From b105201239c04ed3b95a16df628e70dee3996486 Mon Sep 17 00:00:00 2001 From: CSRG Date: Sun, 14 May 1995 01:40:21 -0800 Subject: [PATCH] BSD 4_4_Lite2 development Work on file usr/share/man/cat1/register.0 Work on file usr/share/man/cat8/registerd.0 Work on file usr/share/man/cat8/make_keypair.0 Work on file usr/share/man/cat1/ksrvtgt.0 Work on file usr/share/man/cat1/klist.0 Work on file usr/share/man/cat1/kdestroy.0 Work on file usr/share/man/cat1/kerberos.0 Work on file usr/share/man/cat3/acl_check.0 Work on file usr/share/man/cat1/kinit.0 Work on file usr/share/man/cat3/krb_rd_err.0 Work on file usr/share/man/cat3/krb_realmofhost.0 Work on file usr/share/man/cat3/krb_sendauth.0 Work on file usr/share/man/cat3/kerberos.0 Work on file usr/share/man/cat3/krb_kntoln.0 Work on file usr/share/man/cat3/krb_mk_req.0 Work on file usr/share/man/cat3/krb_rd_req.0 Work on file usr/share/man/cat3/krb.0 Work on file usr/share/man/cat3/realm.0 Work on file usr/share/man/cat3/krb_rd_safe.0 Work on file usr/share/man/cat3/krb_set_tkt_string.0 Work on file usr/share/man/cat3/krb_get_cred.0 Work on file usr/share/man/cat3/des_crypt.0 Work on file usr/share/man/cat3/des.0 Work on file usr/share/man/cat3/ksend.0 Work on file usr/share/man/cat3/krb_ck_repl.0 Work on file usr/share/man/cat3/krb_set_key.0 Work on file usr/share/man/cat3/krb_mk_err.0 Work on file usr/share/man/cat3/krb_mk_safe.0 Work on file usr/share/man/cat3/krb_mk_priv.0 Work on file usr/share/man/cat8/ext_srvtab.0 Work on file usr/share/man/cat5/krb.conf.0 Work on file usr/share/man/cat5/krb.realms.0 Work on file usr/share/man/cat8/kdb_destroy.0 Work on file usr/share/man/cat3/tf_util.0 Work on file usr/share/man/cat3/kuserok.0 Work on file usr/share/man/cat8/kdb_edit.0 Work on file usr/share/man/cat8/kdb_init.0 Work on file usr/share/man/cat8/kstash.0 Work on file usr/share/man/cat8/kdb_util.0 Synthesized-from: CSRG/cd3/4.4BSD-Lite2 --- usr/share/man/cat1/kdestroy.0 | 132 +++++++ usr/share/man/cat1/kerberos.0 | 198 ++++++++++ usr/share/man/cat1/kinit.0 | 132 +++++++ usr/share/man/cat1/klist.0 | 132 +++++++ usr/share/man/cat1/ksrvtgt.0 | 66 ++++ usr/share/man/cat1/register.0 | 66 ++++ usr/share/man/cat3/acl_check.0 | 198 ++++++++++ usr/share/man/cat3/des.0 | 396 ++++++++++++++++++++ usr/share/man/cat3/des_crypt.0 | 396 ++++++++++++++++++++ usr/share/man/cat3/kerberos.0 | 462 ++++++++++++++++++++++++ usr/share/man/cat3/krb.0 | 462 ++++++++++++++++++++++++ usr/share/man/cat3/krb_ck_repl.0 | 462 ++++++++++++++++++++++++ usr/share/man/cat3/krb_get_cred.0 | 462 ++++++++++++++++++++++++ usr/share/man/cat3/krb_kntoln.0 | 462 ++++++++++++++++++++++++ usr/share/man/cat3/krb_mk_err.0 | 462 ++++++++++++++++++++++++ usr/share/man/cat3/krb_mk_priv.0 | 462 ++++++++++++++++++++++++ usr/share/man/cat3/krb_mk_req.0 | 462 ++++++++++++++++++++++++ usr/share/man/cat3/krb_mk_safe.0 | 462 ++++++++++++++++++++++++ usr/share/man/cat3/krb_rd_err.0 | 462 ++++++++++++++++++++++++ usr/share/man/cat3/krb_rd_req.0 | 462 ++++++++++++++++++++++++ usr/share/man/cat3/krb_rd_safe.0 | 462 ++++++++++++++++++++++++ usr/share/man/cat3/krb_realmofhost.0 | 198 ++++++++++ usr/share/man/cat3/krb_sendauth.0 | 264 ++++++++++++++ usr/share/man/cat3/krb_set_key.0 | 462 ++++++++++++++++++++++++ usr/share/man/cat3/krb_set_tkt_string.0 | 66 ++++ usr/share/man/cat3/ksend.0 | 264 ++++++++++++++ usr/share/man/cat3/kuserok.0 | 66 ++++ usr/share/man/cat3/realm.0 | 198 ++++++++++ usr/share/man/cat3/tf_util.0 | 198 ++++++++++ usr/share/man/cat5/krb.conf.0 | 66 ++++ usr/share/man/cat5/krb.realms.0 | 66 ++++ usr/share/man/cat8/ext_srvtab.0 | 66 ++++ usr/share/man/cat8/kdb_destroy.0 | 66 ++++ usr/share/man/cat8/kdb_edit.0 | 66 ++++ usr/share/man/cat8/kdb_init.0 | 66 ++++ usr/share/man/cat8/kdb_util.0 | 132 +++++++ usr/share/man/cat8/kstash.0 | 66 ++++ usr/share/man/cat8/make_keypair.0 | 31 ++ usr/share/man/cat8/registerd.0 | 31 ++ 39 files changed, 9632 insertions(+) create mode 100644 usr/share/man/cat1/kdestroy.0 create mode 100644 usr/share/man/cat1/kerberos.0 create mode 100644 usr/share/man/cat1/kinit.0 create mode 100644 usr/share/man/cat1/klist.0 create mode 100644 usr/share/man/cat1/ksrvtgt.0 create mode 100644 usr/share/man/cat1/register.0 create mode 100644 usr/share/man/cat3/acl_check.0 create mode 100644 usr/share/man/cat3/des.0 create mode 100644 usr/share/man/cat3/des_crypt.0 create mode 100644 usr/share/man/cat3/kerberos.0 create mode 100644 usr/share/man/cat3/krb.0 create mode 100644 usr/share/man/cat3/krb_ck_repl.0 create mode 100644 usr/share/man/cat3/krb_get_cred.0 create mode 100644 usr/share/man/cat3/krb_kntoln.0 create mode 100644 usr/share/man/cat3/krb_mk_err.0 create mode 100644 usr/share/man/cat3/krb_mk_priv.0 create mode 100644 usr/share/man/cat3/krb_mk_req.0 create mode 100644 usr/share/man/cat3/krb_mk_safe.0 create mode 100644 usr/share/man/cat3/krb_rd_err.0 create mode 100644 usr/share/man/cat3/krb_rd_req.0 create mode 100644 usr/share/man/cat3/krb_rd_safe.0 create mode 100644 usr/share/man/cat3/krb_realmofhost.0 create mode 100644 usr/share/man/cat3/krb_sendauth.0 create mode 100644 usr/share/man/cat3/krb_set_key.0 create mode 100644 usr/share/man/cat3/krb_set_tkt_string.0 create mode 100644 usr/share/man/cat3/ksend.0 create mode 100644 usr/share/man/cat3/kuserok.0 create mode 100644 usr/share/man/cat3/realm.0 create mode 100644 usr/share/man/cat3/tf_util.0 create mode 100644 usr/share/man/cat5/krb.conf.0 create mode 100644 usr/share/man/cat5/krb.realms.0 create mode 100644 usr/share/man/cat8/ext_srvtab.0 create mode 100644 usr/share/man/cat8/kdb_destroy.0 create mode 100644 usr/share/man/cat8/kdb_edit.0 create mode 100644 usr/share/man/cat8/kdb_init.0 create mode 100644 usr/share/man/cat8/kdb_util.0 create mode 100644 usr/share/man/cat8/kstash.0 create mode 100644 usr/share/man/cat8/make_keypair.0 create mode 100644 usr/share/man/cat8/registerd.0 diff --git a/usr/share/man/cat1/kdestroy.0 b/usr/share/man/cat1/kdestroy.0 new file mode 100644 index 0000000000..59a1849bca --- /dev/null +++ b/usr/share/man/cat1/kdestroy.0 @@ -0,0 +1,132 @@ + + + +KDESTROY(1) BSD Reference Manual KDESTROY(1) + + +NNAAMMEE + kdestroy - destroy Kerberos tickets + +SSYYNNOOPPSSIISS + kkddeessttrrooyy [ --ff ] [ --qq ] + +DDEESSCCRRIIPPTTIIOONN + The _k_d_e_s_t_r_o_y utility destroys the user's active Kerberos + authorization tickets by writing zeros to the file that + contains them. If the ticket file does not exist, _k_d_e_- + _s_t_r_o_y displays a message to that effect. + + After overwriting the file, _k_d_e_s_t_r_o_y removes the file from + the system. The utility displays a message indicating the + success or failure of the operation. If _k_d_e_s_t_r_o_y is + unable to destroy the ticket file, the utility will warn + you by making your terminal beep. + + In the Athena workstation environment, the _t_o_e_h_o_l_d service + automatically destroys your tickets when you end a work- + station session. If your site does not provide a similar + ticket-destroying mechanism, you can place the _k_d_e_s_t_r_o_y + command in your _._l_o_g_o_u_t file so that your tickets are + destroyed automatically when you logout. + + The options to _k_d_e_s_t_r_o_y are as follows: + + --ff _k_d_e_s_t_r_o_y runs without displaying the status mes- + sage. + + --qq _k_d_e_s_t_r_o_y will not make your terminal beep if it + fails to destroy the tickets. + +FFIILLEESS + KRBTKFILE environment variable if set, otherwise + /tmp/tkt[uid] + +SSEEEE AALLSSOO + kerberos(1), kinit(1), klist(1) + +BBUUGGSS + Only the tickets in the user's current ticket file are + destroyed. Separate ticket files are used to hold root + instance and password changing tickets. These files + should probably be destroyed too, or all of a user's tick- + ets kept in a single ticket file. + +AAUUTTHHOORRSS + Steve Miller, MIT Project Athena/Digital Equipment Corpo- + ration + Clifford Neuman, MIT Project Athena + + + +MIT Project Athena Kerberos Version 4.0 1 + + + + + + + + +KDESTROY(1) BSD Reference Manual KDESTROY(1) + + + Bill Sommerfeld, MIT Project Athena + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +MIT Project Athena Kerberos Version 4.0 2 + + + + + diff --git a/usr/share/man/cat1/kerberos.0 b/usr/share/man/cat1/kerberos.0 new file mode 100644 index 0000000000..7607076e93 --- /dev/null +++ b/usr/share/man/cat1/kerberos.0 @@ -0,0 +1,198 @@ + + + +KERBEROS(1) BSD Reference Manual KERBEROS(1) + + +NNAAMMEE + kerberos - introduction to the Kerberos system + + +DDEESSCCRRIIPPTTIIOONN + The Kerberos system authenticates individual users in a + network environment. After authenticating yourself to + Kerberos, you can use network utilities such as _r_l_o_g_i_n, + _r_c_p, and _r_s_h without having to present passwords to remote + hosts and without having to bother with _._r_h_o_s_t_s files. + Note that these utilities will work without passwords only + if the remote machines you deal with support the Kerberos + system. All Athena timesharing machines and public work- + stations support Kerberos. + + Before you can use Kerberos, you must register as an + Athena user, and you must make sure you have been added to + the Kerberos database. You can use the _k_i_n_i_t command to + find out. This command tries to log you into the Kerberos + system. _k_i_n_i_t will prompt you for a username and pass- + word. Enter your username and password. If the utility + lets you login without giving you a message, you have + already been registered. + + If you enter your username and _k_i_n_i_t responds with this + message: + + Principal unknown (kerberos) + + you haven't been registered as a Kerberos user. See your + system administrator. + + A Kerberos name contains three parts. The first is the + _p_r_i_n_c_i_p_a_l _n_a_m_e_, which is usually a user's or service's + name. The second is the _i_n_s_t_a_n_c_e_, which in the case of a + user is usually null. Some users may have privileged + instances, however, such as ``root'' or ``admin''. In the + case of a service, the instance is the name of the machine + on which it runs; i.e. there can be an _r_l_o_g_i_n service run- + ning on the machine ABC, which is different from the + rlogin service running on the machine XYZ. The third part + of a Kerberos name is the _r_e_a_l_m_. The realm corresponds to + the Kerberos service providing authentication for the + principal. For example, at MIT there is a Kerberos run- + ning at the Laboratory for Computer Science and one run- + ning at Project Athena. + + When writing a Kerberos name, the principal name is sepa- + rated from the instance (if not null) by a period, and the + realm (if not the local realm) follows, preceded by an + ``@'' sign. The following are examples of valid Kerberos + + + +MIT Project Athena Kerberos Version 4.0 1 + + + + + + + + +KERBEROS(1) BSD Reference Manual KERBEROS(1) + + + names: + + billb + jis.admin + srz@lcs.mit.edu + treese.root@athena.mit.edu + + When you authenticate yourself with Kerberos, through + either the workstation _t_o_e_h_o_l_d system or the _k_i_n_i_t com- + mand, Kerberos gives you an initial Kerberos _t_i_c_k_e_t. (A + Kerberos ticket is an encrypted protocol message that pro- + vides authentication.) Kerberos uses this ticket for net- + work utilities such as _r_l_o_g_i_n and _r_c_p. The ticket trans- + actions are done transparently, so you don't have to worry + about their management. + + Note, however, that tickets expire. Privileged tickets, + such as root instance tickets, expire in a few minutes, + while tickets that carry more ordinary privileges may be + good for several hours or a day, depending on the instal- + lation's policy. If your login session extends beyond the + time limit, you will have to re-authenticate yourself to + Kerberos to get new tickets. Use the _k_i_n_i_t command to re- + authenticate yourself. + + If you use the _k_i_n_i_t command to get your tickets, make + sure you use the _k_d_e_s_t_r_o_y command to destroy your tickets + before you end your login session. You should probably + put the _k_d_e_s_t_r_o_y command in your _._l_o_g_o_u_t file so that your + tickets will be destroyed automatically when you logout. + For more information about the _k_i_n_i_t and _k_d_e_s_t_r_o_y com- + mands, see the _k_i_n_i_t_(_1_) and _k_d_e_s_t_r_o_y_(_1_) manual pages. + + Currently, Kerberos