kerberos(5)                                                     kerberos(5)




 NAME    [Toc]    [Back]
      kerberos - introduction to the Kerberos system

 DESCRIPTION    [Toc]    [Back]
      The Kerberos system authenticates individual users in a network
      environment. After authenticating yourself to Kerberos, you can use
      network utilities such as rlogin, rcp, and rsh without having to
      present passwords to the remote hosts and without having to edit and
      use .rhosts files. Note that these utilities will work without
      passwords only if the remote machines you deal with support the
      Kerberos system.

      If you enter your username and the remote machine is not a Kerberos
      system, you will get the following message:

           Principal unknown (Kerberos) you haven't been registered as a
           Kerberos user.

      You will have to see your system administrator when the above message
      is encountered.

      A Kerberos name usually contains three parts. The first is the
      principal, which is usually a user's or service's name. The second is
      the instance, which in the case of a user is usually null. Some users
      may have privileged instances, such as ``root'' or ``admin''. In the
      case of a service, the instance is the fully qualified name of the
      machine on which it runs; i.e. there can be an rlogin service running
      on the machine ABC, which is different from the rlogin service running
      on the machine XYZ. The third part of a Kerberos name is the realm.
      The realm corresponds to the Kerberos service providing authentication
      for the principal.

      When writing a Kerberos name, the principal name is separated from the
      instance (if not null) by a slash (/), and the realm (if not the local
      realm) follows, preceded by an ``@'' sign.  The following are examples
      of valid Kerberos names:

           david

           jennifer/admin

           [email protected]

           cbrown/[email protected]

      When you authenticate yourself with Kerberos, you get an initial
      Kerberos ticket.  A Kerberos ticket is an encrypted protocol message
      that provides authentication.  Kerberos uses this ticket for network
      utilities such as rlogin and rcp.  The ticket transactions are done
      transparently, so you do not have to worry about their management.




 Hewlett-Packard Company            - 1 -   HP-UX 11i Version 2: August 2003






 kerberos(5)                                                     kerberos(5)




      Note, however, that tickets will expire.  Privileged tickets, such as
      those with the instance ``root'', expire with in a few minutes, while
      tickets that carry more ordinary privileges may be valid for several
      hours or a day, depending on the Kerberos server configuration. If
      your login session extends beyond the lifetime limit, you will have to
      re-authenticate yourself to Kerberos to get new tickets. Use the kinit
      command to re-authenticate yourself.

      If you use the kinit command to get your tickets, make sure you use
      the kdestroy command to destroy your tickets before you end your login
      session. You should put the kdestroy command in your .logout file so
      that your tickets will be destroyed automatically when you logout. For
      more information about the kinit and kdestroy commands, see the
      kinit(1) and kdestroy(1) manual pages.

      Kerberos tickets can be forwarded. In order to forward tickets, you
      must request forwardable tickets when you use the kinit command.  Once
      you have forwardable tickets, most Kerberos programs have a command
      line option to forward them to the remote host.

      Currently, Kerberos support is available for the following network
      services: rlogin, rsh, rcp, telnet, ftp, and login.

 AUTHOR    [Toc]    [Back]
      Kerberos was developed by the Massachusetts Institute of Technology by
      Steve Miller, MIT Project Athena/Digital Equipment Corporation, and
      Clifford Neuman, MIT Project Athena.

 SEE ALSO    [Toc]    [Back]
      kdestroy(1), kinit(1), klist(1), kpasswd(1), krb5.conf(4), libkrb5(3).


 Hewlett-Packard Company            - 2 -   HP-UX 11i Version 2: August 2003