

KERBEROS(1)            BSD Reference Manual           KERBEROS(1)


NNAAMMEE
       kerberos - introduction to the Kerberos system


DDEESSCCRRIIPPTTIIOONN
       The  Kerberos  system  authenticates individual users in a
       network environment.   After  authenticating  yourself  to
       Kerberos,  you  can  use network utilities such as _r_l_o_g_i_n,
       _r_c_p, and _r_s_h without having to present passwords to remote
       hosts  and  without  having  to bother with _._r_h_o_s_t_s files.
       Note that these utilities will work without passwords only
       if  the remote machines you deal with support the Kerberos
       system.  All Athena timesharing machines and public  work-
       stations support Kerberos.

       Before  you  can  use  Kerberos,  you  must register as an
       Athena user, and you must make sure you have been added to
       the  Kerberos  database.  You can use the _k_i_n_i_t command to
       find out.  This command tries to log you into the Kerberos
       system.   _k_i_n_i_t  will  prompt you for a username and pass-
       word.  Enter your username and password.  If  the  utility
       lets  you  login  without  giving  you a message, you have
       already been registered.

       If you enter your username and _k_i_n_i_t  responds  with  this
       message:

       Principal unknown (kerberos)

       you  haven't been registered as a Kerberos user.  See your
       system administrator.

       A Kerberos name contains three parts.  The  first  is  the
       _p_r_i_n_c_i_p_a_l  _n_a_m_e_,  which  is  usually a user's or service's
       name.  The second is the _i_n_s_t_a_n_c_e_, which in the case of  a
       user  is  usually  null.   Some  users may have privileged
       instances, however, such as ``root'' or ``admin''.  In the
       case of a service, the instance is the name of the machine
       on which it runs; i.e. there can be an _r_l_o_g_i_n service run-
       ning  on  the  machine  ABC,  which  is different from the
       rlogin service running on the machine XYZ.  The third part
       of a Kerberos name is the _r_e_a_l_m_.  The realm corresponds to
       the Kerberos  service  providing  authentication  for  the
       principal.   For  example, at MIT there is a Kerberos run-
       ning at the Laboratory for Computer Science and  one  run-
       ning at Project Athena.

       When  writing a Kerberos name, the principal name is sepa-
       rated from the instance (if not null) by a period, and the
       realm  (if  not  the  local realm) follows, preceded by an
       ``@'' sign.  The following are examples of valid  Kerberos


MIT Project Athena     Kerberos Version 4.0                     1


KERBEROS(1)            BSD Reference Manual           KERBEROS(1)


       names:

               billb
               jis.admin
               srz@lcs.mit.edu
               treese.root@athena.mit.edu

       When  you  authenticate  yourself  with  Kerberos, through
       either the workstation _t_o_e_h_o_l_d system or  the  _k_i_n_i_t  com-
       mand,  Kerberos  gives you an initial Kerberos _t_i_c_k_e_t.  (A
       Kerberos ticket is an encrypted protocol message that pro-
       vides authentication.)  Kerberos uses this ticket for net-
       work utilities such as _r_l_o_g_i_n and _r_c_p.  The ticket  trans-
       actions are done transparently, so you don't have to worry
       about their management.

       Note, however, that tickets expire.   Privileged  tickets,
       such  as  root  instance tickets, expire in a few minutes,
       while tickets that carry more ordinary privileges  may  be
       good  for several hours or a day, depending on the instal-
       lation's policy.  If your login session extends beyond the
       time  limit,  you will have to re-authenticate yourself to
       Kerberos to get new tickets.  Use the _k_i_n_i_t command to re-
       authenticate yourself.

       If  you  use  the  _k_i_n_i_t command to get your tickets, make
       sure you use the _k_d_e_s_t_r_o_y command to destroy your  tickets
       before  you  end  your login session.  You should probably
       put the _k_d_e_s_t_r_o_y command in your _._l_o_g_o_u_t file so that your
       tickets  will  be destroyed automatically when you logout.
       For more information about the  _k_i_n_i_t  and  _k_d_e_s_t_r_o_y  com-
       mands, see the _k_i_n_i_t_(_1_) and _k_d_e_s_t_r_o_y_(_1_) manual pages.

       Currently,  Kerberos  supports  the following network ser-
       vices: _r_l_o_g_i_n, _r_s_h, and _r_c_p.   Other  services  are  being
       worked  on,  such  as the _p_o_p mail system and NFS (network
       file system), but are not yet available.


SSEEEE AALLSSOO
       kdestroy(1), kinit(1), klist(1), kpasswd(1), des_crypt(3),
       kerberos(3), kadmin(8)

BBUUGGSS
       Kerberos  will not do authentication forwarding.  In other
       words, if you use _r_l_o_g_i_n to login to a  remote  host,  you
       cannot  use  Kerberos  services  from  that host until you
       authenticate yourself explicitly on that  host.   Although
       you  may need to authenticate yourself on the remote host,
       be aware that when you do so, _r_l_o_g_i_n sends  your  password
       across the network in clear text.


MIT Project Athena     Kerberos Version 4.0                     2


KERBEROS(1)            BSD Reference Manual           KERBEROS(1)


AAUUTTHHOORRSS
       Steve  Miller, MIT Project Athena/Digital Equipment Corpo-
       ration
       Clifford Neuman, MIT Project Athena

       The following people helped out on various aspects of  the
       system:

       Jeff Schiller designed and wrote the administration server
       and its user interface, kadmin.  He  also  wrote  the  dbm
       version of the database management system.

       Mark Colan developed the Kerberos versions of _r_l_o_g_i_n, _r_s_h,
       and _r_c_p, as well as contributing work on the servers.

       John Ostlund developed the Kerberos versions of _p_a_s_s_w_d and
       _u_s_e_r_r_e_g.

       Stan  Zanarotti  pioneered  Kerberos  in  a  foreign realm
       (LCS), and made many contributions based on  that  experi-
       ence.

       Many  people contributed code and/or useful ideas, includ-
       ing Jim Aspnes, Bob Baldwin, John  Barba,  Richard  Basch,
       Jim  Bloom,  Bill  Bryant,  Rob  French,  Dan  Geer, David
       Jedlinsky, John Kohl, John Kubiatowicz, Bob  McKie,  Brian
       Murphy,   Ken  Raeburn,  Chris  Reed,  Jon  Rochlis,  Mike
       Shanzer, Bill Sommerfeld, Jennifer Steiner, Ted Ts'o,  and
       Win Treese.


RREESSTTRRIICCTTIIOONNSS
       COPYRIGHT 1985,1986 Massachusetts Institute of Technology


MIT Project Athena     Kerberos Version 4.0                     3