supports the following network ser- + vices: _r_l_o_g_i_n, _r_s_h, and _r_c_p. Other services are being + worked on, such as the _p_o_p mail system and NFS (network + file system), but are not yet available. + + +SSEEEE AALLSSOO + kdestroy(1), kinit(1), klist(1), kpasswd(1), des_crypt(3), + kerberos(3), kadmin(8) + +BBUUGGSS + Kerberos will not do authentication forwarding. In other + words, if you use _r_l_o_g_i_n to login to a remote host, you + cannot use Kerberos services from that host until you + authenticate yourself explicitly on that host. Although + you may need to authenticate yourself on the remote host, + be aware that when you do so, _r_l_o_g_i_n sends your password + across the network in clear text. + + + +MIT Project Athena Kerberos Version 4.0 2 + + + + + + + + +KERBEROS(1) BSD Reference Manual KERBEROS(1) + + +AAUUTTHHOORRSS + Steve Miller, MIT Project Athena/Digital Equipment Corpo- + ration + Clifford Neuman, MIT Project Athena + + The following people helped out on various aspects of the + system: + + Jeff Schiller designed and wrote the administration server + and its user interface, kadmin. He also wrote the dbm + version of the database management system. + + Mark Colan developed the Kerberos versions of _r_l_o_g_i_n, _r_s_h, + and _r_c_p, as well as contributing work on the servers. + + John Ostlund developed the Kerberos versions of _p_a_s_s_w_d and + _u_s_e_r_r_e_g. + + Stan Zanarotti pioneered Kerberos in a foreign realm + (LCS), and made many contributions based on that experi- + ence. + + Many people contributed code and/or useful ideas, includ- + ing Jim Aspnes, Bob Baldwin, John Barba, Richard Basch, + Jim Bloom, Bill Bryant, Rob French, Dan Geer, David + Jedlinsky, John Kohl, John Kubiatowicz, Bob McKie, Brian + Murphy, Ken Raeburn, Chris Reed, Jon Rochlis, Mike + Shanzer, Bill Sommerfeld, Jennifer Steiner, Ted Ts'o, and + Win Treese. + + +RREESSTTRRIICCTTIIOONNSS + COPYRIGHT 1985,1986 Massachusetts Institute of Technology + + + + + + + + + + + + + + + + + + + + + +MIT Project Athena Kerberos Version 4.0 3 + + + + + diff --git a/usr/share/man/cat1/kinit.0 b/usr/share/man/cat1/kinit.0 new file mode 100644 index 0000000000..13cf8d0b8f --- /dev/null +++ b/usr/share/man/cat1/kinit.0 @@ -0,0 +1,132 @@ + + + +KINIT(1) BSD Reference Manual KINIT(1) + + +NNAAMMEE + kinit - Kerberos login utility + +SSYYNNOOPPSSIISS + kkiinniitt [ --iirrvvll ] + +DDEESSCCRRIIPPTTIIOONN + The _k_i_n_i_t command is used to login to the Kerberos authen- + tication and authorization system. Note that only regis- + tered Kerberos users can use the Kerberos system. For + information about registering as a Kerberos user, see the + _k_e_r_b_e_r_o_s_(_1_) manual page. + + If you are logged in to a workstation that is running the + _t_o_e_h_o_l_d service, you do not have to use _k_i_n_i_t_. The _t_o_e_- + _h_o_l_d login procedure will log you into Kerberos automati- + cally. You will need to use _k_i_n_i_t only in those situa- + tions in which your original tickets have expired. (Tick- + ets expire in about a day.) Note as well that _t_o_e_h_o_l_d + will automatically destroy your tickets when you logout + from the workstation. + + When you use _k_i_n_i_t without options, the utility prompts + for your username and Kerberos password, and tries to + authenticate your login with the local Kerberos server. + + If Kerberos authenticates the login attempt, _k_i_n_i_t + retrieves your initial ticket and puts it in the ticket + file specified by your KRBTKFILE environment variable. If + this variable is undefined, your ticket will be stored in + the _/_t_m_p directory, in the file _t_k_t_u_i_d _, where _u_i_d speci- + fies your user identification number. + + If you have logged in to Kerberos without the benefit of + the workstation _t_o_e_h_o_l_d system, make sure you use the _k_d_e_- + _s_t_r_o_y command to destroy any active tickets before you end + your login session. You may want to put the _k_d_e_s_t_r_o_y com- + mand in your _._l_o_g_o_u_t file so that your tickets will be + destroyed automatically when you logout. + + The options to _k_i_n_i_t are as follows: + + --ii _k_i_n_i_t prompts you for a Kerberos instance. + + --rr _k_i_n_i_t prompts you for a Kerberos realm. This + option lets you authenticate yourself with a remote + Kerberos server. + + --vv Verbose mode. _k_i_n_i_t prints the name of the ticket + file used, and a status message indicating the suc- + cess or failure of your login attempt. + + + +MIT Project Athena Kerberos Version 4.0 1 + + + + + + + + +KINIT(1) BSD Reference Manual KINIT(1) + + + --ll _k_i_n_i_t prompts you for a ticket lifetime in minutes. + Due to protocol restrictions in Kerberos Version 4, + this value must be between 5 and 1275 minutes. + +SSEEEE AALLSSOO + kerberos(1), kdestroy(1), klist(1), toehold(1) + +BBUUGGSS + The --rr option has not been fully implemented. + +AAUUTTHHOORRSS + Steve Miller, MIT Project Athena/Digital Equipment Corpo- + ration + Clifford Neuman, MIT Project Athena + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +MIT Project Athena Kerberos Version 4.0 2 + + + + + diff --git a/usr/share/man/cat1/klist.0 b/usr/share/man/cat1/klist.0 new file mode 100644 index 0000000000..5db9335ee4 --- /dev/null +++ b/usr/share/man/cat1/klist.0 @@ -0,0 +1,132 @@ + + + +KLIST(1) BSD Reference Manual KLIST(1) + + +NNAAMMEE + klist - list currently held Kerberos tickets + +SSYYNNOOPPSSIISS + kklliisstt [ --ss | --tt ] [ --ffiillee name ] [ --ssrrvvttaabb ] + +DDEESSCCRRIIPPTTIIOONN + _k_l_i_s_t prints the name of the tickets file and the identity + of the principal the tickets are for (as listed in the + tickets file), and lists the principal names of all Ker- + beros tickets currently held by the user, along with the + issue and expire time for each authenticator. Principal + names are listed in the form _n_a_m_e_._i_n_s_t_a_n_c_e_@_r_e_a_l_m_, with the + '.' omitted if the instance is null, and the '@' omitted + if the realm is null. + + If given the --ss option, _k_l_i_s_t does not print the issue and + expire times, the name of the tickets file, or the iden- + tity of the principal. + + If given the --tt option, kklliisstt checks for the existence of + a non-expired ticket-granting-ticket in the ticket file. + If one is present, it exits with status 0, else it exits + with status 1. No output is generated when this option is + specified. + + If given the --ffiillee option, the following argument is used + as the ticket file. Otherwise, if the KKRRBBTTKKFFIILLEE environ- + ment variable is set, it is used. If this environment + variable is not set, the file //ttmmpp//ttkktt[[uuiidd]] is used, where + uuiidd is the current user-id of the user. + + If given the --ssrrvvttaabb option, the file is treated as a ser- + vice key file, and the names of the keys contained therein + are printed. If no file is specified with a --ffiillee option, + the default is _/_e_t_c_/_k_e_r_b_e_r_o_s_I_V_/_s_r_v_t_a_b. + +FFIILLEESS + /etc/kerberosIV/krb.conf + to get the name of the local realm + + /tmp/tkt[uid] as the default ticket file ([uid] is + the decimal UID of the user). + + /etc/kerberosIV/srvtab + as the default service key file + +SSEEEE AALLSSOO + kerberos(1), kinit(1), kdestroy(1) + + + + + +MIT Project Athena Kerberos Version 4.0 1 + + + + + + + + +KLIST(1) BSD Reference Manual KLIST(1) + + +BBUUGGSS + When reading a file as a service key file, very little + sanity or error checking is performed. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +MIT Project Athena Kerberos Version 4.0 2 + + + + + diff --git a/usr/share/man/cat1/ksrvtgt.0 b/usr/share/man/cat1/ksrvtgt.0 new file mode 100644 index 0000000000..c8e9d15a42 --- /dev/null +++ b/usr/share/man/cat1/ksrvtgt.0 @@ -0,0 +1,66 @@ + + + +KSRVTGT(1) BSD Reference Manual KSRVTGT(1) + + +NNAAMMEE + ksrvtgt - fetch and store Kerberos ticket-granting-ticket + using a service key + +SSYYNNOOPPSSIISS + kkssrrvvttggtt name instance [[realm] srvtab] + +DDEESSCCRRIIPPTTIIOONN + _k_s_r_v_t_g_t retrieves a ticket-granting ticket with a lifetime + of five (5) minutes for the principal _n_a_m_e_._i_n_s_t_a_n_c_e_@_r_e_a_l_m + (or _n_a_m_e_._i_n_s_t_a_n_c_e_@_l_o_c_a_l_r_e_a_l_m if _r_e_a_l_m is not supplied on + the command line), decrypts the response using the service + key found in _s_r_v_t_a_b (or in //eettcc//kkeerrbbeerroossIIVV//ssrrvvttaabb if + _s_r_v_t_a_b is not specified on the command line), and stores + the ticket in the standard ticket cache. + + This command is intended primarily for use in shell + scripts and other batch-type facilities. + +DDIIAAGGNNOOSSTTIICCSS + "Generic kerberos failure (kfailure)" can indicate a whole + range of problems, the most common of which is the inabil- + ity to read the service key file. + +FFIILLEESS + /etc/kerberosIV/krb.conf + to get the name of the local realm. + + /tmp/tkt[uid] The default ticket file. + + /etc/kerberosIV/srvtab + The default service key file. + +SSEEEE AALLSSOO + kerberos(1), kinit(1), kdestroy(1) + + + + + + + + + + + + + + + + + + + +MIT Project Athena Kerberos Version 4.0 1 + + + + + diff --git a/usr/share/man/cat1/register.0 b/usr/share/man/cat1/register.0 new file mode 100644 index 0000000000..9d0d1e3c4d --- /dev/null +++ b/usr/share/man/cat1/register.0 @@ -0,0 +1,66 @@ + + + +REGISTER(1) BSD Reference Manual REGISTER(1) + + +NNAAMMEE + register - register with Kerberos + +SSYYNNOOPPSSIISS + rreeggiisstteerr + +DDEESSCCRRIIPPTTIIOONN + The _r_e_g_i_s_t_e_r command is used to register a new user with + Kerberos. The Kerberos server keeps record of certain + trusted hosts from which it will accept new registrations. + If the host on which _r_e_g_i_s_t_e_r is run is trusted by Ker- + beros, the user is asked for his current password, and + then a new password to be used with Kerberos. A user may + only register with Kerberos one time. + +FFIILLEESS + /.update.keyxx.xx.xx.xx shared DES key with server + +SSEEEE AALLSSOO + registerd(8), kerberos(1) + +DDIIAAGGNNOOSSTTIICCSS + "Principal not unique" if the user already exists in the + Kerberos database. + "Permission Denied," if the host on which register is + being run is untrusted. + + + + + + + + + + + + + + + + + + + + + + + + + + + + +4.4 Berkeley Distribution June 1, 1993 1 + + + + + diff --git a/usr/share/man/cat3/acl_check.0 b/usr/share/man/cat3/acl_check.0 new file mode 100644 index 0000000000..ba975b4b21 --- /dev/null +++ b/usr/share/man/cat3/acl_check.0 @@ -0,0 +1,198 @@ + + + +ACL_CHECK(3) BSD Programmer's Manual ACL_CHECK(3) + + +NNAAMMEE + acl_canonicalize_principal, acl_check, acl_exact_match, + acl_add, acl_delete, acl_initialize - access control list + routines + +SSYYNNOOPPSSIISS + cccc <> --llaaccll --llkkrrbb + + ##iinncclluuddee <> + + aaccll__ccaannoonniiccaalliizzee__pprriinncciippaall((pprriinncciippaall,, bbuuff)) + cchhaarr **pprriinncciippaall;; + cchhaarr **bbuuff;; + + aaccll__cchheecckk((aaccll,, pprriinncciippaall)) + cchhaarr **aaccll;; + cchhaarr **pprriinncciippaall;; + + aaccll__eexxaacctt__mmaattcchh((aaccll,, pprriinncciippaall)) + cchhaarr **aaccll;; + cchhaarr **pprriinncciippaall;; + + aaccll__aadddd((aaccll,, pprriinncciippaall)) + cchhaarr **aaccll;; + cchhaarr **pprriinncciippaall;; + + aaccll__ddeelleettee((aaccll,, pprriinncciippaall)) + cchhaarr **aaccll;; + cchhaarr **pprriinncciippaall;; + + aaccll__iinniittiiaalliizzee((aaccll__ffiillee,, mmooddee)) + cchhaarr **aaccll__ffiillee;; + iinntt mmooddee;; + +DDEESSCCRRIIPPTTIIOONN + IInnttrroodduuccttiioonn + An access control list (ACL) is a list of principals, + where each principal is represented by a text string which + cannot contain whitespace. The library allows application + programs to refer to named access control lists to test + membership and to atomically add and delete principals + using a natural and intuitive interface. At present, the + names of access control lists are required to be Unix + filenames, and refer to human-readable Unix files; in the + future, when a networked ACL server is implemented, the + names may refer to a different namespace specific to the + ACL service. + + + PPrriinncciippaall NNaammeess + Principal names have the form + + + +MIT Project Athena Kerberos Version 4.0 1 + + + + + + + + +ACL_CHECK(3) BSD Programmer's Manual ACL_CHECK(3) + + + [.][@] + e.g.: + asp + asp.root + asp@ATHENA.MIT.EDU + asp.