KERBEROS(1)						      General Commands Manual						       KERBEROS(1)

NAME

       kerberos - introduction to the Kerberos system

DESCRIPTION

       The  Kerberos  system authenticates individual users in a network environment.  After authenticating yourself to Kerberos, you can use net-
       work utilities such as rlogin, rcp, and rsh without having to present passwords to remote hosts and without having to bother  with  .rhosts
       files.  Note that these utilities will work without passwords only if the remote machines you deal with support the Kerberos system.

       If you enter your username and kinit responds with this message:

       kinit(v5): Client not found in Kerberos database while getting initial credentials

       you haven't been registered as a Kerberos user.	See your system administrator.

       A  Kerberos  name  usually contains three parts.  The first is the primary, which is usually a user's or service's name.  The second is the
       instance, which in the case of a user is usually null.  Some users may have privileged instances, however, such as ``root''  or	``admin''.
       In  the	case  of  a service, the instance is the fully qualified name of the machine on which it runs; i.e. there can be an rlogin service
       running on the machine ABC, which is different from the rlogin service running on the machine XYZ.  The third part of a	Kerberos  name	is
       the realm.  The realm corresponds to the Kerberos service providing authentication for the principal.

       When  writing  a Kerberos name, the principal name is separated from the instance (if not null) by a slash, and the realm (if not the local
       realm) follows, preceded by an ``@'' sign.  The following are examples of valid Kerberos names:

	       david
	       jennifer/admin
	       joeuser@BLEEP.COM
	       cbrown/root@FUBAR.ORG

       When you authenticate yourself with Kerberos you get an initial Kerberos ticket.  (A Kerberos ticket is an encrypted protocol message  that
       provides authentication.)  Kerberos uses this ticket for network utilities such as rlogin and rcp.  The ticket transactions are done trans-
       parently, so you don't have to worry about their management.

       Note, however, that tickets expire.  Privileged tickets, such as those with the instance ``root'', expire in a few minutes,  while  tickets
       that  carry more ordinary privileges may be good for several hours or a day, depending on the installation's policy.  If your login session
       extends beyond the time limit, you will have to re-authenticate yourself to Kerberos to get new tickets.  Use  the  kinit  command  to  re-
       authenticate yourself.

       If  you use the kinit command to get your tickets, make sure you use the kdestroy command to destroy your tickets before you end your login
       session.  You should put the kdestroy command in your .logout file so that your tickets will be destroyed automatically	when  you  logout.
       For more information about the kinit and kdestroy commands, see the kinit(1) and kdestroy(1) manual pages.

       Kerberos  tickets  can be forwarded.  In order to forward tickets, you must request forwardable tickets when you kinit.	Once you have for-
       wardable tickets, most Kerberos programs have a command line option to forward them to the remote host.

       Currently, Kerberos support is available for the following network services: rlogin, rsh, rcp, telnet, ftp, krdist (a Kerberized version of
       rdist), ksu (a Kerberized version of su), login, and Xdm.

SEE ALSO

       kdestroy(1),  kinit(1),	klist(1),  kpasswd(1),	rsh(1),  rcp(1),  rlogin(1),	telnet(1),  ftp(1), krdist(1), ksu(1), sclient(1), xdm(1),
       des_crypt(3), hash(3), krb5strings(3), krb5.conf(5), kdc.conf(5), kadmin(8),  kadmind(8),  kdb5_util(8),  telnetd(8),  ftpd(8),	rdistd(8),
       sserver(8), klogind(8c), kshd(8c), login(8c)

BUGS

AUTHORS

       Steve Miller, MIT Project Athena/Digital Equipment Corporation
       Clifford Neuman, MIT Project Athena

HISTORY

       Kerberos  was developed at MIT.	OpenVision rewrote and donated the administration server, which is used in the current version of Kerberos
       5.

RESTRICTIONS

       Copyright 1985,1986,1989-1996,2002 Massachusetts Institute of Technology

																       KERBEROS(1)