From 03ee415d20caee6c6550e3313a1cb4a842e47fe1 Mon Sep 17 00:00:00 2001 From: CSRG Date: Sun, 24 Jun 1990 23:12:45 -0800 Subject: [PATCH] BSD 4_3_Net_2 development Work on file usr/src/kerberosIV/man/des_crypt.3 Work on file usr/src/kerberosIV/man/kdb_destroy.8 Work on file usr/src/kerberosIV/man/kdb_edit.8 Work on file usr/src/kerberosIV/man/kdb_init.8 Work on file usr/src/kerberosIV/man/kdb_util.8 Work on file usr/src/kerberosIV/man/krb.3 Work on file usr/src/kerberosIV/man/klist.1 Work on file usr/src/kerberosIV/man/krb.conf.5 Work on file usr/src/kerberosIV/man/krb.realms.5 Work on file usr/src/kerberosIV/man/krb_realmofhost.3 Work on file usr/src/kerberosIV/man/krb_sendauth.3 Work on file usr/src/kerberosIV/man/krb_set_tkt_string.3 Work on file usr/src/kerberosIV/man/ksrvtgt.1 Work on file usr/src/kerberosIV/man/kstash.8 Work on file usr/src/kerberosIV/man/kuserok.3 Work on file usr/src/kerberosIV/man/tf_util.3 Synthesized-from: CSRG/cd2/net.2 --- usr/src/kerberosIV/man/des_crypt.3 | 381 ++++++++++++++++ usr/src/kerberosIV/man/kdb_destroy.8 | 34 ++ usr/src/kerberosIV/man/kdb_edit.8 | 56 +++ usr/src/kerberosIV/man/kdb_init.8 | 42 ++ usr/src/kerberosIV/man/kdb_util.8 | 65 +++ usr/src/kerberosIV/man/klist.1 | 85 ++++ usr/src/kerberosIV/man/krb.3 | 462 ++++++++++++++++++++ usr/src/kerberosIV/man/krb.conf.5 | 33 ++ usr/src/kerberosIV/man/krb.realms.5 | 40 ++ usr/src/kerberosIV/man/krb_realmofhost.3 | 162 +++++++ usr/src/kerberosIV/man/krb_sendauth.3 | 349 +++++++++++++++ usr/src/kerberosIV/man/krb_set_tkt_string.3 | 44 ++ usr/src/kerberosIV/man/ksrvtgt.1 | 52 +++ usr/src/kerberosIV/man/kstash.8 | 42 ++ usr/src/kerberosIV/man/kuserok.3 | 64 +++ usr/src/kerberosIV/man/tf_util.3 | 152 +++++++ 16 files changed, 2063 insertions(+) create mode 100644 usr/src/kerberosIV/man/des_crypt.3 create mode 100644 usr/src/kerberosIV/man/kdb_destroy.8 create mode 100644 usr/src/kerberosIV/man/kdb_edit.8 create mode 100644 usr/src/kerberosIV/man/kdb_init.8 create mode 100644 usr/src/kerberosIV/man/kdb_util.8 create mode 100644 usr/src/kerberosIV/man/klist.1 create mode 100644 usr/src/kerberosIV/man/krb.3 create mode 100644 usr/src/kerberosIV/man/krb.conf.5 create mode 100644 usr/src/kerberosIV/man/krb.realms.5 create mode 100644 usr/src/kerberosIV/man/krb_realmofhost.3 create mode 100644 usr/src/kerberosIV/man/krb_sendauth.3 create mode 100644 usr/src/kerberosIV/man/krb_set_tkt_string.3 create mode 100644 usr/src/kerberosIV/man/ksrvtgt.1 create mode 100644 usr/src/kerberosIV/man/kstash.8 create mode 100644 usr/src/kerberosIV/man/kuserok.3 create mode 100644 usr/src/kerberosIV/man/tf_util.3 diff --git a/usr/src/kerberosIV/man/des_crypt.3 b/usr/src/kerberosIV/man/des_crypt.3 new file mode 100644 index 0000000000..cfc1466b58 --- /dev/null +++ b/usr/src/kerberosIV/man/des_crypt.3 @@ -0,0 +1,381 @@ +.\" $Source: /usr/src/kerberosIV/man/RCS/des_crypt.3,v $ +.\" $Author: kfall $ +.\" $Header: /usr/src/kerberosIV/man/RCS/des_crypt.3,v 4.4 90/06/25 21:11:49 kfall Exp $ +.\" Copyright 1989 by the Massachusetts Institute of Technology. +.\" +.\" For copying and distribution information, +.\" please see the file . +.\" +.TH DES_CRYPT 3 "Kerberos Version 4.0" "MIT Project Athena" +.SH NAME +des_read_password, des_string_to_key, des_random_key, des_set_key, +des_ecb_encrypt, des_cbc_encrypt, des_pcbc_encrypt, des_cbc_cksum, +des_quad_cksum, \- (new) DES encryption +.SH SYNOPSIS +.nf +.nj +.ft B +#include +.PP +.ft B +.B int des_read_password(key,prompt,verify) +des_cblock *key; +char *prompt; +int verify; +.PP +.ft B +int des_string_to_key(str,key) +char *str; +des_cblock key; +.PP +.ft B +int des_random_key(key) +des_cblock *key; +.PP +.ft B +int des_set_key(key,schedule) +des_cblock *key; +des_key_schedule schedule; +.PP +.ft B +int des_ecb_encrypt(input,output,schedule,encrypt) +des_cblock *input; +des_cblock *output; +des_key_schedule schedule; +int encrypt; +.PP +.ft B +int des_cbc_encrypt(input,output,length,schedule,ivec,encrypt) +des_cblock *input; +des_cblock *output; +long length; +des_key_schedule schedule; +des_cblock *ivec; +int encrypt; +.PP +.ft B +int des_pcbc_encrypt(input,output,length,schedule,ivec,encrypt) +des_cblock *input; +des_cblock *output; +long length; +des_key_schedule schedule; +des_cblock *ivec; +int encrypt; +.PP +.ft B +unsigned long des_cbc_cksum(input,output,length,schedule,ivec) +des_cblock *input; +des_cblock *output; +long length; +des_key_schedule schedule; +des_cblock *ivec; +.PP +.ft B +unsigned long quad_cksum(input,output,length,out_count,seed) +des_cblock *input; +des_cblock *output; +long length; +int out_count; +des_cblock *seed; +.PP +.fi +.SH DESCRIPTION +This library supports various DES encryption related operations. It differs +from the +.I crypt, setkey, and encrypt +library routines in that it provides +a true DES encryption, without modifying the algorithm, +and executes much faster. +.PP +For each key that may be simultaneously active, create a +.B des_key_schedule +struct, +defined in "des.h". Next, create key schedules (from the 8-byte keys) as +needed, via +.I des_set_key, +prior to using the encryption or checksum routines. Then +setup the input and output areas. Make sure to note the restrictions +on lengths being multiples of eight bytes. Finally, invoke the +encryption/decryption routines, +.I des_ecb_encrypt +or +.I des_cbc_encrypt +or +.I des_pcbc_encrypt, +or, to generate a cryptographic checksum, use +.I quad_cksum +(fast) or +.I des_cbc_cksum +(slow). +.PP +A +.I des_cblock +struct is an 8 byte block used as the fundamental unit for DES data and +keys, and is defined as: +.PP +.B typedef unsigned char des_cblock[8]; +.PP +and a +.I des_key_schedule, +is defined as: +.PP +.B typedef struct des_ks_struct {des_cblock _;} des_key_schedule[16]; +.PP +.I des_read_password +writes the string specified by +.I prompt +to the standard +output, turns off echo (if possible) +and reads an input string from standard input until terminated with a newline. +If +.I verify +is non-zero, it prompts and reads input again, for use +in applications such as changing a password; both +versions are compared, and the input is requested repeatedly until they +match. Then +.I des_read_password +converts the input string into a valid DES key, internally +using the +.I des_string_to_key +routine. The newly created key is copied to the +area pointed to by the +.I key +argument. +.I des_read_password +returns a zero if no errors occurred, or a -1 +indicating that an error +occurred trying to manipulate the terminal echo. +.PP +.PP +.I des_string_to_key +converts an arbitrary length null-terminated string +to an 8 byte DES key, with odd byte parity, per FIPS specification. +A one-way function is used to convert the string to a key, making it +very difficult to reconstruct the string from the key. +The +.I str +argument is a pointer to the string, and +.I key +should +point to a +.I des_cblock +supplied by the caller to receive the generated key. +No meaningful value is returned. Void is not used for compatibility with +other compilers. +.PP +.PP +.I des_random_key +generates a random DES encryption key (eight bytes), set to odd parity per +FIPS +specifications. +This routine uses the current time, process id, and a counter +as a seed for the random number generator. +The caller must supply space for the output key, pointed to +by argument +.I key, +then after calling +.I des_random_key +should +call the +.I des_set_key +routine when needed. +No meaningful value is returned. Void is not used for compatibility +with other compilers. +.PP +.PP +.I des_set_key +calculates a key schedule from all eight bytes of the input key, pointed +to by the +.I key +argument, and outputs the schedule into the +.I des_key_schedule +indicated by the +.I schedule +argument. Make sure to pass a valid eight byte +key; no padding is done. The key schedule may then be used in subsequent +encryption/decryption/checksum operations. Many key schedules may be +cached for later use. The user is responsible to clear keys and schedules +as soon as no longer needed, to prevent their disclosure. +The routine also checks the key +parity, and returns a zero if the key parity is correct (odd), a -1 +indicating a key parity error, or a -2 indicating use of an illegal +weak key. If an error is returned, the key schedule was not created. +.PP +.PP +.I des_ecb_encrypt +is the basic DES encryption routine that encrypts or decrypts a single 8-byte +block in +.B electronic code book +mode. It always transforms the input data, pointed to by +.I input, +into the output data, pointed to by the +.I output +argument. +.PP +If the +.I encrypt +argument is non-zero, the +.I input +(cleartext) is encrypted into the +.I output +(ciphertext) using the key_schedule specified by the +.I schedule +argument, previously set via +.I des_set_key +.PP +If encrypt is zero, the +.I input +(now ciphertext) is decrypted into the +.I output +(now cleartext). +.PP +Input and output may overlap. +.PP +No meaningful value is returned. Void is not used for compatibility +with other compilers. +.PP +.PP +.I des_cbc_encrypt +encrypts/decrypts using the +.B cipher-block-chaining mode of DES. +If the +.I encrypt +argument is non-zero, the routine cipher-block-chain encrypts +the cleartext data pointed to by the +.I input +argument into the ciphertext pointed to by the +.I output +argument, using the key schedule provided by the +.I schedule +argument, and initialization vector provided by the +.I ivec +argument. +If the +.I length +argument is not an integral +multiple of eight bytes, the last block is copied to a temp and zero +filled (highest addresses). The output is ALWAYS an integral multiple +of eight bytes. +.PP +If +.I encrypt +is zero, the routine cipher-block chain decrypts the (now) ciphertext +data pointed to by the +.I input +argument into (now) cleartext pointed to by the +.I output +argument using the key schedule provided by the +.I schedule +argument, and initialization vector provided by the +.I ivec +argument. Decryption ALWAYS operates on integral +multiples of 8 bytes, so it will round the +.I length +provided up to the +appropriate multiple. Consequently, it will always produce the rounded-up +number of bytes of output cleartext. The application must determine if +the output cleartext was zero-padded due to original cleartext lengths that +were not integral multiples of 8. +.PP +No errors or meaningful values are returned. Void is not used for +compatibility with other compilers. +.PP +A characteristic of cbc mode is that changing a single bit of the +cleartext, then encrypting using cbc mode, +affects ALL the subsequent ciphertext. This makes cryptanalysis +much more difficult. However, modifying a single bit of the ciphertext, +then decrypting, only affects the resulting cleartext from +the modified block and the succeeding block. Therefore, +.I des_pcbc_encrypt +is STRONGLY recommended for applications where +indefinite propagation of errors is required in order to detect modifications. +.PP +.PP +.I des_pcbc_encrypt +encrypts/decrypts using a modified block chaining mode. Its calling +sequence is identical to +.I des_cbc_encrypt. +It differs in its error propagation characteristics. +.PP +.I des_pcbc_encrypt +is highly recommended for most encryption purposes, in that +modification of a single bit of the ciphertext will affect ALL the +subsequent (decrypted) cleartext. Similarly, modifying a single bit of +the cleartext will affect ALL the subsequent (encrypted) ciphertext. +"PCBC" mode, on encryption, "xors" both the +cleartext of block N and the ciphertext resulting from block N with the +cleartext for block N+1 prior to encrypting block N+1. +.PP +.I des_cbc_cksum +produces an 8 byte cryptographic checksum by cipher-block-chain +encrypting the cleartext data pointed to by the +.I input +argument. All of the ciphertext output is discarded, except the +last 8-byte ciphertext block, which is written into the area pointed to by +the +.I output +argument. +It uses the key schedule, +provided by the +.I schedule +argument and initialization vector provided by the +.I ivec +argument. +If the +.I length +argument is not an integral +multiple of eight bytes, the last cleartext block is copied to a temp and zero +filled (highest addresses). The output is ALWAYS eight bytes. +.PP +The routine also returns an unsigned long, which is the last (highest address) +half of the 8 byte checksum computed. +.PP +.PP +.I quad_cksum +produces a checksum by chaining quadratic operations on the cleartext data +pointed to by the +.I input +argument. The +.I length +argument specifies the length of the +input -- only exactly that many bytes are included for the checksum, +without any padding. +.PP +The algorithm may be iterated over the same input data, if the +.I out_count +argument is 2, 3 or 4, and the optional +.I output +argument is a non-null pointer . +The default is one iteration, and it will not run +more than 4 times. Multiple iterations run slower, but provide +a longer checksum if desired. The +.I seed +argument provides an 8-byte seed for the first iteration. If multiple iterations are +requested, the results of one iteration are automatically used as +the seed for the next iteration. +.PP +It returns both an unsigned long checksum value, and +if the +.I output +argument is not a null pointer, up to 16 bytes of +the computed checksum are written into the output. +.PP +.PP +.SH FILES +/usr/include/kerberosIV/des.h +.br +/usr/lib/libdes.a +.SH "SEE ALSO" +.SH DIAGNOSTICS +.SH BUGS +This software has not yet been compiled or tested on machines other than the +VAX and the IBM PC. +.SH AUTHORS +Steve Miller, MIT Project Athena/Digital Equipment Corporation +.SH RESTRICTIONS +COPYRIGHT 1985,1986 Massachusetts Institute of Technology +.PP +This software may not be exported outside of the US without a special +license from the US Dept of Commerce. It may be replaced by any secret +key block cipher with block length and key length of 8 bytes, as long +as the interface is the same as described here. diff --git a/usr/src/kerberosIV/man/kdb_destroy.8 b/usr/src/kerberosIV/man/kdb_destroy.8 new file mode 100644 index 0000000000..6ed20d56a0 --- /dev/null +++ b/usr/src/kerberosIV/man/kdb_destroy.8 @@ -0,0 +1,34 @@ +.\" $Source: /usr/src/kerberosIV/man/RCS/kdb_destroy.8,v $ +.\" $Author: kfall $ +.\" $Header: /usr/src/kerberosIV/man/RCS/kdb_destroy.8,v 4.2 90/06/25 21:12:01 kfall Exp $ +.\" Copyright 1989 by the Massachusetts Institute of Technology. +.\" +.\" For copying and distribution information, +.\" please see the file . +.\" +.TH KDB_DESTROY 8 "Kerberos Version 4.0" "MIT Project Athena" +.SH NAME +kdb_destroy \- destroy Kerberos key distribution center database +.SH SYNOPSIS +kdb_destroy +.SH DESCRIPTION +.I kdb_destroy +deletes a Kerberos key distribution center database. +.PP +The user is prompted to verify that the database should be destroyed. A +response beginning with `y' or `Y' confirms deletion. +Any other response aborts deletion. +.SH DIAGNOSTICS +.TP 20n +"Database cannot be deleted at /etc/kerberosIV/principal" +The attempt to delete the database failed (probably due to a system or +access permission error). +.TP +"Database not deleted." +The user aborted the deletion. +.SH FILES +.TP 20n +/etc/kerberosIV/principal.pag, /etc/kerberosIV/principal.dir +DBM files containing database +.SH SEE ALSO +kdb_init(8) diff --git a/usr/src/kerberosIV/man/kdb_edit.8 b/usr/src/kerberosIV/man/kdb_edit.8 new file mode 100644 index 0000000000..663f96c452 --- /dev/null +++ b/usr/src/kerberosIV/man/kdb_edit.8 @@ -0,0 +1,56 @@ +.\" $Source: /usr/src/kerberosIV/man/RCS/kdb_edit.8,v $ +.\" $Author: kfall $ +.\" $Header: /usr/src/kerberosIV/man/RCS/kdb_edit.8,v 4.2 90/06/25 21:12:03 kfall Exp $ +.