DESCRIPTION
The Kerberos system authenticates individual users in a network
environment.
After authenticating yourself to Kerberos, you can use
network utilities such as
rlogin,
rcp,
and
remsh
without having to present passwords to the remote hosts and without having
to edit and use
.rhosts
files.
Note that these utilities will work without passwords only if
the remote machines you deal with support the Kerberos system.
If you enter your username and
the remote machine is not a Kerberos system,
you will get the following message:
Principal unknown (Kerberos) you haven't been registered as a Kerberos user.
You will have to see your system administrator when the above message
is encountered.
A Kerberos name usually contains three parts.
The first is the
primary,
which is usually a user's or service's name.
The second is the
instance,
which in the case of a user is usually null.
Some users may have
privileged instances, such as "root" or "admin".
In the
case of a service, the instance is the fully qualified name of the
machine on which it runs; that is, there can be an
rlogin
service running on the machine ABC, which is different from the
rlogin
service running on the machine XYZ.
The third part of a Kerberos name is the
realm.
The realm corresponds to the Kerberos service providing authentication
for the principal.
When writing a Kerberos name, the principal name is separated from the
instance
(if not null) by a slash
(/),
and the realm (if not the local realm) follows, preceded by an
@
sign.
The following are examples of valid Kerberos names:
When you authenticate yourself with Kerberos, you get an initial Kerberos
ticket.
A Kerberos ticket is an encrypted protocol message that provides
authentication.
Kerberos uses this ticket for network utilities such as
rlogin
and
rcp.
The ticket transactions are done transparently, so you do not have to
worry about their management.
Note, however, that tickets will expire.
Privileged tickets, such as those with the instance "root", expire within
a few minutes, while tickets that
carry more ordinary privileges may be valid for several hours or a day,
depending on the Kerberos server configuration.
If your login session extends
beyond the lifetime limit, you will have to re-authenticate yourself to
Kerberos to get new tickets.
Use the
kinit
command to re-authenticate yourself.
If you use the
kinit
command to get your tickets, make sure you use the
kdestroy
command to destroy your tickets before you end your login session.
You should put the
kdestroy
command in your
.logout
file so that your tickets will be destroyed automatically when you
logout.
For more information about the
kinit
and
kdestroy
commands, see
kinit(1)
and
kdestroy(1).
Kerberos tickets can be forwarded.
In order to forward tickets, you must request
forwardable
tickets when you use the
kinit
command.
Once you have forwardable tickets, most Kerberos programs have a command
line option to forward them to the remote host.
Currently, Kerberos support is available for the following network
services:
rlogin,
remsh,
rcp,
telnet,
ftp,
and
ssh.
Printable version
