KINIT(1)

KINIT(1) | General Commands Manual | KINIT(1)

# NAME

`kinit` — acquire initial tickets

# SYNOPSIS

`kinit` | [`--afslog`] [`-c` cachename | `--cache=`cachename] [`-f` | `--forwardable`] [`-F` | `--no-forwardable`] [`-t` keytabname | `--keytab=`keytabname] [`-l` time | `--lifetime=`time] [`-p` | `--proxiable`] [`-R` | `--renew`] [`--renewable`] [`-r` time | `--renewable-life=`time] [`-S` principal | `--server=`principal] [`-s` time | `--start-time=`time] [`-k` | `--use-keytab`] [`-v` | `--validate`] [`-e` enctypes | `--enctypes=`enctypes] [`-a` addresses | `--extra-addresses=`addresses] [`--password-file=`filename] [`--fcache-version=`version-number] [`-A` | `--no-addresses`] [`-n` | `--anonymous`] [`--enterprise`] [`--version`] [`--help`] [principal [command]]

# DESCRIPTION

`kinit` is used to authenticate to the Kerberos server as principal, or if none is given, a system generated default (typically your login name at the default realm), and acquire a ticket granting ticket that can later be used to obtain tickets for other services.

Supported options:

`-c` cachename `--cache=`cachename
  The credentials cache to put the acquired ticket in, if other than default.
`-f` `--forwardable`
  Obtain a ticket than can be forwarded to another host.
`-F` `--no-forwardable`
  Do not obtain a forwardable ticket.
`-t` keytabname, `--keytab=`keytabname
  Don't ask for a password, but instead get the key from the specified keytab.
`-l` time, `--lifetime=`time
  Specifies the lifetime of the ticket. The argument can either be in seconds, or a more human readable string like ‘1h’.
`-p`, `--proxiable`
  Request tickets with the proxiable flag set.
`-R`, `--renew`
  Try to renew ticket. The ticket must have the ‘renewable’ flag set, and must not be expired.
`--renewable`
  The same as `--renewable-life`, with an infinite time.
`-r` time, `--renewable-life=`time
  The max renewable ticket life.
`-S` principal, `--server=`principal
  Get a ticket for a service other than krbtgt/LOCAL.REALM.
`-s` time, `--start-time=`time
  Obtain a ticket that starts to be valid time (which can really be a generic time specification, like ‘1h’) seconds into the future.
`-k`, `--use-keytab`
  The same as `--keytab`, but with the default keytab name (normally FILE:/etc/krb5.keytab).
`-v`, `--validate`
  Try to validate an invalid ticket.
`-e`, `--enctypes=`enctypes
  Request tickets with this particular enctype.
`--password-file=`filename
  read the password from the first line of filename. If the filename is STDIN, the password will be read from the standard input.
`--fcache-version=`version-number
  Create a credentials cache of version version-number.
`-a`, `--extra-addresses=`enctypes
  Adds a set of addresses that will, in addition to the systems local addresses, be put in the ticket. This can be useful if all addresses a client can use can't be automatically figured out. One such example is if the client is behind a firewall. Also settable via `libdefaults/extra_addresses` in krb5.conf(5).
`-A`, `--no-addresses`
  Request a ticket with no addresses.
`-n`, `--anonymous`
  Request an anonymous ticket. With the default (false) setting of the historical_anon_pkinit configuration parameter, if the principal is specified as @REALM, then anonymous PKINIT will be used to acquire an unauthenticated anonymous ticket and both the client name and (with fully RFC-comformant KDCs) realm in the returned ticket will be anonymized. Otherwise, authentication proceeds as normal and the anonymous ticket will have only the client name anonymized. With historical_anon_pkinit set to `true`, the principal is interpreted as a realm even without an at-sign prefix, and it is not possible to obtain authenticated anonymized tickets.
`--enterprise`
  Parse principal as a enterprise (KRB5-NT-ENTERPRISE) name. Enterprise names are email like principals that are stored in the name part of the principal, and since there are two @ characters the parser needs to know that the first is not a realm. An example of an enterprise name is “lha@e.kth.se@KTH.SE”, and this option is usually used with canonicalize so that the principal returned from the KDC will typically be the real principal name.
`--afslog`
  Gets AFS tickets, converts them to version 4 format, and stores them in the kernel. Only useful if you have AFS.

The forwardable, proxiable, ticket_life, and renewable_life options can be set to a default value from the `appdefaults` section in krb5.conf, see krb5_appdefault(3).

If a command is given, `kinit` will set up new credentials caches, and AFS PAG, and then run the given command. When it finishes the credentials will be removed.

# ENVIRONMENT

`KRB5CCNAME`
  Specifies the default credentials cache.
`KRB5_CONFIG`
  The file name of krb5.conf, the default being /etc/krb5.conf.

# SEE ALSO

kdestroy(1), klist(1), krb5_appdefault(3), krb5.conf(5)

April 25, 2006 | NetBSD 11.0