\" Copyright 1989 by the Massachusetts Institute of Technology. +.\" +.\" For copying and distribution information, +.\" please see the file . +.\" +.TH KDB_EDIT 8 "Kerberos Version 4.0" "MIT Project Athena" +.SH NAME +kdb_edit \- Kerberos key distribution center database editing utility +.SH SYNOPSIS +kdb_edit [ +.B \-n +] +.SH DESCRIPTION +.I kdb_edit +is used to create or change principals stored in the Kerberos key +distribution center (KDC) database. +.PP +When executed, +.I kdb_edit +prompts for the master key string and verifies that it matches the +master key stored in the database. +If the +.B \-n +option is specified, the master key is instead fetched from the master +key cache file. +.PP +Once the master key has been verified, +.I kdb_edit +begins a prompt loop. The user is prompted for the principal and +instance to be modified. If the entry is not found the user may create +it. +Once an entry is found or created, the user may set the password, +expiration date, maximum ticket lifetime, and attributes. +Default expiration dates, maximum ticket lifetimes, and attributes are +presented in brackets; if the user presses return the default is selected. +There is no default password. +The password RANDOM is interpreted specially, and if entered +the user may have the program select a random DES key for the +principal. +.PP +Upon successfully creating or changing the entry, ``Edit O.K.'' is +printed. +.SH DIAGNOSTICS +.TP 20n +"verify_master_key: Invalid master key, does not match database." +The master key string entered was incorrect. +.SH FILES +.TP 20n +/etc/kerberosIV/principal.pag, /etc/kerberosIV/principal.dir +DBM files containing database +.TP +/etc/kerberosIV/master_key +Master key cache file. diff --git a/usr/src/kerberosIV/man/kdb_init.8 b/usr/src/kerberosIV/man/kdb_init.8 new file mode 100644 index 0000000000..b7c39d0c5c --- /dev/null +++ b/usr/src/kerberosIV/man/kdb_init.8 @@ -0,0 +1,42 @@ +.\" $Source: /usr/src/kerberosIV/man/RCS/kdb_init.8,v $ +.\" $Author: kfall $ +.\" $Header: /usr/src/kerberosIV/man/RCS/kdb_init.8,v 4.2 90/06/25 21:12:05 kfall Exp $ +.\" Copyright 1989 by the Massachusetts Institute of Technology. +.\" +.\" For copying and distribution information, +.\" please see the file . +.\" +.TH KDB_INIT 8 "Kerberos Version 4.0" "MIT Project Athena" +.SH NAME +kdb_init \- Initialize Kerberos key distribution center database +.SH SYNOPSIS +kdb_init [ +.B realm +] +.SH DESCRIPTION +.I kdb_init +initializes a Kerberos key distribution center database, creating the +necessary principals. +.PP +If the optional +.I realm +argument is not present, +.I kdb_init +prompts for a realm name (defaulting to the definition in /usr/include/krb.h). +After determining the realm to be created, it prompts for +a master key password. The master key password is used to encrypt +every encryption key stored in the database. +.SH DIAGNOSTICS +.TP 20n +"/etc/kerberosIV/principal: File exists" +An attempt was made to create a database on a machine which already had +an existing database. +.SH FILES +.TP 20n +/etc/kerberosIV/principal.pag, /etc/kerberosIV/principal.dir +DBM files containing database +.TP +/usr/include/kerberosIV/krb.h +Include file defining default realm +.SH SEE ALSO +kdb_destroy(8) diff --git a/usr/src/kerberosIV/man/kdb_util.8 b/usr/src/kerberosIV/man/kdb_util.8 new file mode 100644 index 0000000000..44ca23147a --- /dev/null +++ b/usr/src/kerberosIV/man/kdb_util.8 @@ -0,0 +1,65 @@ +.\" $Source: /usr/src/kerberosIV/man/RCS/kdb_util.8,v $ +.\" $Author: kfall $ +.\" $Header: /usr/src/kerberosIV/man/RCS/kdb_util.8,v 4.2 90/06/25 21:12:07 kfall Exp $ +.\" Copyright 1989 by the Massachusetts Institute of Technology. +.\" +.\" For copying and distribution information, +.\" please see the file . +.\" +.TH KDB_UTIL 8 "Kerberos Version 4.0" "MIT Project Athena" +.SH NAME +kdb_util \- Kerberos key distribution center database utility +.SH SYNOPSIS +kdb_util +.B operation filename +.SH DESCRIPTION +.I kdb_util +allows the Kerberos key distribution center (KDC) database administrator to +perform utility functions on the database. +.PP +.I Operation +must be one of the following: +.TP 10n +.I load +initializes the KDC database with the records described by the +text contained in the file +.IR filename . +Any existing database is overwritten. +.TP +.I dump +dumps the KDC database into a text representation in the file +.IR filename . +.TP +.I slave_dump +performs a database dump like the +.I dump +operation, and additionally creates a semaphore file signalling the +propagation software that an update is available for distribution to +slave KDC databases. +.TP +.I new_master_key +prompts for the old and new master key strings, and then dumps the KDC +database into a text representation in the file +.IR filename . +The keys in the text representation are encrypted in the new master key. +.TP +.I convert_old_db +prompts for the master key string, and then dumps the KDC database into +a text representation in the file +.IR filename . +The existing database is assumed to be encrypted using the old format +(encrypted by the key schedule of the master key); the dumped database +is encrypted using the new format (encrypted directly with master key). +.PP +.SH DIAGNOSTICS +.TP 20n +"verify_master_key: Invalid master key, does not match database." +The master key string entered was incorrect. +.SH FILES +.TP 20n +/etc/kerberosIV/principal.pag, /etc/kerberosIV/principal.dir +DBM files containing database +.TP +.IR filename .ok +semaphore file created by +.IR slave_dump. diff --git a/usr/src/kerberosIV/man/klist.1 b/usr/src/kerberosIV/man/klist.1 new file mode 100644 index 0000000000..a7a4af15db --- /dev/null +++ b/usr/src/kerberosIV/man/klist.1 @@ -0,0 +1,85 @@ +.\" $Source: /usr/src/kerberosIV/man/RCS/klist.1,v $ +.\" $Author: kfall $ +.\" $Header: /usr/src/kerberosIV/man/RCS/klist.1,v 4.9 90/06/25 21:12:15 kfall Exp $ +.\" Copyright 1989 by the Massachusetts Institute of Technology. +.\" +.\" For copying and distribution information, +.\" please see the file . +.\" +.TH KLIST 1 "Kerberos Version 4.0" "MIT Project Athena" +.SH NAME +klist \- list currently held Kerberos tickets +.SH SYNOPSIS +.B klist +[ +\fB\-s \fR|\fB \-t\fR +] [ +.B \-file +name ] [ +.B \-srvtab +] +.br +.SH DESCRIPTION +.I klist +prints the name of the tickets file and the +identity of the principal the tickets are for (as listed in the +tickets file), and +lists the principal names of all Kerberos tickets currently held by +the user, along with the issue and expire time for each authenticator. +Principal names are listed in the form +.I name.instance@realm, +with the '.' omitted if the instance is null, +and the '@' omitted if the realm is null. + +If given the +.B \-s +option, +.I klist +does not print the issue and expire times, the name of the tickets file, +or the identity of the principal. + +If given the +.B \-t +option, +.B klist +checks for the existence of a non-expired ticket-granting-ticket in the +ticket file. If one is present, it exits with status 0, else it exits +with status 1. No output is generated when this option is specified. + +If given the +.B \-file +option, the following argument is used as the ticket file. +Otherwise, if the +.B KRBTKFILE +environment variable is set, it is used. +If this environment variable +is not set, the file +.B /tmp/tkt[uid] +is used, where +.B uid +is the current user-id of the user. + +If given the +.B \-srvtab +option, the file is treated as a service key file, and the names of the +keys contained therein are printed. If no file is +specified with a +.B \-file +option, the default is +.IR /etc/kerberosIV/srvtab . +.SH FILES +.TP 2i +/etc/kerberosIV/krb.conf +to get the name of the local realm +.TP +/tmp/tkt[uid] +as the default ticket file ([uid] is the decimal UID of the user). +.TP +/etc/kerberosIV/srvtab +as the default service key file +.SH SEE ALSO +.PP +kerberos(1), kinit(1), kdestroy(1) +.SH BUGS +When reading a file as a service key file, very little sanity or error +checking is performed. diff --git a/usr/src/kerberosIV/man/krb.3 b/usr/src/kerberosIV/man/krb.3 new file mode 100644 index 0000000000..b08456aa10 --- /dev/null +++ b/usr/src/kerberosIV/man/krb.3 @@ -0,0 +1,462 @@ +.