@ATHENA.MIT.EDU + asp.root@ATHENA.MIT.EDU + It is possible for principals to be underspecified. If an + instance is missing, it is assumed to be "". If realm is + missing, it is assumed to be the local realm as determined + by _k_r_b___g_e_t___l_r_e_a_l_m(3). The canonical form contains all of + name, instance, and realm; the acl_add and acl_delete rou- + tines will always leave the file in that form. Note that + the canonical form of asp@ATHENA.MIT.EDU is actually + asp.@ATHENA.MIT.EDU. + + RRoouuttiinneess + _a_c_l___c_a_n_o_n_i_c_a_l_i_z_e___p_r_i_n_c_i_p_a_l stores the canonical form of + _p_r_i_n_c_i_p_a_l in _b_u_f. _B_u_f must contain enough space to store + a principal, given the limits on the sizes of name, + instance, and realm specified as ANAME_SZ, INST_SZ, and + REALM_SZ, respectively, in _/_u_s_r_/_i_n_c_l_u_d_e_/_k_r_b_._h. + + _a_c_l___c_h_e_c_k returns nonzero if _p_r_i_n_c_i_p_a_l appears in _a_c_l. + Returns 0 if principal does not appear in acl, or if an + error occurs. Canonicalizes principal before checking, + and allows the ACL to contain wildcards. The only sup- + ported wildcards are entries of the form name.*@realm, + *.*@realm, and *.*@*. An asterisk matches any value for + its component field. For example, "jtkohl.*@*" would + match principal jtkohl, with any instance and any realm. + + _a_c_l___e_x_a_c_t___m_a_t_c_h performs like _a_c_l___c_h_e_c_k, but does no + canonicalization or wildcard matching. + + _a_c_l___a_d_d atomically adds _p_r_i_n_c_i_p_a_l to _a_c_l. Returns 0 if + successful, nonzero otherwise. It is considered a failure + if _p_r_i_n_c_i_p_a_l is already in _a_c_l. This routine will canoni- + calize _p_r_i_n_c_i_p_a_l, but will treat wildcards literally. + + _a_c_l___d_e_l_e_t_e atomically deletes _p_r_i_n_c_i_p_a_l from _a_c_l. Returns + 0 if successful, nonzero otherwise. It is considered a + failure if _p_r_i_n_c_i_p_a_l is not already in _a_c_l. This routine + will canonicalize _p_r_i_n_c_i_p_a_l, but will treat wildcards lit- + erally. + + _a_c_l___i_n_i_t_i_a_l_i_z_e initializes _a_c_l___f_i_l_e. If the file _a_c_l___f_i_l_e + does not exist, _a_c_l___i_n_i_t_i_a_l_i_z_e creates it with mode _m_o_d_e. + If the file _a_c_l___f_i_l_e exists, _a_c_l___i_n_i_t_i_a_l_i_z_e removes all + members. Returns 0 if successful, nonzero otherwise. + WARNING: Mode argument is likely to change with the + + + +MIT Project Athena Kerberos Version 4.0 2 + + + + + + + + +ACL_CHECK(3) BSD Programmer's Manual ACL_CHECK(3) + + + eventual introduction of an ACL service. + +NNOOTTEESS + In the presence of concurrency, there is a very small + chance that _a_c_l___a_d_d or _a_c_l___d_e_l_e_t_e could report success + even though it would have had no effect. This is a neces- + sary side effect of using lock files for concurrency con- + trol rather than flock(2), which is not supported by NFS. + + The current implementation caches ACLs in memory in a + hash-table format for increased efficiency in checking + membership; one effect of the caching scheme is that one + file descriptor will be kept open for each ACL cached, up + to a maximum of 8. + +SSEEEE AALLSSOO + kerberos(3), krb_get_lrealm(3) + +AAUUTTHHOORR + James Aspnes (MIT Project Athena) + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +MIT Project Athena Kerberos Version 4.0 3 + + + + + diff --git a/usr/share/man/cat3/des.0 b/usr/share/man/cat3/des.0 new file mode 100644 index 0000000000..7e68897962 --- /dev/null +++ b/usr/share/man/cat3/des.0 @@ -0,0 +1,396 @@ + + + +DES_CRYPT(3) BSD Programmer's Manual DES_CRYPT(3) + + +NNAAMMEE + des_read_password, des_string_to_key, des_random_key, + des_set_key, des_ecb_encrypt, des_cbc_encrypt, + des_pcbc_encrypt, des_cbc_cksum, des_quad_cksum, - (new) + DES encryption + +SSYYNNOOPPSSIISS + ##iinncclluuddee <> + + iinntt ddeess__rreeaadd__ppaasssswwoorrdd((kkeeyy,,pprroommpptt,,vveerriiffyy)) + des_cblock *key; + char *prompt; + int verify; + + iinntt ddeess__ssttrriinngg__ttoo__kkeeyy((ssttrr,,kkeeyy)) + cchhaarr **ssttrr;; + ddeess__ccbblloocckk kkeeyy;; + + iinntt ddeess__rraannddoomm__kkeeyy((kkeeyy)) + ddeess__ccbblloocckk **kkeeyy;; + + iinntt ddeess__sseett__kkeeyy((kkeeyy,,sscchheedduullee)) + ddeess__ccbblloocckk **kkeeyy;; + ddeess__kkeeyy__sscchheedduullee sscchheedduullee;; + + iinntt ddeess__eeccbb__eennccrryypptt((iinnppuutt,,oouuttppuutt,,sscchheedduullee,,eennccrryypptt)) + ddeess__ccbblloocckk **iinnppuutt;; + ddeess__ccbblloocckk **oouuttppuutt;; + ddeess__kkeeyy__sscchheedduullee sscchheedduullee;; + iinntt eennccrryypptt;; + + iinntt ddeess__ccbbcc__eennccrryypptt((iinnppuutt,,oouuttppuutt,,lleennggtthh,,sscchheedduullee,,iivveecc,,eennccrryypptt)) + ddeess__ccbblloocckk **iinnppuutt;; + ddeess__ccbblloocckk **oouuttppuutt;; + lloonngg lleennggtthh;; + ddeess__kkeeyy__sscchheedduullee sscchheedduullee;; + ddeess__ccbblloocckk **iivveecc;; + iinntt eennccrryypptt;; + + iinntt ddeess__ppccbbcc__eennccrryypptt((iinnppuutt,,oouuttppuutt,,lleennggtthh,,sscchheedduullee,,iivveecc,,eennccrryypptt)) + ddeess__ccbblloocckk **iinnppuutt;; + ddeess__ccbblloocckk **oouuttppuutt;; + lloonngg lleennggtthh;; + ddeess__kkeeyy__sscchheedduullee sscchheedduullee;; + ddeess__ccbblloocckk **iivveecc;; + iinntt eennccrryypptt;; + + uunnssiiggnneedd lloonngg ddeess__ccbbcc__cckkssuumm((iinnppuutt,,oouuttppuutt,,lleennggtthh,,sscchheedduullee,,iivveecc)) + ddeess__ccbblloocckk **iinnppuutt;; + ddeess__ccbblloocckk **oouuttppuutt;; + lloonngg lleennggtthh;; + + + +MIT Project Athena Kerberos Version 4.0 1 + + + + + + + + +DES_CRYPT(3) BSD Programmer's Manual DES_CRYPT(3) + + + ddeess__kkeeyy__sscchheedduullee sscchheedduullee;; + ddeess__ccbblloocckk **iivveecc;; + + uunnssiiggnneedd lloonngg qquuaadd__cckkssuumm((iinnppuutt,,oouuttppuutt,,lleennggtthh,,oouutt__ccoouunntt,,sseeeedd)) + ddeess__ccbblloocckk **iinnppuutt;; + ddeess__ccbblloocckk **oouuttppuutt;; + lloonngg lleennggtthh;; + iinntt oouutt__ccoouunntt;; + ddeess__ccbblloocckk **sseeeedd;; + + +DDEESSCCRRIIPPTTIIOONN + This library supports various DES encryption related oper- + ations. It differs from the _c_r_y_p_t_, _s_e_t_k_e_y_, _a_n_d _e_n_c_r_y_p_t + library routines in that it provides a true DES encryp- + tion, without modifying the algorithm, and executes much + faster. + + For each key that may be simultaneously active, create a + ddeess__kkeeyy__sscchheedduullee struct, defined in "des.h". Next, create + key schedules (from the 8-byte keys) as needed, via + _d_e_s___s_e_t___k_e_y_, prior to using the encryption or checksum + routines. Then setup the input and output areas. Make + sure to note the restrictions on lengths being multiples + of eight bytes. Finally, invoke the encryption/decryption + routines, _d_e_s___e_c_b___e_n_c_r_y_p_t or _d_e_s___c_b_c___e_n_c_r_y_p_t or + _d_e_s___p_c_b_c___e_n_c_r_y_p_t_, or, to generate a cryptographic check- + sum, use _q_u_a_d___c_k_s_u_m (fast) or _d_e_s___c_b_c___c_k_s_u_m (slow). + + A _d_e_s___c_b_l_o_c_k struct is an 8 byte block used as the funda- + mental unit for DES data and keys, and is defined as: + + ttyyppeeddeeff uunnssiiggnneedd cchhaarr ddeess__ccbblloocckk[[88]];; + + and a _d_e_s___k_e_y___s_c_h_e_d_u_l_e_, is defined as: + + ttyyppeeddeeff ssttrruucctt ddeess__kkss__ssttrruucctt {{ddeess__ccbblloocckk __;;}} + ddeess__kkeeyy__sscchheedduullee[[1166]];; + + _d_e_s___r_e_a_d___p_a_s_s_w_o_r_d writes the string specified by _p_r_o_m_p_t to + the standard output, turns off echo (if possible) and + reads an input string from standard input until terminated + with a newline. If _v_e_r_i_f_y is non-zero, it prompts and + reads input again, for use in applications such as chang- + ing a password; both versions are compared, and the input + is requested repeatedly until they match. Then + _d_e_s___r_e_a_d___p_a_s_s_w_o_r_d converts the input string into a valid + DES key, internally using the _d_e_s___s_t_r_i_n_g___t_o___k_e_y routine. + The newly created key is copied to the area pointed to by + the _k_e_y argument. _d_e_s___r_e_a_d___p_a_s_s_w_o_r_d returns a zero if no + errors occurred, or a -1 indicating that an error occurred + + + +MIT Project Athena Kerberos Version 4.0 2 + + + + + + + + +DES_CRYPT(3) BSD Programmer's Manual DES_CRYPT(3) + + + trying to manipulate the terminal echo. + + + _d_e_s___s_t_r_i_n_g___t_o___k_e_y converts an arbitrary length null- + terminated string to an 8 byte DES key, with odd byte par- + ity, per FIPS specification. A one-way function is used + to convert the string to a key, making it very difficult + to reconstruct the string from the key. The _s_t_r argument + is a pointer to the string, and _k_e_y should point to a + _d_e_s___c_b_l_o_c_k supplied by the caller to receive the generated + key. No meaningful value is returned. Void is not used + for compatibility with other compilers. + + + _d_e_s___r_a_n_d_o_m___k_e_y generates a random DES encryption key + (eight bytes), set to odd parity per FIPS specifications. + This routine uses the current time, process id, and a + counter as a seed for the random number generator. The + caller must supply space for the output key, pointed to + by argument _k_e_y_, then after calling _d_e_s___r_a_n_d_o_m___k_e_y should + call the _d_e_s___s_e_t___k_e_y routine when needed. No meaningful + value is returned. Void is not used for compatibility + with other compilers. + + + _d_e_s___s_e_t___k_e_y calculates a key schedule from all eight bytes + of the input key, pointed to by the _k_e_y argument, and out- + puts the schedule into the _d_e_s___k_e_y___s_c_h_e_d_u_l_e indicated by + the _s_c_h_e_d_u_l_e argument. Make sure to pass a valid eight + byte key; no padding is done. The key schedule may then + be used in subsequent encryption/decryption/checksum oper- + ations. Many key schedules may be cached for later use. + The user is responsible to clear keys and schedules as + soon as no longer needed, to prevent their disclosure. + The routine also checks the key parity, and returns a zero + if the key parity is correct (odd), a -1 indicating a key + parity error, or a -2 indicating use of an illegal weak + key. If an error is returned, the key schedule was not + created. + + + _d_e_s___e_c_b___e_n_c_r_y_p_t is the basic DES encryption routine that + encrypts or decrypts a single 8-byte block in eelleeccttrroonniicc + ccooddee bbooookk mode. It always transforms the input data, + pointed to by _i_n_p_u_t_, into the output data, pointed to by + the _o_u_t_p_u_t argument. + + If the _e_n_c_r_y_p_t argument is non-zero, the _i_n_p_u_t (cleartext) + is encrypted into the _o_u_t_p_u_t (ciphertext) using the + key_schedule specified by the _s_c_h_e_d_u_l_e argument, previ- + ously set via _d_e_s___s_e_t___k_e_y + + + +MIT Project Athena Kerberos Version 4.0 3 + + + + + + + + +DES_CRYPT(3) BSD Programmer's Manual DES_CRYPT(3) + + + If encrypt is zero, the _i_n_p_u_t (now ciphertext) is + decrypted into the _o_u_t_p_u_t (now cleartext). + + Input and output may overlap. + + No meaningful value is returned. Void is not used for + compatibility with other compilers. + + + _d_e_s___c_b_c___e_n_c_r_y_p_t encrypts/decrypts using the cciipphheerr--bblloocckk-- + cchhaaiinniinngg mmooddee ooff DDEESS.. If the _e_n_c_r_y_p_t argument is non- + zero, the routine cipher-block-chain encrypts the cleart- + ext data pointed to by the _i_n_p_u_t argument into the cipher- + text pointed to by the _o_u_t_p_u_t argument, using the key + schedule provided by the _s_c_h_e_d_u_l_e argument, and initial- + ization vector provided by the _i_v_e_c argument. If the + _l_e_n_g_t_h argument is not an integral multiple of eight + bytes, the last block is copied to a temp and zero filled + (highest addresses). The output is ALWAYS an integral + multiple of eight bytes. + + If _e_n_c_r_y_p_t is zero, the routine cipher-block chain + decrypts the (now) ciphertext data pointed to by the _i_n_p_u_t + argument into (now) cleartext pointed to by the _o_u_t_p_u_t + argument using the key schedule provided by the _s_c_h_e_d_u_l_e + argument, and initialization vector provided by the _i_v_e_c + argument. Decryption ALWAYS operates on integral multiples + of 8 bytes, so it will round the _l_e_n_g_t_h provided up to the + appropriate multiple. Consequently, it