permission to execute any command. (I.e., having only a Kerberos principal on a line is equivalent to giving that principal permission to execute *.)  This is so that RANDOMUSER2 can allow himself to execute commands when he logs in, using Kerberos, from a machine in the realm SECONDREALM.

Then, when RANDOMUSER1 wanted to list his home directory, she would type:

     RANDOMUSER1% ksu RANDOMUSER2 -e ls ~RANDOMUSER2
     Authenticated RANDOMUSER1@PRIMARYREALM
     Account RANDOMUSER2: authorization for RANDOMUSER1@PRIMARYREALM for execution of
                    /bin/ls successful
     Changing uid to RANDOMUSER2 (3382)
     Mail            News            Personal        misc            bin
     RANDOMUSER1%

If RANDOMUSER1 had tried to give a different command to ksu, it would have prompted for a password as with the previous example.

Note that unless the .k5users file gives the target permission to run any command, the user must use ksu with the -e command option.

The ksu options you are most likely to use are:

-n principal
     specifies which Kerberos principal you want to use for ksu. (e.g., the user ADMINUSER might want to use his admin instance.  See What is a Ticket?.)

-c
     specifies the location of your Kerberos credentials cache (ticket file).

-k
     tells ksu not to destroy your Kerberos tickets when ksu is finished.

-f
     requests forwardable tickets.  (see Obtaining Tickets with kinit.)  This is only applicable if ksu needs to obtain tickets.

-l lifetime
     sets the ticket lifetime.  (see Obtaining Tickets with kinit.)  This is only applicable if ksu needs to obtain tickets.

-z
     tells ksu to copy your Kerberos tickets only if the UID you are switching is the same as the Kerberos primary (either yours or the one specified by the -n option).

-Z
     tells ksu not to copy any Kerberos tickets to the new UID.

-e command
     tells ksu to execute command and then exit.  See the description of the .k5users file above.

-a text
     (at the end of the command line) tells ksu to pass everything after -a to the target shell.

The full set of options to PRODUCT ksu are discussed in the Reference section of this manual.  (see ksu Reference)

Kerberos V5 Reference
*********************

This section will include copies of the manual pages for the PRODUCT client programs.  You can read the manual entry for any command by typing man command, where command is the name of the command for which you want to read the manual entry.  For example, to read the kinit manual entry, you would type:

     shell% man kinit

Note:  To be able to view the PRODUCT manual pages on line, you may need to add the directory ROOTDIR/man to your MANPATH environment variable.  (Remember to replace ROOTDIR with the top-level directory in which PRODUCT is installed.)  For example, if you had the the following line in your .login file (The MANPATH variable may be specified in a different initialization file, depending on your operating system.  Some of the files in which you might specify environment variables include .login, .profile, or .cshrc.):

     setenv MANPATH /usr/local/man:/usr/man

and the PRODUCT man pages were in the directory /usr/LCPRODUCT/man, you would change the line to the following:

     setenv MANPATH /usr/LCPRODUCT/man:/usr/local/man:/usr/man

Note to info users:  the manual pages are not available within this info tree.  You can read them from emacs with the command:

     M-x manual-entry command

kinit Reference
===============

Type M-x manual-entry kinit to read this manual page.

klist Reference
===============

Type M-x manual-entry klist to read this manual page.

ksu Reference
=============

Type M-x manual-entry ksu to read this manual page.

kdestroy Reference
==================

Type M-x manual-entry kdestroy to read this manual page.

kpasswd Reference
=================

Type M-x manual-entry kpasswd to read this manual page.

telnet Reference
================

Type M-x manual-entry telnet to read this manual page.

FTP Reference
=============

Type M-x manual-entry FTP to read this manual page.

rlogin Reference
================

Type M-x manual-entry rlogin to read this manual page.

rsh Reference
=============

Type M-x manual-entry rsh to read this manual page.

rcp Reference
=============

Type M-x manual-entry rcp to read this manual page.

Kerberos Glossary
*****************

     [file glossary.texinfo not included]