\" $Source: /usr/src/kerberosIV/man/RCS/kerberos.3,v $ +.\" $Author: kfall $ +.\" $Header: /usr/src/kerberosIV/man/RCS/kerberos.3,v 4.10 90/06/25 21:12:11 kfall Exp $ +.\" Copyright 1989 by the Massachusetts Institute of Technology. +.\" +.\" For copying and distribution information, +.\" please see the file . +.\" +.TH KERBEROS 3 "Kerberos Version 4.0" "MIT Project Athena" +.SH NAME +krb_mk_req, krb_rd_req, krb_kntoln, krb_set_key, krb_get_cred, +krb_mk_priv, krb_rd_priv, krb_mk_safe, krb_rd_safe, krb_mk_err, +krb_rd_err, krb_ck_repl \- Kerberos authentication library +.SH SYNOPSIS +.nf +.nj +.ft B +#include +#include +.PP +.ft B +extern char *krb_err_txt[]; +.PP +.ft B +int krb_mk_req(authent,service,instance,realm,checksum) +KTEXT authent; +char *service; +char *instance; +char *realm; +u_long checksum; +.PP +.ft B +int krb_rd_req(authent,service,instance,from_addr,ad,fn) +KTEXT authent; +char *service; +char *instance; +u_long from_addr; +AUTH_DAT *ad; +char *fn; +.PP +.ft B +int krb_kntoln(ad,lname) +AUTH_DAT *ad; +char *lname; +.PP +.ft B +int krb_set_key(key,cvt) +char *key; +int cvt; +.PP +.ft B +int krb_get_cred(service,instance,realm,c) +char *service; +char *instance; +char *realm; +CREDENTIALS *c; +.PP +.ft B +long krb_mk_priv(in,out,in_length,schedule,key,sender,receiver) +u_char *in; +u_char *out; +u_long in_length; +des_cblock key; +des_key_schedule schedule; +struct sockaddr_in *sender; +struct sockaddr_in *receiver; +.PP +.ft B +long krb_rd_priv(in,in_length,schedule,key,sender,receiver,msg_data) +u_char *in; +u_long in_length; +Key_schedule schedule; +des_cblock key; +struct sockaddr_in *sender; +struct sockaddr_in *receiver; +MSG_DAT *msg_data; +.PP +.ft B +long krb_mk_safe(in,out,in_length,key,sender,receiver) +u_char *in; +u_char *out; +u_long in_length; +des_cblock key; +struct sockaddr_in *sender; +struct sockaddr_in *receiver; +.PP +.ft B +long krb_rd_safe(in,length,key,sender,receiver,msg_data) +u_char *in; +u_long length; +des_cblock key; +struct sockaddr_in *sender; +struct sockaddr_in *receiver; +MSG_DAT *msg_data; +.PP +.ft B +long krb_mk_err(out,code,string) +u_char *out; +long code; +char *string; +.PP +.ft B +long krb_rd_err(in,length,code,msg_data) +u_char *in; +u_long length; +long code; +MSG_DAT *msg_data; +.fi +.ft R +.SH DESCRIPTION +This library supports network authentication and various related +operations. The library contains many routines beyond those described +in this man page, but they are not intended to be used directly. +Instead, they are called by the routines that are described, the +authentication server and the login program. +.PP +.I krb_err_txt[] +contains text string descriptions of various Kerberos error codes returned +by some of the routines below. +.PP +.I krb_mk_req +takes a pointer to a text structure in which an authenticator is to be +built. It also takes the name, instance, and realm of the service to be +used and an optional checksum. It is up to the application to decide +how to generate the checksum. +.I krb_mk_req +then retrieves a ticket for the desired service and creates an +authenticator. The authenticator is built in +.I authent +and is accessible +to the calling procedure. +.PP +It is up to the application to get the authenticator to the service +where it will be read by +.I krb_rd_req. +Unless an attacker posesses the session key contained in the ticket, it +will be unable to modify the authenticator. Thus, the checksum can be +used to verify the authenticity of the other data that will pass through +a connection. +.PP +.I krb_rd_req +takes an authenticator of type +.B KTEXT, +a service name, an instance, the address of the +host originating the request, and a pointer to a structure of type +.B AUTH_DAT +which is filled in with information obtained from the authenticator. +It also optionally takes the name of the file in which it will find the +secret key(s) for the service. +If the supplied +.I instance +contains "*", then the first service key with the same service name +found in the service key file will be used, and the +.I instance +argument will be filled in with the chosen instance. This means that +the caller must provide space for such an instance name. +.PP +It is used to find out information about the principal when a request +has been made to a service. It is up to the application protocol to get +the authenticator from the client to the service. The authenticator is +then passed to +.I krb_rd_req +to extract the desired information. +.PP +.I krb_rd_req +returns zero (RD_AP_OK) upon successful authentication. If a packet was +forged, modified, or replayed, authentication will fail. If the +authentication fails, a non-zero value is returned indicating the +particular problem encountered. See +.I krb.h +for the list of error codes. +.PP +If the last argument is the null string (""), krb_rd_req will use the +file /etc/srvtab to find its keys. If the last argument is NULL, it +will assume that the key has been set by +.I krb_set_key +and will not bother looking further. +.PP +.I krb_kntoln +converts a Kerberos name to a local name. It takes a structure +of type AUTH_DAT and uses the name and instance to look in the database +/etc/aname to find the corresponding local name. The local name is +returned and can be used by an application to change uids, directories, +or other parameters. It is not an integral part of Kerberos, but is +instead provided to support the use of Kerberos in existing utilities. +.PP +.I krb_set_key +takes as an argument a des key. It then creates +a key schedule from it and saves the original key to be used as an +initialization vector. +It is used to set the server's key which +must be used to decrypt tickets. +.PP +If called with a non-zero second argument, +.I krb_set_key +will first convert the input from a string of arbitrary length to a DES +key by encrypting it with a one-way function. +.PP +In most cases it should not be necessary to call +.I krb_set_key. +The necessary keys will usually be obtained and set inside +.I krb_rd_req. krb_set_key +is provided for those applications that do not wish to place the +application keys on disk. +.PP +.I krb_get_cred +searches the caller's ticket file for a ticket for the given service, instance, +and realm; and, if a ticket is found, fills in the given CREDENTIALS structure +with the ticket information. +.PP +If the ticket was found, +.I krb_get_cred +returns GC_OK. +If the ticket file can't be found, can't be read, doesn't belong to +the user (other than root), isn't a regular file, or is in the wrong +mode, the error GC_TKFIL is returned. +.PP +.I krb_mk_priv +creates an encrypted, authenticated +message from any arbitrary application data, pointed to by +.I in +and +.I in_length +bytes long. +The private session key, pointed to by +.I key +and the key schedule, +.I schedule, +are used to encrypt the data and some header information using +.I pcbc_encrypt. +.I sender +and +.I receiver +point to the Internet address of the two parties. +In addition to providing privacy, this protocol message protects +against modifications, insertions or replays. The encapsulated message and +header are placed in the area pointed to by +.I out +and the routine returns the length of the output, or -1 indicating +an error. +.PP +.I krb_rd_priv +decrypts and authenticates a received +.I krb_mk_priv +message. +.I in +points to the beginning of the received message, whose length +is specified in +.I in_length. +The private session key, pointed to by +.I key, +and the key schedule, +.I