will always produce + the rounded-up number of bytes of output cleartext. The + application must determine if the output cleartext was + zero-padded due to original cleartext lengths that were + not integral multiples of 8. + + No errors or meaningful values are returned. Void is not + used for compatibility with other compilers. + + A characteristic of cbc mode is that changing a single bit + of the cleartext, then encrypting using cbc mode, affects + ALL the subsequent ciphertext. This makes cryptanalysis + much more difficult. However, modifying a single bit of + the ciphertext, then decrypting, only affects the result- + ing cleartext from the modified block and the succeeding + block. Therefore, _d_e_s___p_c_b_c___e_n_c_r_y_p_t is STRONGLY recom- + mended for applications where indefinite propagation of + errors is required in order to detect modifications. + + + _d_e_s___p_c_b_c___e_n_c_r_y_p_t encrypts/decrypts using a modified block + chaining mode. Its calling sequence is identical to + _d_e_s___c_b_c___e_n_c_r_y_p_t_. It differs in its error propagation + + + +MIT Project Athena Kerberos Version 4.0 4 + + + + + + + + +DES_CRYPT(3) BSD Programmer's Manual DES_CRYPT(3) + + + characteristics. + + _d_e_s___p_c_b_c___e_n_c_r_y_p_t is highly recommended for most encryption + purposes, in that modification of a single bit of the + ciphertext will affect ALL the subsequent (decrypted) + cleartext. Similarly, modifying a single bit of the clear- + text will affect ALL the subsequent (encrypted) cipher- + text. "PCBC" mode, on encryption, "xors" both the cleart- + ext of block N and the ciphertext resulting from block N + with the cleartext for block N+1 prior to encrypting block + N+1. + + _d_e_s___c_b_c___c_k_s_u_m produces an 8 byte cryptographic checksum by + cipher-block-chain encrypting the cleartext data pointed + to by the _i_n_p_u_t argument. All of the ciphertext output is + discarded, except the last 8-byte ciphertext block, which + is written into the area pointed to by the _o_u_t_p_u_t argu- + ment. It uses the key schedule, provided by the _s_c_h_e_d_u_l_e + argument and initialization vector provided by the _i_v_e_c + argument. If the _l_e_n_g_t_h argument is not an integral mul- + tiple of eight bytes, the last cleartext block is copied + to a temp and zero filled (highest addresses). The output + is ALWAYS eight bytes. + + The routine also returns an unsigned long, which is the + last (highest address) half of the 8 byte checksum com- + puted. + + + _q_u_a_d___c_k_s_u_m produces a checksum by chaining quadratic oper- + ations on the cleartext data pointed to by the _i_n_p_u_t argu- + ment. The _l_e_n_g_t_h argument specifies the length of the + input -- only exactly that many bytes are included for the + checksum, without any padding. + + The algorithm may be iterated over the same input data, if + the _o_u_t___c_o_u_n_t argument is 2, 3 or 4, and the optional _o_u_t_- + _p_u_t argument is a non-null pointer . The default is one + iteration, and it will not run more than 4 times. Multiple + iterations run slower, but provide a longer checksum if + desired. The _s_e_e_d argument provides an 8-byte seed for the + first iteration. If multiple iterations are requested, the + results of one iteration are automatically used as the + seed for the next iteration. + + It returns both an unsigned long checksum value, and if + the _o_u_t_p_u_t argument is not a null pointer, up to 16 bytes + of the computed checksum are written into the output. + + + + + + +MIT Project Athena Kerberos Version 4.0 5 + + + + + + + + +DES_CRYPT(3) BSD Programmer's Manual DES_CRYPT(3) + + +FFIILLEESS + /usr/include/kerberosIV/des.h + /usr/lib/libdes.a + +SSEEEE AALLSSOO +DDIIAAGGNNOOSSTTIICCSS +BBUUGGSS + This software has not yet been compiled or tested on + machines other than the VAX and the IBM PC. + +AAUUTTHHOORRSS + Steve Miller, MIT Project Athena/Digital Equipment Corpo- + ration + +RREESSTTRRIICCTTIIOONNSS + COPYRIGHT 1985,1986 Massachusetts Institute of Technology + + This software may not be exported outside of the US with- + out a special license from the US Dept of Commerce. It may + be replaced by any secret key block cipher with block + length and key length of 8 bytes, as long as the interface + is the same as described here. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +MIT Project Athena Kerberos Version 4.0 6 + + + + + diff --git a/usr/share/man/cat3/des_crypt.0 b/usr/share/man/cat3/des_crypt.0 new file mode 100644 index 0000000000..7e68897962 --- /dev/null +++ b/usr/share/man/cat3/des_crypt.0 @@ -0,0 +1,396 @@ + + + +DES_CRYPT(3) BSD Programmer's Manual DES_CRYPT(3) + + +NNAAMMEE + des_read_password, des_string_to_key, des_random_key, + des_set_key, des_ecb_encrypt, des_cbc_encrypt, + des_pcbc_encrypt, des_cbc_cksum, des_quad_cksum, - (new) + DES encryption + +SSYYNNOOPPSSIISS + ##iinncclluuddee <> + + iinntt ddeess__rreeaadd__ppaasssswwoorrdd((kkeeyy,,pprroommpptt,,vveerriiffyy)) + des_cblock *key; + char *prompt; + int verify; + + iinntt ddeess__ssttrriinngg__ttoo__kkeeyy((ssttrr,,kkeeyy)) + cchhaarr **ssttrr;; + ddeess__ccbblloocckk kkeeyy;; + + iinntt ddeess__rraannddoomm__kkeeyy((kkeeyy)) + ddeess__ccbblloocckk **kkeeyy;; + + iinntt ddeess__sseett__kkeeyy((kkeeyy,,sscchheedduullee)) + ddeess__ccbblloocckk **kkeeyy;; + ddeess__kkeeyy__sscchheedduullee sscchheedduullee;; + + iinntt ddeess__eeccbb__eennccrryypptt((iinnppuutt,,oouuttppuutt,,sscchheedduullee,,eennccrryypptt)) + ddeess__ccbblloocckk **iinnppuutt;; + ddeess__ccbblloocckk **oouuttppuutt;; + ddeess__kkeeyy__sscchheedduullee sscchheedduullee;; + iinntt eennccrryypptt;; + + iinntt ddeess__ccbbcc__eennccrryypptt((iinnppuutt,,oouuttppuutt,,lleennggtthh,,sscchheedduullee,,iivveecc,,eennccrryypptt)) + ddeess__ccbblloocckk **iinnppuutt;; + ddeess__ccbblloocckk **oouuttppuutt;; + lloonngg lleennggtthh;; + ddeess__kkeeyy__sscchheedduullee sscchheedduullee;; + ddeess__ccbblloocckk **iivveecc;; + iinntt eennccrryypptt;; + + iinntt ddeess__ppccbbcc__eennccrryypptt((iinnppuutt,,oouuttppuutt,,lleennggtthh,,sscchheedduullee,,iivveecc,,eennccrryypptt)) + ddeess__ccbblloocckk **iinnppuutt;; + ddeess__ccbblloocckk **oouuttppuutt;; + lloonngg lleennggtthh;; + ddeess__kkeeyy__sscchheedduullee sscchheedduullee;; + ddeess__ccbblloocckk **iivveecc;; + iinntt eennccrryypptt;; + + uunnssiiggnneedd lloonngg ddeess__ccbbcc__cckkssuumm((iinnppuutt,,oouuttppuutt,,lleennggtthh,,sscchheedduullee,,iivveecc)) + ddeess__ccbblloocckk **iinnppuutt;; + ddeess__ccbblloocckk **oouuttppuutt;; + lloonngg lleennggtthh;; + + + +MIT Project Athena Kerberos Version 4.0 1 + + + + + + + + +DES_CRYPT(3) BSD Programmer's Manual DES_CRYPT(3) + + + ddeess__kkeeyy__sscchheedduullee sscchheedduullee;; + ddeess__ccbblloocckk **iivveecc;; + + uunnssiiggnneedd lloonngg qquuaadd__cckkssuumm((iinnppuutt,,oouuttppuutt,,lleennggtthh,,oouutt__ccoouunntt,,sseeeedd)) + ddeess__ccbblloocckk **iinnppuutt;; + ddeess__ccbblloocckk **oouuttppuutt;; + lloonngg lleennggtthh;; + iinntt oouutt__ccoouunntt;; + ddeess__ccbblloocckk **sseeeedd;; + + +DDEESSCCRRIIPPTTIIOONN + This library supports various DES encryption related oper- + ations. It differs from the _c_r_y_p_t_, _s_e_t_k_e_y_, _a_n_d _e_n_c_r_y_p_t + library routines in that it provides a true DES encryp- + tion, without modifying the algorithm, and executes much + faster. + + For each key that may be simultaneously active, create a + ddeess__kkeeyy__sscchheedduullee struct, defined in "des.h". Next, create + key schedules (from the 8-byte keys) as needed, via + _d_e_s___s_e_t___k_e_y_, prior to using the encryption or checksum + routines. Then setup the input and output areas. Make + sure to note the restrictions on lengths being multiples + of eight bytes. Finally, invoke the encryption/decryption + routines, _d_e_s___e_c_b___e_n_c_r_y_p_t or _d_e_s___c_b_c___e_n_c_r_y_p_t or + _d_e_s___p_c_b_c___e_n_c_r_y_p_t_, or, to generate a cryptographic check- + sum, use _q_u_a_d___c_k_s_u_m (fast) or _d_e_s___c_b_c___c_k_s_u_m (slow). + + A _d_e_s___c_b_l_o_c_k struct is an 8 byte block used as the funda- + mental unit for DES data and keys, and is defined as: + + ttyyppeeddeeff uunnssiiggnneedd cchhaarr ddeess__ccbblloocckk[[88]];; + + and a _d_e_s___k_e_y___s_c_h_e_d_u_l_e_, is defined as: + + ttyyppeeddeeff ssttrruucctt ddeess__kkss__ssttrruucctt {{ddeess__ccbblloocckk __;;}} + ddeess__kkeeyy__sscchheedduullee[[1166]];; + + _d_e_s___r_e_a_d___p_a_s_s_w_o_r_d writes the string specified by _p_r_o_m_p_t to + the standard output, turns off echo (if possible) and + reads an input string from standard input until terminated + with a newline. If _v_e_r_i_f_y is non-zero, it prompts and + reads input again, for use in applications such as chang- + ing a password; both versions are compared, and the input + is requested repeatedly until they match. Then + _d_e_s___r_e_a_d___p_a_s_s_w_o_r_d converts the input string into a valid + DES key, internally using the _d_e_s___s_t_r_i_n_g___t_o___k_e_y routine. + The newly created key is copied to the area pointed to by + the _k_e_y argument. _d_e_s___r_e_a_d___p_a_s_s_w_o_r_d returns a zero if no + errors occurred, or a -1 indicating that an error occurred + + + +MIT Project Athena Kerberos Version 4.0 2 + + + + + + + + +DES_CRYPT(3) BSD Programmer's Manual DES_CRYPT(3) + + + trying to manipulate the terminal echo. + + + _d_e_s___s_t_r_i_n_g___t_o___k_e_y converts an arbitrary length null- + terminated string to an 8 byte DES key, with odd byte par- + ity, per FIPS specification. A one-way function is used + to convert the string to a key, making it very difficult + to reconstruct the string from the key. The _s_t_r argument + is a pointer to the string, and _k_e_y should point to a + _d_e_s___c_b_l_o_c_k supplied by the caller to receive the generated + key. No meaningful value is returned. Void is not used + for compatibility with other compilers. + + + _d_e_s___r_a_n_d_o_m___k_e_y generates a random DES encryption key + (eight bytes), set to odd parity per FIPS specifications. + This routine uses the current time, process id, and a + counter as a seed for the random number generator. The + caller must supply space for the output key, pointed to + by argument _k_e_y_, then after calling _d_e_s___r_a_n_d_o_m___k_e_y should + call the _d_e_s___s_e_t___k_e_y routine when needed. No meaningful + value is returned. Void is not used for compatibility + with other compilers. + + + _d_e_s___s_e_t___k_e_y calculates a key schedule from all eight bytes + of the input key, pointed to by the _k_e_y argument, and out- + puts the schedule into the _d_e_s___k_e_y___s_c_h_e_d_u_l_e indicated by + the _s_c_h_e_d_u_l_e argument. Make sure to pass a valid eight + byte key; no padding is done. The key schedule may then + be used in subsequent encryption/decryption/checksum oper- + ations. Many key schedules may be cached for later use. + The user is responsible to clear keys and schedules as + soon as no longer needed, to prevent their disclosure. + The routine also checks the key parity, and returns a zero + if the key parity is correct (odd), a -1 indicating a key + parity error, or a -2 indicating use of an illegal weak + key. If an error is returned, the key schedule was not + created. + + + _d_e_s___e_c_b___e_n_c_r_y_p_t is the basic DES encryption routine that + encrypts or decrypts a single 8-byte block in eelleeccttrroonniicc + ccooddee bbooookk mode. It always transforms the input data, + pointed to by _i_n_p_u_t_, into the output data, pointed to by + the _o_u_t_p_u_t argument. + + If the _e_n_c_r_y_p_t argument is non-zero, the _i_n_p_u_t (cleartext) + is encrypted into the _o_u_t_p_u_t (ciphertext) using the + key_schedule specified by the _s_c_h_e_d_u_l_e argument, previ- + ously set via _d_e_s___s_e_t___k_e_y + + + +MIT Project Athena Kerberos Version 4.0 3 + + + + + + + + +DES_CRYPT(3) BSD Programmer's Manual DES_CRYPT(3) + + + If encrypt is zero, the _i_n_p_u_t (now ciphertext) is + decrypted into the _o_u_t_p_u_t (now cleartext). + + Input and output may overlap. + + No meaningful value is returned. Void is not used for + compatibility with other compilers. + + + _d_e_s___c_b_c___e_n_c_r_y_p_t encrypts/decrypts using the cciipphheerr--bblloocckk-- + cchhaaiinniinngg mmooddee ooff DDEESS.. If the _e_n_c_r_y_p_t argument is non- + zero, the routine cipher-block-chain encrypts the cleart- + ext data pointed to by the _i_n_p_u_t argument into the cipher- + text pointed to by the _o_u_t_p_u_t argument, using the key + schedule provided by the _s_c_h_e_d_u_l_e argument, and initial- + ization vector provided by the _i_v_e_c argument. If the + _l_e_n_g_t_h argument is not an integral multiple of eight + bytes, the last block is copied to a temp and zero filled + (highest addresses). The output is ALWAYS an integral + multiple of eight bytes. + + If _e_n_c_r_y_p_t is zero, the routine cipher-block chain + decrypts the (now) ciphertext data pointed to by the _i_n_p_u_t + argument into (now) cleartext pointed to by the _o_u_t_p_u_t + argument using the key schedule provided by the _s_c_h_e_d_u_l_e + argument, and initialization vector provided by the _i_v_e_c + argument. Decryption ALWAYS operates on integral multiples + of 8 bytes, so it will round the _l_e_n_g_t_h provided up to the + appropriate multiple. Consequently, it will always produce + the rounded-up number of bytes of output cleartext. The + application must determine if the output cleartext was + zero-padded due to original cleartext lengths that were + not integral multiples of 8. + + No errors or meaningful values are returned. Void is not + used for compatibility with other compilers. + + A characteristic of cbc mode is that changing a single bit + of the cleartext, then encrypting using cbc mode, affects + ALL the subsequent ciphertext. This makes cryptanalysis + much more difficult. However, modifying a single bit of + the ciphertext, then decrypting, only affects the result- + ing cleartext from the modified block and the succeeding + block. Therefore, _d_e_s___p_c_b_c___e_n_c_r_y_p_t is STRONGLY recom- + mended for applications where indefinite propagation of + errors is required in order to detect modifications. + + + _d_e_s___p_c_b_c___e_n_c_r_y_p_t encrypts/decrypts using a modified block + chaining mode. Its calling sequence is identical to + _d_e_s___c_b_c___e_n_c_r_y_p_t_. It differs in its error propagation + + + +MIT Project Athena Kerberos Version 4.0 4 + + + + + + + + +DES_CRYPT(3) BSD Programmer's Manual DES_CRYPT(3) + + + characteristics. + + _d_e_s___p_c_b_c___e_n_c_r_y_p_t is highly recommended for most encryption + purposes, in that modification of a single bit of the + ciphertext will affect ALL the subsequent (decrypted) + cleartext. Similarly, modifying a single bit of the clear- + text will affect ALL the subsequent (encrypted) cipher- + text. "PCBC" mode, on encryption, "xors" both the cleart- + ext of block N and the ciphertext resulting from block N + with the cleartext for block N+1 prior to encrypting block + N+1. + + _d_e_s___c_b_c___c_k_s_u_m produces an 8 byte cryptographic checksum by + cipher-block-chain encrypting the cleartext data pointed + to by the _i_n_p_u_t argument. All of the ciphertext output is + discarded, except the last 8-byte ciphertext block, which + is written into the area pointed to by the _o_u_t_p_u_t argu- + ment. It uses the key schedule, provided by the _s_c_h_e_d_u_l_e + argument and initialization vector provided by the _i_v_e_c + argument. If the _l_e_n_g_t_h argument is not an integral mul- + tiple of eight bytes, the last cleartext block is copied + to a temp and zero filled (highest addresses). The output + is ALWAYS eight bytes. + + The routine also returns an unsigned long, which is the + last (highest address) half of the 8 byte checksum com- + puted. + + + _q_u_a_d___c_k_s_u_m produces a checksum by chaining quadratic oper- + ations on the cleartext data pointed to by the _i_n_p_u_t argu- + ment. The _l_e_n_g_t_h argument specifies the length of the + input -- only exactly that many bytes are included for the + checksum, without any padding. + + The algorithm may be iterated over the same input data, if + the _o_u_t___c_o_u_n_t argument is 2, 3 or 4, and the optional _o_u_t_- + _p_u_t argument is a non-null pointer . The default is one + iteration, and it will not run more than 4 times. Multiple + iterations run slower, but provide a longer checksum if + desired. The _s_e_e_d argument provides an 8-byte seed for the + first iteration. If multiple iterations are requested, the + results of one iteration are automatically used as the + seed for the next iteration. + + It returns both an unsigned long checksum value, and if + the _o_u_t_p_u_t argument is not a null pointer, up to 16 bytes + of the computed checksum are written into the output. + + + + + + +MIT Project Athena Kerberos Version 4.0 5 + + + + + + + + +DES_CRYPT(3) BSD Programmer's Manual DES_CRYPT(3) + + +FFIILLEESS + /usr/include/kerberosIV/des.h + /usr/lib/libdes.a + +SSEEEE AALLSSOO +DDIIAAGGNNOOSSTTIICCSS +BBUUGGSS + This software has not yet been compiled or tested on + machines other than the VAX and the IBM PC. + +AAUUTTHHOORRSS + Steve Miller, MIT Project Athena/Digital Equipment Corpo- + ration + +RREESSTTRRIICCTTIIOONNSS + COPYRIGHT 1985,1986 Massachusetts Institute of Technology + + This software may not be exported outside of the US with- + out a special license from the US Dept of Commerce. It may + be replaced by any secret key block cipher with block + length and key length of 8 bytes, as long as the interface + is the same as described here. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +MIT Project Athena Kerberos Version 4.0 6 + + + + + diff --git a/usr/share/man/cat3/kerberos.0 b/usr/share/man/cat3/kerberos.0 new file mode 100644 index 0000000000..ac1157fbda --- /dev/null +++ b/usr/share/man/cat3/kerberos.0 @@ -0,0 +1,462 @@ + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + +NNAAMMEE + krb_mk_req, krb_rd_req, krb_kntoln, krb_set_key, + krb_get_cred, krb_mk_priv, krb_rd_priv, krb_mk_safe, + krb_rd_safe, krb_mk_err, krb_rd_err, krb_ck_repl - Ker- + beros authentication library + +SSYYNNOOPPSSIISS + ##iinncclluuddee <> + ##iinncclluuddee <> + + eexxtteerrnn cchhaarr **kkrrbb__eerrrr__ttxxtt[[]];; + + iinntt kkrrbb__mmkk__rreeqq((aauutthheenntt,,sseerrvviiccee,,iinnssttaannccee,,rreeaallmm,,cchheecckkssuumm)) + KKTTEEXXTT aauutthheenntt;; + cchhaarr **sseerrvviiccee;; + cchhaarr **iinnssttaannccee;; + cchhaarr **rreeaallmm;; + uu__lloonngg cchheecckkssuumm;; + + iinntt kkrrbb__rrdd__rreeqq((aauutthheenntt,,sseerrvviiccee,,iinnssttaannccee,,ffrroomm__aaddddrr,,aadd,,ffnn)) + KKTTEEXXTT aauutthheenntt;; + cchhaarr **sseerrvviiccee;; + cchhaarr **iinnssttaannccee;; + uu__lloonngg ffrroomm__aaddddrr;; + AAUUTTHH__DDAATT **aadd;; + cchhaarr **ffnn;; + + iinntt kkrrbb__kknnttoollnn((aadd,,llnnaammee)) + AAUUTTHH__DDAATT **aadd;; + cchhaarr **llnnaammee;; + + iinntt kkrrbb__sseett__kkeeyy((kkeeyy,,ccvvtt)) + cchhaarr **kkeeyy;; + iinntt ccvvtt;; + + iinntt kkrrbb__ggeett__ccrreedd((sseerrvviiccee,,iinnssttaannccee,,rreeaallmm,,cc)) + cchhaarr **sseerrvviiccee;; + cchhaarr **iinnssttaannccee;; + cchhaarr **rreeaallmm;; + CCRREEDDEENNTTIIAALLSS **cc;; + + lloonngg kkrrbb__mmkk__pprriivv((iinn,,oouutt,,iinn__lleennggtthh,,sscchheedduullee,,kkeeyy,,sseennddeerr,,rreecceeiivveerr)) + uu__cchhaarr **iinn;; + uu__cchhaarr **oouutt;; + uu__lloonngg iinn__lleennggtthh;; + ddeess__ccbblloocckk kkeeyy;; + ddeess__kkeeyy__sscchheedduullee sscchheedduullee;; + ssttrruucctt ssoocckkaaddddrr__iinn **sseennddeerr;; + ssttrruucctt ssoocckkaaddddrr__iinn **rreecceeiivveerr;; + + lloonngg kkrrbb__rrdd__pprriivv((iinn,,iinn__lleennggtthh,,sscchheedduullee,,kkeeyy,,sseennddeerr,,rreecceeiivveerr,,mmssgg__ddaattaa)) + + + +MIT Project Athena Kerberos Version 4.0 1 + + + + + + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + + uu__cchhaarr **iinn;; + uu__lloonngg iinn__lleennggtthh;; + KKeeyy__sscchheedduullee sscchheedduullee;; + ddeess__ccbblloocckk kkeeyy;; + ssttrruucctt ssoocckkaaddddrr__iinn **sseennddeerr;; + ssttrruucctt ssoocckkaaddddrr__iinn **rreecceeiivveerr;; + MMSSGG__DDAATT **mmssgg__ddaattaa;; + + lloonngg kkrrbb__mmkk__ssaaffee((iinn,,oouutt,,iinn__lleennggtthh,,kkeeyy,,sseennddeerr,,rreecceeiivveerr)) + uu__cchhaarr **iinn;; + uu__cchhaarr **oouutt;; + uu__lloonngg iinn__lleennggtthh;; + ddeess__ccbblloocckk kkeeyy;; + ssttrruucctt ssoocckkaaddddrr__iinn **sseennddeerr;; + ssttrruucctt ssoocckkaaddddrr__iinn **rreecceeiivveerr;; + + lloonngg kkrrbb__rrdd__ssaaffee((iinn,,lleennggtthh,,kkeeyy,,sseennddeerr,,rreecceeiivveerr,,mmssgg__ddaattaa)) + uu__cchhaarr **iinn;; + uu__lloonngg lleennggtthh;; + ddeess__ccbblloocckk kkeeyy;; + ssttrruucctt ssoocckkaaddddrr__iinn **sseennddeerr;; + ssttrruucctt ssoocckkaaddddrr__iinn **rreecceeiivveerr;; + MMSSGG__DDAATT **mmssgg__ddaattaa;; + + lloonngg kkrrbb__mmkk__eerrrr((oouutt,,ccooddee,,ssttrriinngg)) + uu__cchhaarr **oouutt;; + lloonngg ccooddee;; + cchhaarr **ssttrriinngg;; + + lloonngg kkrrbb__rrdd__eerrrr((iinn,,lleennggtthh,,ccooddee,,mmssgg__ddaattaa)) + uu__cchhaarr **iinn;; + uu__lloonngg lleennggtthh;; + lloonngg ccooddee;; + MMSSGG__DDAATT **mmssgg__ddaattaa;; + +DDEESSCCRRIIPPTTIIOONN + This library supports network authentication and various + related operations. The library contains many routines + beyond those described in this man page, but they are not + intended to be used directly. Instead, they are called by + the routines that are described, the authentication server + and the login program. + + _k_r_b___e_r_r___t_x_t_[_] contains text string descriptions of various + Kerberos error codes returned by some of the routines + below. + + _k_r_b___m_k___r_e_q takes a pointer to a text structure in which an + authenticator is to be built. It also takes the name, + instance, and realm of the service to be used and an + optional checksum. It is up to the application to decide + + + +MIT Project Athena Kerberos Version 4.0 2 + + + + + + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + + how to generate the checksum. _k_r_b___m_k___r_e_q then retrieves a + ticket for the desired service and creates an authentica- + tor. The authenticator is built in _a_u_t_h_e_n_t and is acces- + sible to the calling procedure. + + It is up to the application to get the authenticator to + the service where it will be read by _k_r_b___r_d___r_e_q_. Unless + an attacker possesses the session key contained in the + ticket, it will be unable to modify the authenticator. + Thus, the checksum can be used to verify the authenticity + of the other data that will pass through a connection. + + _k_r_b___r_d___r_e_q takes an authenticator of type KKTTEEXXTT,, a service + name, an instance, the address of the host originating the + request, and a pointer to a structure of type AAUUTTHH__DDAATT + which is filled in with information obtained from the + authenticator. It also optionally takes the name of the + file in which it will find the secret key(s) for the ser- + vice. If the supplied _i_n_s_t_a_n_c_e contains "*", then the + first service key with the same service name found in the + service key file will be used, and the _i_n_s_t_a_n_c_e argument + will be filled in with the chosen instance. This means + that the caller must provide space for such an instance + name. + + It is used to find out information about the principal + when a request has been made to a service. It is up to + the application protocol to get the authenticator from the + client to the service. The authenticator is then passed + to _k_r_b___r_d___r_e_q to extract the desired information. + + _k_r_b___r_d___r_e_q returns zero (RD_AP_OK) upon successful authen- + tication. If a packet was forged, modified, or replayed, + authentication will fail. If the authentication fails, a + non-zero value is returned indicating the particular prob- + lem encountered. See _k_r_b_._h for the list of error codes. + + If the last argument is the null string (""), krb_rd_req + will use the file /etc/srvtab to find its keys. If the + last argument is NULL, it will assume that the key has + been set by _k_r_b___s_e_t___k_e_y and will not bother looking fur- + ther. + + _k_r_b___k_n_t_o_l_n converts a Kerberos name to a local name. It + takes a structure of type AUTH_DAT and uses the name and + instance to look in the database /etc/aname to find the + corresponding local name. The local name is returned and + can be used by an application to change uids, directories, + or