schedule, +are used to decrypt and verify the received message. +.I msg_data +is a pointer to a +.I MSG_DAT +struct, defined in +.I krb.h. +The routine fills in the +.I app_data +field with a pointer to the decrypted application data, +.I app_length +with the length of the +.I app_data +field, +.I time_sec +and +.I time_5ms +with the timestamps in the message, and +.I swap +with a 1 if the byte order of the receiver is different than that of +the sender. (The application must still determine if it is appropriate +to byte-swap application data; the Kerberos protocol fields are already taken +care of). The +.I hash +field returns a value useful as input to the +.I krb_ck_repl +routine. + +The routine returns zero if ok, or a Kerberos error code. Modified messages +and old messages cause errors, but it is up to the caller to +check the time sequence of messages, and to check against recently replayed +messages using +.I krb_ck_repl +if so desired. +.PP +.I krb_mk_safe +creates an authenticated, but unencrypted message from any arbitrary +application data, +pointed to by +.I in +and +.I in_length +bytes long. +The private session key, pointed to by +.I key, +is used to seed the +.I quad_cksum() +checksum algorithm used as part of the authentication. +.I sender +and +.I receiver +point to the Internet address of the two parties. +This message does not provide privacy, but does protect (via detection) +against modifications, insertions or replays. The encapsulated message and +header are placed in the area pointed to by +.I out +and the routine returns the length of the output, or -1 indicating +an error. +The authentication provided by this routine is not as strong as that +provided by +.I krb_mk_priv +or by computing the checksum using +.I cbc_cksum +instead, both of which authenticate via DES. +.PP + +.I krb_rd_safe +authenticates a received +.I krb_mk_safe +message. +.I in +points to the beginning of the received message, whose length +is specified in +.I in_length. +The private session key, pointed to by +.I key, +is used to seed the quad_cksum() routine as part of the authentication. +.I msg_data +is a pointer to a +.I MSG_DAT +struct, defined in +.I krb.h . +The routine fills in these +.I MSG_DAT +fields: +the +.I app_data +field with a pointer to the application data, +.I app_length +with the length of the +.I app_data +field, +.I time_sec +and +.I time_5ms +with the timestamps in the message, and +.I swap +with a 1 if the byte order of the receiver is different than that of +the sender. +(The application must still determine if it is appropriate +to byte-swap application data; the Kerberos protocol fields are already taken +care of). The +.I hash +field returns a value useful as input to the +.I krb_ck_repl +routine. + +The routine returns zero if ok, or a Kerberos error code. Modified messages +and old messages cause errors, but it is up to the caller to +check the time sequence of messages, and to check against recently replayed +messages using +.I krb_ck_repl +if so desired. +.PP +.I krb_mk_err +constructs an application level error message that may be used along +with +.I krb_mk_priv +or +.I krb_mk_safe. +.I out +is a pointer to the output buffer, +.I code +is an application specific error code, and +.I string +is an application specific error string. + +.PP +.I krb_rd_err +unpacks a received +.I krb_mk_err +message. +.I in +points to the beginning of the received message, whose length +is specified in +.I in_length. +.I code +is a pointer to a value to be filled in with the error +value provided by the application. +.I msg_data +is a pointer to a +.I MSG_DAT +struct, defined in +.I krb.h . +The routine fills in these +.I MSG_DAT +fields: the +.I app_data +field with a pointer to the application error text, +.I app_length +with the length of the +.I app_data +field, and +.I swap +with a 1 if the byte order of the receiver is different than that of +the sender. (The application must still determine if it is appropriate +to byte-swap application data; the Kerberos protocol fields are already taken +care of). + +The routine returns zero if the error message has been successfully received, +or a Kerberos error code. +.PP +The +.I KTEXT +structure is used to pass around text of varying lengths. It consists +of a buffer for the data, and a length. krb_rd_req takes an argument of this +type containing the authenticator, and krb_mk_req returns the +authenticator in a structure of this type. KTEXT itself is really a +pointer to the structure. The actual structure is of type KTEXT_ST. +.PP +The +.I AUTH_DAT +structure is filled in by krb_rd_req. It must be allocated before +calling krb_rd_req, and a pointer to it is passed. The structure is +filled in with data obtained from Kerberos. +.I MSG_DAT +structure is filled in by either krb_rd_priv, krb_rd_safe, or +krb_rd_err. It must be allocated before the call and a pointer to it +is passed. The structure is +filled in with data obtained from Kerberos. +.PP +.SH FILES +/usr/include/kerberosIV/krb.h +.br +/usr/lib/libkrb.a +.br +/usr/include/kerberosIV/des.h +.br +/usr/lib/libdes.a +.br +/etc/kerberosIV/aname +.br +/etc/kerberosIV/srvtab +.br +/tmp/tkt[uid] +.SH "SEE ALSO" +kerberos(1), des_crypt(3) +.SH DIAGNOSTICS +.SH BUGS +The caller of +.I krb_rd_req, krb_rd_priv, and krb_rd_safe +must check time order and for replay attempts. +.I krb_ck_repl +is not implemented yet. +.SH AUTHORS +Clifford Neuman, MIT Project Athena +.br +Steve Miller, MIT Project Athena/Digital Equipment Corporation +.SH RESTRICTIONS +COPYRIGHT 1985,1986,1989 Massachusetts Institute of Technology diff --git a/usr/src/kerberosIV/man/krb.conf.5 b/usr/src/kerberosIV/man/krb.conf.5 new file mode 100644 index 0000000000..a2113b71e5 --- /dev/null +++ b/usr/src/kerberosIV/man/krb.conf.5 @@ -0,0 +1,33 @@ +.\" $Source: /usr/src/kerberosIV/man/RCS/krb.conf.5,v $ +.\" $Author: kfall $ +.\" $Header: /usr/src/kerberosIV/man/RCS/krb.conf.5,v 4.2 90/06/25 21:12:18 kfall Exp $ +.\" Copyright 1989 by the Massachusetts Institute of Technology. +.\" +.\" For copying and distribution information, +.\" please see the file . +.\" +.TH KRB.CONF 5 "Kerberos Version 4.0" "MIT Project Athena" +.SH NAME +/etc/kerberosIV/krb.conf \- Kerberos configuration file +.SH DESCRIPTION +.I krb.conf +contains configuration information describing the Kerberos realm and the +Kerberos key distribution center (KDC) servers for known realms. +.PP +.I krb.conf +contains the name of the local realm in the first +line, followed by lines indicating realm/host +entries. The first token is a realm name, and the second is the hostname +of a host running a KDC for that realm. +The words "admin server" following the hostname indicate that +the host also provides an administrative database server. +For example: +.nf +.in +1i +ATHENA.MIT.EDU +ATHENA.MIT.EDU kerberos-1.mit.edu admin server +ATHENA.MIT.EDU kerberos-2.mit.edu +LCS.MIT.EDU kerberos.lcs.mit.edu admin server +.in -1i +.SH SEE ALSO +krb.realms(5), krb_get_krbhst(3), krb_get_lrealm(3) diff --git a/usr/src/kerberosIV/man/krb.realms.5 b/usr/src/kerberosIV/man/krb.realms.5 new file mode 100644 index 0000000000..da297682e4 --- /dev/null +++ b/usr/src/kerberosIV/man/krb.realms.5 @@ -0,0 +1,40 @@ +.\" $Source: /usr/src/kerberosIV/man/RCS/krb.realms.5,v $ +.\" $Author: kfall $ +.\" $Header: /usr/src/kerberosIV/man/RCS/krb.realms.5,v 4.2 90/06/25 21:12:20 kfall Exp $ +.\" Copyright 1989 by the Massachusetts Institute of Technology. +.\" +.\" For copying and distribution information, +.\" please see the file . +.