other parameters. It is not an integral part of Ker- + beros, but is instead provided to support the use of Ker- + beros in existing utilities. + + + +MIT Project Athena Kerberos Version 4.0 3 + + + + + + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + + _k_r_b___s_e_t___k_e_y takes as an argument a des key. It then cre- + ates a key schedule from it and saves the original key to + be used as an initialization vector. It is used to set + the server's key which must be used to decrypt tickets. + + If called with a non-zero second argument, _k_r_b___s_e_t___k_e_y + will first convert the input from a string of arbitrary + length to a DES key by encrypting it with a one-way func- + tion. + + In most cases it should not be necessary to call + _k_r_b___s_e_t___k_e_y_. The necessary keys will usually be obtained + and set inside _k_r_b___r_d___r_e_q_. _k_r_b___s_e_t___k_e_y is provided for + those applications that do not wish to place the applica- + tion keys on disk. + + _k_r_b___g_e_t___c_r_e_d searches the caller's ticket file for a + ticket for the given service, instance, and realm; and, if + a ticket is found, fills in the given CREDENTIALS struc- + ture with the ticket information. + + If the ticket was found, _k_r_b___g_e_t___c_r_e_d returns GC_OK. If + the ticket file can't be found, can't be read, doesn't + belong to the user (other than root), isn't a regular + file, or is in the wrong mode, the error GC_TKFIL is + returned. + + _k_r_b___m_k___p_r_i_v creates an encrypted, authenticated message + from any arbitrary application data, pointed to by _i_n and + _i_n___l_e_n_g_t_h bytes long. The private session key, pointed to + by _k_e_y and the key schedule, _s_c_h_e_d_u_l_e_, are used to encrypt + the data and some header information using _p_c_b_c___e_n_c_r_y_p_t_. + _s_e_n_d_e_r and _r_e_c_e_i_v_e_r point to the Internet address of the + two parties. In addition to providing privacy, this pro- + tocol message protects against modifications, insertions + or replays. The encapsulated message and header are + placed in the area pointed to by _o_u_t and the routine + returns the length of the output, or -1 indicating an + error. + + _k_r_b___r_d___p_r_i_v decrypts and authenticates a received + _k_r_b___m_k___p_r_i_v message. _i_n points to the beginning of the + received message, whose length is specified in _i_n___l_e_n_g_t_h_. + The private session key, pointed to by _k_e_y_, and the key + schedule, _s_c_h_e_d_u_l_e_, are used to decrypt and verify the + received message. _m_s_g___d_a_t_a is a pointer to a _M_S_G___D_A_T + struct, defined in _k_r_b_._h_. The routine fills in the + _a_p_p___d_a_t_a field with a pointer to the decrypted application + data, _a_p_p___l_e_n_g_t_h with the length of the _a_p_p___d_a_t_a field, + _t_i_m_e___s_e_c and _t_i_m_e___5_m_s with the timestamps in the message, + and _s_w_a_p with a 1 if the byte order of the receiver is + + + +MIT Project Athena Kerberos Version 4.0 4 + + + + + + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + + different than that of the sender. (The application must + still determine if it is appropriate to byte-swap applica- + tion data; the Kerberos protocol fields are already taken + care of). The _h_a_s_h field returns a value useful as input + to the _k_r_b___c_k___r_e_p_l routine. + + The routine returns zero if ok, or a Kerberos error code. + Modified messages and old messages cause errors, but it is + up to the caller to check the time sequence of messages, + and to check against recently replayed messages using + _k_r_b___c_k___r_e_p_l if so desired. + + _k_r_b___m_k___s_a_f_e creates an authenticated, but unencrypted mes- + sage from any arbitrary application data, pointed to by _i_n + and _i_n___l_e_n_g_t_h bytes long. The private session key, + pointed to by _k_e_y_, is used to seed the _q_u_a_d___c_k_s_u_m_(_) check- + sum algorithm used as part of the authentication. _s_e_n_d_e_r + and _r_e_c_e_i_v_e_r point to the Internet address of the two par- + ties. This message does not provide privacy, but does + protect (via detection) against modifications, insertions + or replays. The encapsulated message and header are + placed in the area pointed to by _o_u_t and the routine + returns the length of the output, or -1 indicating an + error. The authentication provided by this routine is not + as strong as that provided by _k_r_b___m_k___p_r_i_v or by computing + the checksum using _c_b_c___c_k_s_u_m instead, both of which + authenticate via DES. + + + _k_r_b___r_d___s_a_f_e authenticates a received _k_r_b___m_k___s_a_f_e message. + _i_n points to the beginning of the received message, whose + length is specified in _i_n___l_e_n_g_t_h_. The private session + key, pointed to by _k_e_y_, is used to seed the quad_cksum() + routine as part of the authentication. _m_s_g___d_a_t_a is a + pointer to a _M_S_G___D_A_T struct, defined in _k_r_b_._h _. The rou- + tine fills in these _M_S_G___D_A_T fields: the _a_p_p___d_a_t_a field + with a pointer to the application data, _a_p_p___l_e_n_g_t_h with + the length of the _a_p_p___d_a_t_a field, _t_i_m_e___s_e_c and _t_i_m_e___5_m_s + with the timestamps in the message, and _s_w_a_p with a 1 if + the byte order of the receiver is different than that of + the sender. (The application must still determine if it + is appropriate to byte-swap application data; the Kerberos + protocol fields are already taken care of). The _h_a_s_h + field returns a value useful as input to the _k_r_b___c_k___r_e_p_l + routine. + + The routine returns zero if ok, or a Kerberos error code. + Modified messages and old messages cause errors, but it is + up to the caller to check the time sequence of messages, + and to check against recently replayed messages using + _k_r_b___c_k___r_e_p_l if so desired. + + + +MIT Project Athena Kerberos Version 4.0 5 + + + + + + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + + _k_r_b___m_k___e_r_r constructs an application level error message + that may be used along with _k_r_b___m_k___p_r_i_v or _k_r_b___m_k___s_a_f_e_. + _o_u_t is a pointer to the output buffer, _c_o_d_e is an applica- + tion specific error code, and _s_t_r_i_n_g is an application + specific error string. + + + _k_r_b___r_d___e_r_r unpacks a received _k_r_b___m_k___e_r_r message. _i_n + points to the beginning of the received message, whose + length is specified in _i_n___l_e_n_g_t_h_. _c_o_d_e is a pointer to a + value to be filled in with the error value provided by the + application. _m_s_g___d_a_t_a is a pointer to a _M_S_G___D_A_T struct, + defined in _k_r_b_._h _. The routine fills in these _M_S_G___D_A_T + fields: the _a_p_p___d_a_t_a field with a pointer to the applica- + tion error text, _a_p_p___l_e_n_g_t_h with the length of the + _a_p_p___d_a_t_a field, and _s_w_a_p with a 1 if the byte order of the + receiver is different than that of the sender. (The + application must still determine if it is appropriate to + byte-swap application data; the Kerberos protocol fields + are already taken care of). + + The routine returns zero if the error message has been + successfully received, or a Kerberos error code. + + The _K_T_E_X_T structure is used to pass around text of varying + lengths. It consists of a buffer for the data, and a + length. krb_rd_req takes an argument of this type con- + taining the authenticator, and krb_mk_req returns the + authenticator in a structure of this type. KTEXT itself + is really a pointer to the structure. The actual struc- + ture is of type KTEXT_ST. + + The _A_U_T_H___D_A_T structure is filled in by krb_rd_req. It + must be allocated before calling krb_rd_req, and a pointer + to it is passed. The structure is filled in with data + obtained from Kerberos. _M_S_G___D_A_T structure is filled in by + either krb_rd_priv, krb_rd_safe, or krb_rd_err. It must + be allocated before the call and a pointer to it is + passed. The structure is filled in with data obtained + from Kerberos. + + +FFIILLEESS + /usr/include/kerberosIV/krb.h + /usr/lib/libkrb.a + /usr/include/kerberosIV/des.h + /usr/lib/libdes.a + /etc/kerberosIV/aname + /etc/kerberosIV/srvtab + /tmp/tkt[uid] + + + + +MIT Project Athena Kerberos Version 4.0 6 + + + + + + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + +SSEEEE AALLSSOO + kerberos(1), des_crypt(3) + +DDIIAAGGNNOOSSTTIICCSS +BBUUGGSS + The caller of _k_r_b___r_d___r_e_q_, _k_r_b___r_d___p_r_i_v_, _a_n_d _k_r_b___r_d___s_a_f_e + must check time order and for replay attempts. + _k_r_b___c_k___r_e_p_l is not implemented yet. + +AAUUTTHHOORRSS + Clifford Neuman, MIT Project Athena + Steve Miller, MIT Project Athena/Digital Equipment Corpo- + ration + +RREESSTTRRIICCTTIIOONNSS + COPYRIGHT 1985,1986,1989 Massachusetts Institute of Tech- + nology + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +MIT Project Athena Kerberos Version 4.0 7 + + + + + diff --git a/usr/share/man/cat3/krb.0 b/usr/share/man/cat3/krb.0 new file mode 100644 index 0000000000..ac1157fbda --- /dev/null +++ b/usr/share/man/cat3/krb.0 @@ -0,0 +1,462 @@ + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + +NNAAMMEE + krb_mk_req, krb_rd_req, krb_kntoln, krb_set_key, + krb_get_cred, krb_mk_priv, krb_rd_priv, krb_mk_safe, + krb_rd_safe, krb_mk_err, krb_rd_err, krb_ck_repl - Ker- + beros authentication library + +SSYYNNOOPPSSIISS + ##iinncclluuddee <> + ##iinncclluuddee <> + + eexxtteerrnn cchhaarr **kkrrbb__eerrrr__ttxxtt[[]];; + + iinntt kkrrbb__mmkk__rreeqq((aauutthheenntt,,sseerrvviiccee,,iinnssttaannccee,,rreeaallmm,,cchheecckkssuumm)) + KKTTEEXXTT aauutthheenntt;; + cchhaarr **sseerrvviiccee;; + cchhaarr **iinnssttaannccee;; + cchhaarr **rreeaallmm;; + uu__lloonngg cchheecckkssuumm;; + + iinntt kkrrbb__rrdd__rreeqq((aauutthheenntt,,sseerrvviiccee,,iinnssttaannccee,,ffrroomm__aaddddrr,,aadd,,ffnn)) + KKTTEEXXTT aauutthheenntt;; + cchhaarr **sseerrvviiccee;; + cchhaarr **iinnssttaannccee;; + uu__lloonngg ffrroomm__aaddddrr;; + AAUUTTHH__DDAATT **aadd;; + cchhaarr **ffnn;; + + iinntt kkrrbb__kknnttoollnn((aadd,,llnnaammee)) + AAUUTTHH__DDAATT **aadd;; + cchhaarr **llnnaammee;; + + iinntt kkrrbb__sseett__kkeeyy((kkeeyy,,ccvvtt)) + cchhaarr **kkeeyy;; + iinntt ccvvtt;; + + iinntt kkrrbb__ggeett__ccrreedd((sseerrvviiccee,,iinnssttaannccee,,rreeaallmm,,cc)) + cchhaarr **sseerrvviiccee;; + cchhaarr **iinnssttaannccee;; + cchhaarr **rreeaallmm;; + CCRREEDDEENNTTIIAALLSS **cc;; + + lloonngg kkrrbb__mmkk__pprriivv((iinn,,oouutt,,iinn__lleennggtthh,,sscchheedduullee,,kkeeyy,,sseennddeerr,,rreecceeiivveerr)) + uu__cchhaarr **iinn;; + uu__cchhaarr **oouutt;; + uu__lloonngg iinn__lleennggtthh;; + ddeess__ccbblloocckk kkeeyy;; + ddeess__kkeeyy__sscchheedduullee sscchheedduullee;; + ssttrruucctt ssoocckkaaddddrr__iinn **sseennddeerr;; + ssttrruucctt ssoocckkaaddddrr__iinn **rreecceeiivveerr;; + + lloonngg kkrrbb__rrdd__pprriivv((iinn,,iinn__lleennggtthh,,sscchheedduullee,,kkeeyy,,sseennddeerr,,rreecceeiivveerr,,mmssgg__ddaattaa)) + + + +MIT Project Athena Kerberos Version 4.0 1 + + + + + + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + + uu__cchhaarr **iinn;; + uu__lloonngg iinn__lleennggtthh;; + KKeeyy__sscchheedduullee sscchheedduullee;; + ddeess__ccbblloocckk kkeeyy;; + ssttrruucctt ssoocckkaaddddrr__iinn **sseennddeerr;; + ssttrruucctt ssoocckkaaddddrr__iinn **rreecceeiivveerr;; + MMSSGG__DDAATT **mmssgg__ddaattaa;; + + lloonngg kkrrbb__mmkk__ssaaffee((iinn,,oouutt,,iinn__lleennggtthh,,kkeeyy,,sseennddeerr,,rreecceeiivveerr)) + uu__cchhaarr **iinn;; + uu__cchhaarr **oouutt;; + uu__lloonngg iinn__lleennggtthh;; + ddeess__ccbblloocckk kkeeyy;; + ssttrruucctt ssoocckkaaddddrr__iinn **sseennddeerr;; + ssttrruucctt ssoocckkaaddddrr__iinn **rreecceeiivveerr;; + + lloonngg kkrrbb__rrdd__ssaaffee((iinn,,lleennggtthh,,kkeeyy,,sseennddeerr,,rreecceeiivveerr,,mmssgg__ddaattaa)) + uu__cchhaarr **iinn;; + uu__lloonngg lleennggtthh;; + ddeess__ccbblloocckk kkeeyy;; + ssttrruucctt ssoocckkaaddddrr__iinn **sseennddeerr;; + ssttrruucctt ssoocckkaaddddrr__iinn **rreecceeiivveerr;; + MMSSGG__DDAATT **mmssgg__ddaattaa;; + + lloonngg kkrrbb__mmkk__eerrrr((oouutt,,ccooddee,,ssttrriinngg)) + uu__cchhaarr **oouutt;; + lloonngg ccooddee;; + cchhaarr **ssttrriinngg;; + + lloonngg kkrrbb__rrdd__eerrrr((iinn,,lleennggtthh,,ccooddee,,mmssgg__ddaattaa)) + uu__cchhaarr **iinn;; + uu__lloonngg lleennggtthh;; + lloonngg ccooddee;; + MMSSGG__DDAATT **mmssgg__ddaattaa;; + +DDEESSCCRRIIPPTTIIOONN + This library supports network authentication and various + related operations. The library contains many routines + beyond those described in this man page, but they are not + intended to be used directly. Instead, they are called by + the routines that are described, the authentication server + and the login program. + + _k_r_b___e_r_r___t_x_t_[_] contains text string descriptions of various + Kerberos error codes returned by some of the routines + below. + + _k_r_b___m_k___r_e_q takes a pointer to a text structure in which an + authenticator is to be built. It also takes the name, + instance, and realm of the service to be used and an + optional checksum. It is up to the application to decide + + + +MIT Project Athena Kerberos Version 4.0 2 + + + + + + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + + how to generate the checksum. _k_r_b___m_k___r_e_q then retrieves a + ticket for the desired service and creates an authentica- + tor. The authenticator is built in _a_u_t_h_e_n_t and is acces- + sible to the calling procedure. + + It is up to the application to get the authenticator to + the service where it will be read by _k_r_b___r_d___r_e_q_. Unless + an attacker possesses the session key contained in the + ticket, it will be unable to modify the authenticator. + Thus, the checksum can be used to verify the authenticity + of the other data that will pass through a connection. + + _k_r_b___r_d___r_e_q takes an authenticator of type KKTTEEXXTT,, a service + name, an instance, the address of the host originating the + request, and a pointer to a structure of type AAUUTTHH__DDAATT + which is filled in with information obtained from the + authenticator. It also optionally takes the name of the + file in which it will find the secret key(s) for the ser- + vice. If the supplied _i_n_s_t_a_n_c_e contains "*", then the + first service key with the same service name found in the + service key file will be used, and the _i_n_s_t_a_n_c_e argument + will be filled in with the chosen instance. This means + that the caller must provide space for such an instance + name. + + It is used to find out information about the principal + when a request has been made to a service. It is up to + the application protocol to get the authenticator from the + client to the service. The authenticator is then passed + to _k_r_b___r_d___r_e_q to extract the desired information. + + _k_r_b___r_d___r_e_q returns zero (RD_AP_OK) upon successful authen- + tication. If a packet was forged, modified, or replayed, + authentication will fail. If the authentication fails, a + non-zero value is returned indicating the particular prob- + lem encountered. See _k_r_b_._h for the list of error codes. + + If the last argument is the null string (""), krb_rd_req + will use the file /etc/srvtab to find its keys. If the + last argument is NULL, it will assume that the key has + been set by _k_r_b___s_e_t___k_e_y and will not bother looking fur- + ther. + + _k_r_b___k_n_t_o_l_n converts a Kerberos name to a local name. It + takes a structure of type AUTH_DAT and uses the name and + instance to look in the database /etc/aname to find the + corresponding local name. The local name is returned and + can be used by an application to change uids, directories, + or other parameters. It is not an integral part of Ker- + beros, but is instead provided to support the use of Ker- + beros in existing utilities. + + + +MIT Project Athena Kerberos Version 4.0 3 + + + + + + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + + _k_r_b___s_e_t___k_e_y takes as an argument a des key. It then cre- + ates a key schedule from it and saves the original key to + be used as an initialization vector. It is used to set + the server's key which must be used to decrypt tickets. + + If called with a non-zero second argument, _k_r_b___s_e_t___k_e_y + will first convert the input from a string of arbitrary + length to a DES key by encrypting it with a one-way func- + tion. + + In most cases it should not be necessary to call + _k_r_b___s_e_t___k_e_y_. The necessary keys will usually be obtained + and set inside _k_r_b___r_d___r_e_q_. _k_r_b___s_e_t___k_e_y is provided for + those applications that do not wish to place the applica- + tion keys on disk. + + _k_r_b___g_e_t___c_r_e_d searches the caller's ticket file for a + ticket for the given service, instance, and realm; and, if + a ticket is found, fills in the given CREDENTIALS struc- + ture with the ticket information. + + If the ticket was found, _k_r_b___g_e_t___c_r_e_d returns GC_OK. If + the ticket file can't be found, can't be read, doesn't + belong to the user (other than root), isn't a regular + file, or is in the wrong mode, the error GC_TKFIL is + returned. + + _k_r_b___m_k___p_r_i_v creates an encrypted, authenticated message + from any arbitrary application data, pointed to by _i_n and + _i_n___l_e_n_g_t_h bytes long. The private session key, pointed to + by _k_e_y and the key schedule, _s_c_h_e_d_u_l_e_, are used to encrypt + the data and some header information using _p_c_b_c___e_n_c_r_y_p_t_. + _s_e_n_d_e_r and _r_e_c_e_i_v_e_r point to the Internet address of the + two parties. In addition to providing privacy, this pro- + tocol message protects against modifications, insertions + or replays. The encapsulated message and header are + placed in the area pointed to by _o_u_t and the routine + returns the length of the output, or -1 indicating an + error. + + _k_r_b___r_d___p_r_i_v decrypts and authenticates a received + _k_r_b___m_k___p_r_i_v message. _i_n points to the beginning of the + received message, whose length is specified in _i_n___l_e_n_g_t_h_. + The private session key, pointed to by _k_e_y_, and the key + schedule, _s_c_h_e_d_u_l_e_, are used to decrypt and verify the + received message. _m_s_g___d_a_t_a is a pointer to a _M_S_G___D_A_T + struct, defined in _k_r_b_._h_. The routine fills in the + _a_p_p___d_a_t_a field with a pointer to the decrypted application + data, _a_p_p___l_e_n_g_t_h with the length of the _a_p_p___d_a_t_a field, + _t_i_m_e___s_e_c and _t_i_m_e___5_m_s with the timestamps in the message, + and _s_w_a_p with a 1 if the byte order of the receiver is + + + +MIT Project Athena Kerberos Version 4.0 4 + + + + + + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + + different than that of the sender. (The application must + still determine if it is appropriate to byte-swap applica- + tion data; the Kerberos protocol fields are already taken + care of). The _h_a_s_h field returns a value useful as input + to the _k_r_b___c_k___r_e_p_l routine. + + The routine returns zero if ok, or a Kerberos error code. + Modified messages and old messages cause errors, but it is + up to the caller to check the time sequence of messages, + and to check against recently replayed messages using + _k_r_b___c_k___r_e_p_l if so desired. + + _k_r_b___m_k___s_a_f_e creates an authenticated, but unencrypted mes- + sage from any arbitrary application data, pointed to by _i_n + and _i_n___l_e_n_g_t_h bytes long. The private session key, + pointed to by _k_e_y_, is used to seed the _q_u_a_d___c_k_s_u_m_(_) check- + sum algorithm used as part of the authentication. _s_e_n_d_e_r + and _r_e_c_e_i_v_e_r point to the Internet address of the two par- + ties. This message does not provide privacy, but does + protect (via detection) against modifications, insertions + or replays. The encapsulated message and header are + placed in the area pointed to by _o_u_t and the routine + returns the length of the output, or -1 indicating an + error. The authentication provided by this routine is not + as strong as that provided by _k_r_b___m_k___p_r_i_v or by computing + the checksum using _c_b_c___c_k_s_u_m instead, both of which + authenticate via DES. + + + _k_r_b___r_d___s_a_f_e authenticates a received _k_r_b___m_k___s_a_f_e message. + _i_n points to the beginning of the received message, whose + length is specified in _i_n___l_e_n_g_t_h_. The private session + key, pointed to by _k_e_y_, is used to seed the quad_cksum() + routine as part of the authentication. _m_s_g___d_a_t_a is a + pointer to a _M_S_G___D_A_T struct, defined in _k_r_b_._h _. The rou- + tine fills in these _M_S_G___D_A_T fields: the _a_p_p___d_a_t_a field + with a pointer to the application data, _a_p_p___l_e_n_g_t_h with + the length of the _a_p_p___d_a_t_a field, _t_i_m_e___s_e_c and _t_i_m_e___5_m_s + with the timestamps in the message, and _s_w_a_p with a 1 if + the byte order of the receiver is different than that of + the sender. (The application must still determine if it + is appropriate to byte-swap application data; the Kerberos + protocol fields are already taken care of). The _h_a_s_h + field returns a value useful as input to the _k_r_b___c_k___r_e_p_l + routine. + + The routine returns zero if ok, or a Kerberos error code. + Modified messages and old messages cause errors, but it is + up to the caller to check the time sequence of messages, + and to check against recently replayed messages using + _k_r_b___c_k___r_e_p_l if so desired. + + + +MIT Project Athena Kerberos Version 4.0 5 + + + + + + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + + _k_r_b___m_k___e_r_r constructs an application level error message + that may be used along with _k_r_b___m_k___p_r_i_v or _k_r_b___m_k___s_a_f_e_. + _o_u_t is a pointer to the output buffer, _c_o_d_e is an applica- + tion specific error code, and _s_t_r_i_n_g is an application + specific error string. + + + _k_r_b___r_d___e_r_r unpacks a received _k_r_b___m_k___e_r_r message. _i_n + points to the beginning of the received message, whose + length is specified in _i_n___l_e_n_g_t_h_. _c_o_d_e is a pointer to a + value to be filled in with the error value provided by the + application. _m_s_g___d_a_t_a is a pointer to a _M_S_G___D_A_T struct, + defined in _k_r_b_._h _. The routine fills in these _M_S_G___D_A_T + fields: the _a_p_p___d_a_t_a field with a pointer to the applica- + tion error text, _a_p_p___l_e_n_g_t_h with the length of the + _a_p_p___d_a_t_a field, and _s_w_a_p with a 1 if the byte order of the + receiver is different than that of the sender. (The + application must still determine if it is appropriate to + byte-swap application data; the Kerberos protocol fields + are already taken care of). + + The routine returns zero if the error message has been + successfully received, or a Kerberos error code. + + The _K_T_E_X_T structure is used to pass around text of varying + lengths. It consists of a buffer for the data, and a + length. krb_rd_req takes an argument of this type con- + taining the authenticator, and krb_mk_req returns the + authenticator in a structure of this type. KTEXT itself + is really a pointer to the structure. The actual struc- + ture is of type KTEXT_ST. + + The _A_U_T_H___D_A_T structure is filled in by krb_rd_req. It + must be allocated before calling krb_rd_req, and a pointer + to it is passed. The structure is filled in with data + obtained from Kerberos. _M_S_G___D_A_T structure is filled in by + either krb_rd_priv, krb_rd_safe, or krb_rd_err. It must + be allocated before the call and a pointer to it is + passed. The structure is filled in with data obtained + from Kerberos. + + +FFIILLEESS + /usr/include/kerberosIV/krb.h + /usr/lib/libkrb.a + /usr/include/kerberosIV/des.h + /usr/lib/libdes.a + /etc/kerberosIV/aname + /etc/kerberosIV/srvtab + /tmp/tkt[uid] + + + + +MIT Project Athena Kerberos Version 4.0 6 + + + + + + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + +SSEEEE AALLSSOO + kerberos(1), des_crypt(3) + +DDIIAAGGNNOOSSTTIICCSS +BBUUGGSS + The caller of _k_r_b___r_d___r_e_q_, _k_r_b___r_d___p_r_i_v_, _a_n_d _k_r_b___r_d___s_a_f_e + must check time order and for replay attempts. + _k_r_b___c_k___r_e_p_l is not implemented yet. + +AAUUTTHHOORRSS + Clifford Neuman, MIT Project Athena + Steve Miller, MIT Project Athena/Digital Equipment Corpo- + ration + +RREESSTTRRIICCTTIIOONNSS + COPYRIGHT 1985,1986,1989 Massachusetts Institute of Tech- + nology + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +MIT Project Athena Kerberos Version 4.0 7 + + + + + diff --git a/usr/share/man/cat3/krb_ck_repl.0 