\" +.TH KRB.REALMS 5 "Kerberos Version 4.0" "MIT Project Athena" +.SH NAME +/etc/kerberosIV/krb.realms \- host to Kerberos realm translation file +.SH DESCRIPTION +.I krb.realms +provides a translation from a hostname to the Kerberos realm name for +the services provided by that host. +.PP +Each line of the translation file is in one of the following forms +(domain_name should be of the form .XXX.YYY, e.g. .LCS.MIT.EDU): +.nf +.in +5n +host_name kerberos_realm +domain_name kerberos_realm +.in -5n +.fi +If a hostname exactly matches the +.I host_name +field in a line of the first +form, the corresponding realm is the realm of the host. +If a hostname does not match any +.I host_name +in the file, but its +domain exactly matches the +.I domain_name +field in a line of the second +form, the corresponding realm is the realm of the host. +.PP +If no translation entry applies, the host's realm is considered to be +the hostname's domain portion converted to upper case. +.SH SEE ALSO +krb_realmofhost(3) diff --git a/usr/src/kerberosIV/man/krb_realmofhost.3 b/usr/src/kerberosIV/man/krb_realmofhost.3 new file mode 100644 index 0000000000..400cfcff02 --- /dev/null +++ b/usr/src/kerberosIV/man/krb_realmofhost.3 @@ -0,0 +1,162 @@ +.\" $Source: /usr/src/kerberosIV/man/RCS/krb_realmofhost.3,v $ +.\" $Author: kfall $ +.\" $Header: /usr/src/kerberosIV/man/RCS/krb_realmofhost.3,v 4.2 90/06/25 21:12:23 kfall Exp $ +.\" Copyright 1989 by the Massachusetts Institute of Technology. +.\" +.\" For copying and distribution information, +.\" please see the file . +.\" +.TH KRB_REALMOFHOST 3 "Kerberos Version 4.0" "MIT Project Athena" +.SH NAME +krb_realmofhost, krb_get_phost, krb_get_krbhst, krb_get_admhst, +krb_get_lrealm \- additional Kerberos utility routines +.SH SYNOPSIS +.nf +.nj +.ft B +#include +#include +#include +.PP +.ft B +char *krb_realmofhost(host) +char *host; +.PP +.ft B +char *krb_get_phost(alias) +char *alias; +.PP +.ft B +krb_get_krbhst(host,realm,n) +char *host; +char *realm; +int n; +.PP +.ft B +krb_get_admhst(host,realm,n) +char *host; +char *realm; +int n; +.PP +.ft B +krb_get_lrealm(realm,n) +char *realm; +int n; +.fi +.ft R +.SH DESCRIPTION +.I krb_realmofhost +returns the Kerberos realm of the host +.IR host , +as determined by the translation table +.IR /etc/kerberosIV/krb.realms . +.I host +should be the fully-qualified domain-style primary host name of the host +in question. In order to prevent certain security attacks, this routine +must either have +.I a priori +knowledge of a host's realm, or obtain such information securely. +.PP +The format of the translation file is described by +.IR krb.realms (5). +If +.I host +exactly matches a host_name line, the corresponding realm +is returned. +Otherwise, if the domain portion of +.I host +matches a domain_name line, the corresponding realm +is returned. +If +.I host +contains a domain, but no translation is found, +.IR host 's +domain is converted to upper-case and returned. +If +.I host +contains no discernable domain, or an error occurs, +the local realm name, as supplied by +.IR krb_get_lrealm (3), +is returned. +.PP +.I krb_get_phost +converts the hostname +.I alias +(which can be either an official name or an alias) into the instance +name to be used in obtaining Kerberos tickets for most services, +including the Berkeley rcmd suite (rlogin, rcp, rsh). +.br +The current convention is to return the first segment of the official +domain-style name after conversion to lower case. +.PP +.I krb_get_krbhst +fills in +.I host +with the hostname of the +.IR n th +host running a Kerberos key distribution center (KDC) +for realm +.IR realm , +as specified in the configuration file (\fI/etc/kerberosIV/krb.conf\fR). +The configuration file is described by +.IR krb.conf (5). +If the host is successfully filled in, the routine +returns KSUCCESS. +If the file cannot be opened, and +.I n +equals 1, then the value of KRB_HOST as defined in +.I +is filled in, and KSUCCESS is returned. If there are fewer than +.I n +hosts running a Kerberos KDC for the requested realm, or the +configuration file is malformed, the routine +returns KFAILURE. +.PP +.I krb_get_admhst +fills in +.I host +with the hostname of the +.IR n th +host running a Kerberos KDC database administration server +for realm +.IR realm , +as specified in the configuration file (\fI/etc/kerberosIV/krb.conf\fR). +If the file cannot be opened or is malformed, or there are fewer than +.I n +hosts running a Kerberos KDC database administration server, +the routine returns KFAILURE. +.PP +The character arrays used as return values for +.IR krb_get_krbhst , +.IR krb_get_admhst , +should be large enough to +hold any hostname (MAXHOSTNAMELEN from ). +.PP +.I krb_get_lrealm +fills in +.I realm +with the +.IR n th +realm of the local host, as specified in the configuration file. +.I realm +should be at least REALM_SZ (from +.IR ) characters long. +.PP +.SH SEE ALSO +kerberos(3), krb.conf(5), krb.realms(5) +.SH FILES +.TP 20n +/etc/kerberosIV/krb.realms +translation file for host-to-realm mapping. +.TP +/etc/kerberosIV/krb.conf +local realm-name and realm/server configuration file. +.SH BUGS +The current convention for instance names is too limited; the full +domain name should be used. +.PP +.I krb_get_lrealm +currently only supports +.I n += 1. It should really consult the user's ticket cache to determine the +user's current realm, rather than consulting a file on the host. diff --git a/usr/src/kerberosIV/man/krb_sendauth.3 b/usr/src/kerberosIV/man/krb_sendauth.3 new file mode 100644 index 0000000000..34e0a0d7e2 --- /dev/null +++ b/usr/src/kerberosIV/man/krb_sendauth.3 @@ -0,0 +1,349 @@ +.\" $Source: /usr/src/kerberosIV/man/RCS/krb_sendauth.3,v $ +.\" $Author: kfall $ +.\" $Header: /usr/src/kerberosIV/man/RCS/krb_sendauth.3,v 4.2 90/06/25 21:12:26 kfall Exp $ +.\" Copyright 1988 by the Massachusetts Institute of Technology. +.\" +.\" For copying and distribution information, +.\" please see the file . +.\" +.TH KRB_SENDAUTH 3 "Kerberos Version 4.0" "MIT Project Athena" +.SH NAME +krb_sendauth, krb_recvauth, krb_net_write, krb_net_read \- +Kerberos routines for sending authentication via network stream sockets +.SH SYNOPSIS +.nf +.nj +.ft B +#include +#include +#include +.PP +.fi +.HP 1i +.ft B +int krb_sendauth(options, fd, ktext, service, inst, realm, checksum, +msg_data, cred, schedule, laddr, faddr, version) +.nf +.RS 0 +.ft B +long options; +int fd; +KTEXT ktext; +char *service, *inst, *realm; +u_long checksum; +MSG_DAT *msg_data; +CREDENTIALS *cred; +Key_schedule schedule; +struct sockaddr_in *laddr, *faddr; +char *version; +.PP +.fi +.HP 1i +.ft B +int krb_recvauth(options, fd, ktext, service, inst, faddr, laddr, +auth_data, filename, schedule, version) +.nf +.RS 0 +.ft B +long options; +int fd; +KTEXT ktext; +char *service, *inst; +struct sockaddr_in *faddr, *laddr; +AUTH_DAT *auth_data; +char *filename; +Key_schedule schedule; +char *version; +.PP +.ft B +int krb_net_write(fd, buf, len) +int fd; +char *buf; +int len; +.PP +.ft B +int krb_net_read(fd, buf, len) +int fd; +char *buf; +int len; +.fi +.SH DESCRIPTION +.PP +These functions, +which are built on top of the core Kerberos library, +provide a convenient means for client and server +programs to send authentication messages +to one another through network connections. +The +.I krb_sendauth +function sends an authenticated ticket from the client program to +the server program by writing the ticket to a network socket. +The +.I krb_recvauth +function receives the ticket from the client by +reading from a network socket. + +.SH KRB_SENDAUTH +.PP +This function writes the ticket to +the network socket specified by the +file descriptor +.IR fd, +returning KSUCCESS if the write proceeds successfully, +and an error code if it does not. + +The +.I ktext +argument should point to an allocated KTEXT_ST structure. +The +.IR service, +.IR inst, +and +.IR realm +arguments specify the server program's Kerberos principal name, +instance, and realm. +If you are writing a client that uses the local realm exclusively, +you can set the +.I realm +argument to NULL. + +The +.I version +argument allows the client program to pass an application-specific +version string that the server program can then match against +its own version string. +The +.I version +string can be up to KSEND_VNO_LEN (see +.IR ) +characters in length. + +The +.I checksum +argument can be used to pass checksum information to the +server program. +The client program is responsible for specifying this information. +This checksum information is difficult to corrupt because +.I krb_sendauth +passes it over the network in encrypted form. +The +.I checksum +argument is passed as the checksum argument to +.IR krb_mk_req . + +You can set +.IR krb_sendauth's +other arguments to NULL unless you want the +client and server programs to mutually authenticate +themselves. +In the case of mutual authentication, +the client authenticates itself to the server program, +and demands that the server in turn authenticate itself to +the client. + +.SH KRB_SENDAUTH AND MUTUAL AUTHENTICATION +.PP +If you want mutual authentication, +make sure that you read all pending data from the local socket +before calling +.IR krb_sendauth. +Set +.IR krb_sendauth's +.I options +argument to +.BR KOPT_DO_MUTUAL +(this macro is defined in the +.IR krb.h +file); +make sure that the +.I laddr +argument points to +the address of the local socket, +and that +.I faddr +points to the foreign socket's network address. + +.I Krb_sendauth +fills in the other arguments-- +.IR msg_data , +.IR cred , +and +.IR schedule --before +sending the ticket to the server program. +You must, however, allocate space for these arguments +before calling the function. + +.I Krb_sendauth +supports two other options: +.BR KOPT_DONT_MK_REQ, +and +.BR KOPT_DONT_CANON. +If called with +.I options +set as KOPT_DONT_MK_REQ, +.I krb_sendauth +will not use the +.I krb_mk_req +function to retrieve the ticket from the Kerberos server. +The +.I ktext +argument must point to an existing ticket and authenticator (such as +would be created by +.IR krb_mk_req ), +and the +.IR service, +.IR inst, +and +.IR realm +arguments can be set to NULL. + +If called with +.I options +set as KOPT_DONT_CANON, +.I krb_sendauth +will not convert the service's instance to canonical form using +.IR krb_get_phost (3). + +If you want to call +.I krb_sendauth +with a multiple +.I options +specification, +construct +.I options +as a bitwise-OR of the options you want to specify. + +.SH KRB_RECVAUTH +.PP +The +.I krb_recvauth +function +reads a ticket/authenticator pair from the socket pointed to by the +.I fd +argument. +Set the +.I options +argument +as a bitwise-OR of the options desired. +Currently only KOPT_DO_MUTUAL is useful to the receiver. + +The +.I ktext +argument +should point to an allocated KTEXT_ST structure. +.I Krb_recvauth +fills +.I ktext +with the +ticket/authenticator pair read from +.IR fd , +then passes it to +.IR krb_rd_req . + +The +.I service +and +.I inst +arguments +specify the expected service and instance for which the ticket was +generated. They are also passed to +.IR krb_rd_req. +The +.I inst +argument may be set to "*" if the caller wishes +.I krb_mk_req +to fill in the instance used (note that there must be space in the +.I inst +argument to hold a full instance name, see +.IR krb_mk_req (3)). + +The +.I faddr +argument +should point to the address of the peer which is presenting the ticket. +It is also passed to +.IR krb_rd_req . + +If the client and server plan to mutually authenticate +one another, +the +.I laddr +argument +should point to the local address of the file descriptor. +Otherwise you can set this argument to NULL. + +The +.I auth_data +argument +should point to an allocated AUTH_DAT area. +It is passed to and filled in by +.IR krb_rd_req . +The checksum passed to the corresponding +.I krb_sendauth +is available as part of the filled-in AUTH_DAT area. + +The +.I filename +argument +specifies the filename +which the service program should use to obtain its service key. +.I Krb_recvauth +passes +.I filename +to the +.I krb_rd_req +function. +If you set this argument to "", +.I krb_rd_req +looks for the service key in the file +.IR /etc/kerberosIV/srvtab. + +If the client and server are performing mutual authenication, +the +.I schedule +argument +should point to an allocated Key_schedule. +Otherwise it is ignored and may be NULL. + +The +.I version +argument should point to a character array of at least KSEND_VNO_LEN +characters. It is filled in with the version string passed by the client to +.IR krb_sendauth. +.PP +.SH KRB_NET_WRITE AND KRB_NET_READ +.PP +The +.I krb_net_write +function +emulates the write(2) system call, but guarantees that all data +specified is written to +.I fd +before returning, unless an error condition occurs. +.PP +The +.I krb_net_read +function +emulates the read(2) system call, but guarantees that the requested +amount of data is read from +.I fd +before returning, unless an error condition occurs. +.PP +.SH BUGS +.IR krb_sendauth, +.IR krb_recvauth, +.IR krb_net_write, +and +.IR krb_net_read +will not work properly on sockets set to non-blocking I/O mode. + +.SH SEE ALSO + +krb_mk_req(3), krb_rd_req(3), krb_get_phost(3) + +.SH AUTHOR +John T. Kohl, MIT Project Athena +.SH RESTRICTIONS +Copyright 1988, Massachusetts Instititute of Technology. +For copying and distribution information, +please see the file . diff --git a/usr/src/kerberosIV/man/krb_set_tkt_string.3 b/usr/src/kerberosIV/man/krb_set_tkt_string.3 new file mode 100644 index 0000000000..2e361eb0de --- /dev/null +++ b/usr/src/kerberosIV/man/krb_set_tkt_string.3 @@ -0,0 +1,44 @@ +.\" $Source: /usr/src/kerberosIV/man/RCS/krb_set_tkt_string.3,v $ +.\" $Author: kfall $ +.\" $Header: /usr/src/kerberosIV/man/RCS/krb_set_tkt_string.3,v 4.2 90/06/25 21:12:29 kfall Exp $ +.\" Copyright 1989 by the Massachusetts Institute of Technology. +.\" +.\" For copying and distribution information, +.\" please see the file . +.\" +.TH KRB_SET_TKT_STRING 3 "Kerberos Version 4.0" "MIT Project Athena" +.SH NAME +krb_set_tkt_string \- set Kerberos ticket cache file name +.SH SYNOPSIS +.nf +.nj +.ft B +#include +.PP +.ft B +void krb_set_tkt_string(filename) +char *filename; +.fi +.ft R +.SH DESCRIPTION +.I krb_set_tkt_string +sets the name of the file that holds the user's +cache of Kerberos server tickets and associated session keys. +.PP +The string +.I filename +passed in is copied into local storage. +Only MAXPATHLEN-1 (see ) characters of the filename are +copied in for use as the cache file name. +.PP +This routine should be called during initialization, before other +Kerberos routines are called; otherwise the routines which fetch the +ticket cache file name may be called and return an undesired ticket file +name until this routine is called. +.SH FILES +.TP 20n +/tmp/tkt[uid] +default ticket file name, unless the environment variable KRBTKFILE is set. +[uid] denotes the user's uid, in decimal. +.SH SEE ALSO +kerberos(3), setenv(3) diff --git a/usr/src/kerberosIV/man/ksrvtgt.1 b/usr/src/kerberosIV/man/ksrvtgt.1 new file mode 100644 index 0000000000..53429dccca --- /dev/null +++ b/usr/src/kerberosIV/man/ksrvtgt.1 @@ -0,0 +1,52 @@ +.\" $Source: /usr/src/kerberosIV/man/RCS/ksrvtgt.1,v $ +.\" $Author: kfall $ +.\" $Header: /usr/src/kerberosIV/man/RCS/ksrvtgt.1,v 4.2 90/06/25 21:12:32 kfall Exp $ +.\" Copyright 1989 by the Massachusetts Institute of Technology. +.\" +.\" For copying and distribution information, +.\" please see the file . +.\" +.TH KSRVTGT 1 "Kerberos Version 4.0" "MIT Project Athena" +.SH NAME +ksrvtgt \- fetch and store Kerberos ticket-granting-ticket using a +service key +.SH SYNOPSIS +.B ksrvtgt +name instance [[realm] srvtab] +.SH DESCRIPTION +.I ksrvtgt +retrieves a ticket-granting ticket with a lifetime of five (5) minutes +for the principal +.I name.instance@realm +(or +.I name.instance@localrealm +if +.I realm +is not supplied on the command line), decrypts the response using +the service key found in +.I srvtab +(or in +.B /etc/kerberosIV/srvtab +if +.I srvtab +is not specified on the command line), and stores the ticket in the +standard ticket cache. +.PP +This command is intended primarily for use in shell scripts and other +batch-type facilities. +.SH DIAGNOSTICS +"Generic kerberos failure (kfailure)" can indicate a whole range of +problems, the most common of which is the inability to read the service +key file. +.SH FILES +.TP 2i +/etc/kerberosIV/krb.conf +to get the name of the local realm. +.TP +/tmp/tkt[uid] +The default ticket file. +.TP +/etc/kerberosIV/srvtab +The default service key file. +.SH SEE ALSO +kerberos(1), kinit(1), kdestroy(1) diff --git a/usr/src/kerberosIV/man/kstash.8 b/usr/src/kerberosIV/man/kstash.8 new file mode 100644 index 0000000000..b0680cb2e4 --- /dev/null +++ b/usr/src/kerberosIV/man/kstash.8 @@ -0,0 +1,42 @@ +.\" $Source: /usr/src/kerberosIV/man/RCS/kstash.8,v $ +.\" $Author: kfall $ +.\" $Header: /usr/src/kerberosIV/man/RCS/kstash.8,v 4.2 90/06/25 21:12:35 kfall Exp $ +.\" Copyright 1989 by the Massachusetts Institute of Technology. +.\" +.\" For copying and distribution information, +.\" please see the file . +.\" +.TH KSTASH 8 "Kerberos Version 4.0" "MIT Project Athena" +.SH NAME +kstash \- stash Kerberos key distribution center database master key +.SH SYNOPSIS +kstash +.SH DESCRIPTION +.I kstash +saves the Kerberos key distribution center (KDC) database master key in +the master key cache file. +.PP +The user is prompted to enter the key, to verify the authenticity of the +key and the authorization to store the key in the file. +.SH DIAGNOSTICS +.TP 20n +"verify_master_key: Invalid master key, does not match database." +The master key string entered was incorrect. +.TP +"kstash: Unable to open master key file" +The attempt to open the cache file for writing failed (probably due to a +system or access permission error). +.TP +"kstash: Write I/O error on master key file" +The +.BR write (2) +system call returned an error while +.I kstash +was attempting to write the key to the file. +.SH FILES +.TP 20n +/etc/kerberosIV/principal.pag, /etc/kerberosIV/principal.dir +DBM files containing database +.TP +/etc/kerberosIV/master_key +Master key cache file. diff --git a/usr/src/kerberosIV/man/kuserok.3 b/usr/src/kerberosIV/man/kuserok.3 new file mode 100644 index 0000000000..6fcd6e566f --- /dev/null +++ b/usr/src/kerberosIV/man/kuserok.3 @@ -0,0 +1,64 @@ +.\" $Source: /usr/src/kerberosIV/man/RCS/kuserok.3,v $ +.\" $Author: kfall $ +.\" $Header: /usr/src/kerberosIV/man/RCS/kuserok.3,v 4.2 90/06/25 21:12:39 kfall Exp $ +.\" Copyright 1989 by the Massachusetts Institute of Technology. +.\" +.\" For copying and distribution information, +.\" please see the file . +.\" +.TH KUSEROK 3 "Kerberos Version 4.0" "MIT Project Athena" +.SH NAME +kuserok \- Kerberos version of ruserok +.SH SYNOPSIS +.nf +.nj +.ft B +#include +.PP +.ft B +kuserok(kdata, localuser) +AUTH_DAT *auth_data; +char *localuser; +.fi +.ft R +.SH DESCRIPTION +.I kuserok +determines whether a Kerberos principal described by the structure +.I auth_data +is authorized to login as user +.I localuser +according to the authorization file +("~\fIlocaluser\fR/.klogin" by default). It returns 0 (zero) if authorized, +1 (one) if not authorized. +.PP +If there is no account for +.I localuser +on the local machine, authorization is not granted. +If there is no authorization file, and the Kerberos principal described +by +.I auth_data +translates to +.I localuser +(using +.IR krb_kntoln (3)), +authorization is granted. +If the authorization file +can't be accessed, or the file is not owned by +.IR localuser, +authorization is denied. Otherwise, the file is searched for +a matching principal name, instance, and realm. If a match is found, +authorization is granted, else authorization is denied. +.PP +The file entries are in the format: +.nf +.in +5n + name.instance@realm +.in -5n +.fi +with one entry per line. +.SH SEE ALSO +kerberos(3), ruserok(3), krb_kntoln(3) +.SH FILES +.TP 20n +~\fIlocaluser\fR/.klogin +authorization list diff --git a/usr/src/kerberosIV/man/tf_util.3 b/usr/src/kerberosIV/man/tf_util.3 new file mode 100644 index 0000000000..0f0a62a086 --- /dev/null +++ b/usr/src/kerberosIV/man/tf_util.3 @@ -0,0 +1,152 @@ +.\" $Source: /usr/src/kerberosIV/man/RCS/tf_util.3,v $ +.\" $Author: kfall $ +.\" $Header: /usr/src/kerberosIV/man/RCS/tf_util.3,v 4.3 90/06/25 21:12:43 kfall Exp $ +.\" Copyright 1989 by the Massachusetts Institute of Technology. +.\" +.\" For copying and distribution information, +.\" please see the file . +.\" +.TH TF_UTIL 3 "Kerberos Version 4.0" "MIT Project Athena" +.SH NAME +tf_init, tf_get_pname, tf_get_pinst, tf_get_cred, tf_close \ +\- Routines for manipulating a Kerberos ticket file +.SH SYNOPSIS +.nf +.nj +.ft B +#include +.PP +.ft B +extern char *krb_err_txt[]; +.PP +.ft B +tf_init(tf_name, rw) +char *tf_name; +int rw; +.PP +.ft B +tf_get_pname(pname) +char *pname; +.PP +.ft B +tf_get_pinst(pinst) +char *pinst; +.PP +.ft B +tf_get_cred(c) +CREDENTIALS *c; +.PP +.ft B +tf_close() +.PP +.fi +.SH DESCRIPTION +This group of routines are provided to manipulate the Kerberos tickets +file. A ticket file has the following format: +.nf +.in +4 +.sp +principal's name (null-terminated string) +principal's instance (null-terminated string) +CREDENTIAL_1 +CREDENTIAL_2 + ... +CREDENTIAL_n +EOF +.sp +.in -4 +.LP +Where "CREDENTIAL_x" consists of the following fixed-length +fields from the CREDENTIALS structure (defined in ): +.nf +.sp +.in +4 + char service[ANAME_SZ] + char instance[INST_SZ] + char realm[REALM_SZ] + des_cblock session + int lifetime + int kvno + KTEXT_ST ticket_st + long issue_date +.in -4 +.sp +.fi +.PP +.I tf_init +must be called before the other ticket file +routines. +It takes the name of the ticket file to use, +and a read/write flag as arguments. +It tries to open the ticket file, checks the mode and if +everything is okay, locks the file. If it's opened for +reading, the lock is shared. If it's opened for writing, +the lock is exclusive. +KSUCCESS is returned if all went well, otherwise one of the +following: +.nf +.sp +NO_TKT_FIL - file wasn't there +TKT_FIL_ACC - file was in wrong mode, etc. +TKT_FIL_LCK - couldn't lock the file, even after a retry +.sp +.fi +.PP +The +.I tf_get_pname +reads the principal's name from a ticket file. +It should only be called after tf_init has been called. The +principal's name is filled into the +.I pname +parameter. If all goes +well, KSUCCESS is returned. +If tf_init wasn't called, TKT_FIL_INI +is returned. +If the principal's name was null, or EOF was encountered, or the +name was longer than ANAME_SZ, TKT_FIL_FMT is returned. +.PP +The +.I tf_get_pinst +reads the principal's instance from a ticket file. +It should only be called after tf_init and tf_get_pname +have been called. +The principal's instance is filled into the +.I pinst +parameter. +If all goes +well, KSUCCESS is returned. +If tf_init wasn't called, TKT_FIL_INI +is returned. +If EOF was encountered, or the +name was longer than INST_SZ, TKT_FIL_FMT is returned. +Note that, unlike the principal name, the instance name may be null. +.PP +The +.I tf_get_cred +routine reads a CREDENTIALS record from a ticket file and +fills in the given structure. +It should only be called after +tf_init, tf_get_pname, and tf_get_pinst have been called. +If all goes well, KSUCCESS is returned. Possible error codes +are: +.nf +.sp +TKT_FIL_INI - tf_init wasn't called first +TKT_FIL_FMT - bad format +EOF - end of file encountered +.sp +.fi +.PP +.I tf_close +closes the ticket file and releases the lock on it. +.SH "SEE ALSO" +krb(3) +.SH DIAGNOSTICS +.SH BUGS +The ticket file routines have to be called in a certain order. +.SH AUTHORS +Jennifer Steiner, MIT Project Athena +.br +Bill Bryant, MIT Project Athena +.SH RESTRICTIONS +Copyright 1987 Massachusetts Institute of Technology -- 2.20.1