b/usr/share/man/cat3/krb_ck_repl.0 new file mode 100644 index 0000000000..ac1157fbda --- /dev/null +++ b/usr/share/man/cat3/krb_ck_repl.0 @@ -0,0 +1,462 @@ + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + +NNAAMMEE + krb_mk_req, krb_rd_req, krb_kntoln, krb_set_key, + krb_get_cred, krb_mk_priv, krb_rd_priv, krb_mk_safe, + krb_rd_safe, krb_mk_err, krb_rd_err, krb_ck_repl - Ker- + beros authentication library + +SSYYNNOOPPSSIISS + ##iinncclluuddee <> + ##iinncclluuddee <> + + eexxtteerrnn cchhaarr **kkrrbb__eerrrr__ttxxtt[[]];; + + iinntt kkrrbb__mmkk__rreeqq((aauutthheenntt,,sseerrvviiccee,,iinnssttaannccee,,rreeaallmm,,cchheecckkssuumm)) + KKTTEEXXTT aauutthheenntt;; + cchhaarr **sseerrvviiccee;; + cchhaarr **iinnssttaannccee;; + cchhaarr **rreeaallmm;; + uu__lloonngg cchheecckkssuumm;; + + iinntt kkrrbb__rrdd__rreeqq((aauutthheenntt,,sseerrvviiccee,,iinnssttaannccee,,ffrroomm__aaddddrr,,aadd,,ffnn)) + KKTTEEXXTT aauutthheenntt;; + cchhaarr **sseerrvviiccee;; + cchhaarr **iinnssttaannccee;; + uu__lloonngg ffrroomm__aaddddrr;; + AAUUTTHH__DDAATT **aadd;; + cchhaarr **ffnn;; + + iinntt kkrrbb__kknnttoollnn((aadd,,llnnaammee)) + AAUUTTHH__DDAATT **aadd;; + cchhaarr **llnnaammee;; + + iinntt kkrrbb__sseett__kkeeyy((kkeeyy,,ccvvtt)) + cchhaarr **kkeeyy;; + iinntt ccvvtt;; + + iinntt kkrrbb__ggeett__ccrreedd((sseerrvviiccee,,iinnssttaannccee,,rreeaallmm,,cc)) + cchhaarr **sseerrvviiccee;; + cchhaarr **iinnssttaannccee;; + cchhaarr **rreeaallmm;; + CCRREEDDEENNTTIIAALLSS **cc;; + + lloonngg kkrrbb__mmkk__pprriivv((iinn,,oouutt,,iinn__lleennggtthh,,sscchheedduullee,,kkeeyy,,sseennddeerr,,rreecceeiivveerr)) + uu__cchhaarr **iinn;; + uu__cchhaarr **oouutt;; + uu__lloonngg iinn__lleennggtthh;; + ddeess__ccbblloocckk kkeeyy;; + ddeess__kkeeyy__sscchheedduullee sscchheedduullee;; + ssttrruucctt ssoocckkaaddddrr__iinn **sseennddeerr;; + ssttrruucctt ssoocckkaaddddrr__iinn **rreecceeiivveerr;; + + lloonngg kkrrbb__rrdd__pprriivv((iinn,,iinn__lleennggtthh,,sscchheedduullee,,kkeeyy,,sseennddeerr,,rreecceeiivveerr,,mmssgg__ddaattaa)) + + + +MIT Project Athena Kerberos Version 4.0 1 + + + + + + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + + uu__cchhaarr **iinn;; + uu__lloonngg iinn__lleennggtthh;; + KKeeyy__sscchheedduullee sscchheedduullee;; + ddeess__ccbblloocckk kkeeyy;; + ssttrruucctt ssoocckkaaddddrr__iinn **sseennddeerr;; + ssttrruucctt ssoocckkaaddddrr__iinn **rreecceeiivveerr;; + MMSSGG__DDAATT **mmssgg__ddaattaa;; + + lloonngg kkrrbb__mmkk__ssaaffee((iinn,,oouutt,,iinn__lleennggtthh,,kkeeyy,,sseennddeerr,,rreecceeiivveerr)) + uu__cchhaarr **iinn;; + uu__cchhaarr **oouutt;; + uu__lloonngg iinn__lleennggtthh;; + ddeess__ccbblloocckk kkeeyy;; + ssttrruucctt ssoocckkaaddddrr__iinn **sseennddeerr;; + ssttrruucctt ssoocckkaaddddrr__iinn **rreecceeiivveerr;; + + lloonngg kkrrbb__rrdd__ssaaffee((iinn,,lleennggtthh,,kkeeyy,,sseennddeerr,,rreecceeiivveerr,,mmssgg__ddaattaa)) + uu__cchhaarr **iinn;; + uu__lloonngg lleennggtthh;; + ddeess__ccbblloocckk kkeeyy;; + ssttrruucctt ssoocckkaaddddrr__iinn **sseennddeerr;; + ssttrruucctt ssoocckkaaddddrr__iinn **rreecceeiivveerr;; + MMSSGG__DDAATT **mmssgg__ddaattaa;; + + lloonngg kkrrbb__mmkk__eerrrr((oouutt,,ccooddee,,ssttrriinngg)) + uu__cchhaarr **oouutt;; + lloonngg ccooddee;; + cchhaarr **ssttrriinngg;; + + lloonngg kkrrbb__rrdd__eerrrr((iinn,,lleennggtthh,,ccooddee,,mmssgg__ddaattaa)) + uu__cchhaarr **iinn;; + uu__lloonngg lleennggtthh;; + lloonngg ccooddee;; + MMSSGG__DDAATT **mmssgg__ddaattaa;; + +DDEESSCCRRIIPPTTIIOONN + This library supports network authentication and various + related operations. The library contains many routines + beyond those described in this man page, but they are not + intended to be used directly. Instead, they are called by + the routines that are described, the authentication server + and the login program. + + _k_r_b___e_r_r___t_x_t_[_] contains text string descriptions of various + Kerberos error codes returned by some of the routines + below. + + _k_r_b___m_k___r_e_q takes a pointer to a text structure in which an + authenticator is to be built. It also takes the name, + instance, and realm of the service to be used and an + optional checksum. It is up to the application to decide + + + +MIT Project Athena Kerberos Version 4.0 2 + + + + + + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + + how to generate the checksum. _k_r_b___m_k___r_e_q then retrieves a + ticket for the desired service and creates an authentica- + tor. The authenticator is built in _a_u_t_h_e_n_t and is acces- + sible to the calling procedure. + + It is up to the application to get the authenticator to + the service where it will be read by _k_r_b___r_d___r_e_q_. Unless + an attacker possesses the session key contained in the + ticket, it will be unable to modify the authenticator. + Thus, the checksum can be used to verify the authenticity + of the other data that will pass through a connection. + + _k_r_b___r_d___r_e_q takes an authenticator of type KKTTEEXXTT,, a service + name, an instance, the address of the host originating the + request, and a pointer to a structure of type AAUUTTHH__DDAATT + which is filled in with information obtained from the + authenticator. It also optionally takes the name of the + file in which it will find the secret key(s) for the ser- + vice. If the supplied _i_n_s_t_a_n_c_e contains "*", then the + first service key with the same service name found in the + service key file will be used, and the _i_n_s_t_a_n_c_e argument + will be filled in with the chosen instance. This means + that the caller must provide space for such an instance + name. + + It is used to find out information about the principal + when a request has been made to a service. It is up to + the application protocol to get the authenticator from the + client to the service. The authenticator is then passed + to _k_r_b___r_d___r_e_q to extract the desired information. + + _k_r_b___r_d___r_e_q returns zero (RD_AP_OK) upon successful authen- + tication. If a packet was forged, modified, or replayed, + authentication will fail. If the authentication fails, a + non-zero value is returned indicating the particular prob- + lem encountered. See _k_r_b_._h for the list of error codes. + + If the last argument is the null string (""), krb_rd_req + will use the file /etc/srvtab to find its keys. If the + last argument is NULL, it will assume that the key has + been set by _k_r_b___s_e_t___k_e_y and will not bother looking fur- + ther. + + _k_r_b___k_n_t_o_l_n converts a Kerberos name to a local name. It + takes a structure of type AUTH_DAT and uses the name and + instance to look in the database /etc/aname to find the + corresponding local name. The local name is returned and + can be used by an application to change uids, directories, + or other parameters. It is not an integral part of Ker- + beros, but is instead provided to support the use of Ker- + beros in existing utilities. + + + +MIT Project Athena Kerberos Version 4.0 3 + + + + + + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + + _k_r_b___s_e_t___k_e_y takes as an argument a des key. It then cre- + ates a key schedule from it and saves the original key to + be used as an initialization vector. It is used to set + the server's key which must be used to decrypt tickets. + + If called with a non-zero second argument, _k_r_b___s_e_t___k_e_y + will first convert the input from a string of arbitrary + length to a DES key by encrypting it with a one-way func- + tion. + + In most cases it should not be necessary to call + _k_r_b___s_e_t___k_e_y_. The necessary keys will usually be obtained + and set inside _k_r_b___r_d___r_e_q_. _k_r_b___s_e_t___k_e_y is provided for + those applications that do not wish to place the applica- + tion keys on disk. + + _k_r_b___g_e_t___c_r_e_d searches the caller's ticket file for a + ticket for the given service, instance, and realm; and, if + a ticket is found, fills in the given CREDENTIALS struc- + ture with the ticket information. + + If the ticket was found, _k_r_b___g_e_t___c_r_e_d returns GC_OK. If + the ticket file can't be found, can't be read, doesn't + belong to the user (other than root), isn't a regular + file, or is in the wrong mode, the error GC_TKFIL is + returned. + + _k_r_b___m_k___p_r_i_v creates an encrypted, authenticated message + from any arbitrary application data, pointed to by _i_n and + _i_n___l_e_n_g_t_h bytes long. The private session key, pointed to + by _k_e_y and the key schedule, _s_c_h_e_d_u_l_e_, are used to encrypt + the data and some header information using _p_c_b_c___e_n_c_r_y_p_t_. + _s_e_n_d_e_r and _r_e_c_e_i_v_e_r point to the Internet address of the + two parties. In addition to providing privacy, this pro- + tocol message protects against modifications, insertions + or replays. The encapsulated message and header are + placed in the area pointed to by _o_u_t and the routine + returns the length of the output, or -1 indicating an + error. + + _k_r_b___r_d___p_r_i_v decrypts and authenticates a received + _k_r_b___m_k___p_r_i_v message. _i_n points to the beginning of the + received message, whose length is specified in _i_n___l_e_n_g_t_h_. + The private session key, pointed to by _k_e_y_, and the key + schedule, _s_c_h_e_d_u_l_e_, are used to decrypt and verify the + received message. _m_s_g___d_a_t_a is a pointer to a _M_S_G___D_A_T + struct, defined in _k_r_b_._h_. The routine fills in the + _a_p_p___d_a_t_a field with a pointer to the decrypted application + data, _a_p_p___l_e_n_g_t_h with the length of the _a_p_p___d_a_t_a field, + _t_i_m_e___s_e_c and _t_i_m_e___5_m_s with the timestamps in the message, + and _s_w_a_p with a 1 if the byte order of the receiver is + + + +MIT Project Athena Kerberos Version 4.0 4 + + + + + + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + + different than that of the sender. (The application must + still determine if it is appropriate to byte-swap applica- + tion data; the Kerberos protocol fields are already taken + care of). The _h_a_s_h field returns a value useful as input + to the _k_r_b___c_k___r_e_p_l routine. + + The routine returns zero if ok, or a Kerberos error code. + Modified messages and old messages cause errors, but it is + up to the caller to check the time sequence of messages, + and to check against recently replayed messages using + _k_r_b___c_k___r_e_p_l if so desired. + + _k_r_b___m_k___s_a_f_e creates an authenticated, but unencrypted mes- + sage from any arbitrary application data, pointed to by _i_n + and _i_n___l_e_n_g_t_h bytes long. The private session key, + pointed to by _k_e_y_, is used to seed the _q_u_a_d___c_k_s_u_m_(_) check- + sum algorithm used as part of the authentication. _s_e_n_d_e_r + and _r_e_c_e_i_v_e_r point to the Internet address of the two par- + ties. This message does not provide privacy, but does + protect (via detection) against modifications, insertions + or replays. The encapsulated message and header are + placed in the area pointed to by _o_u_t and the routine + returns the length of the output, or -1 indicating an + error. The authentication provided by this routine is not + as strong as that provided by _k_r_b___m_k___p_r_i_v or by computing + the checksum using _c_b_c___c_k_s_u_m instead, both of which + authenticate via DES. + + + _k_r_b___r_d___s_a_f_e authenticates a received _k_r_b___m_k___s_a_f_e message. + _i_n points to the beginning of the received message, whose + length is specified in _i_n___l_e_n_g_t_h_. The private session + key, pointed to by _k_e_y_, is used to seed the quad_cksum() + routine as part of the authentication. _m_s_g___d_a_t_a is a + pointer to a _M_S_G___D_A_T struct, defined in _k_r_b_._h _. The rou- + tine fills in these _M_S_G___D_A_T fields: the _a_p_p___d_a_t_a field + with a pointer to the application data, _a_p_p___l_e_n_g_t_h with + the length of the _a_p_p___d_a_t_a field, _t_i_m_e___s_e_c and _t_i_m_e___5_m_s + with the timestamps in the message, and _s_w_a_p with a 1 if + the byte order of the receiver is different than that of + the sender. (The application must still determine if it + is appropriate to byte-swap application data; the Kerberos + protocol fields are already taken care of). The _h_a_s_h + field returns a value useful as input to the _k_r_b___c_k___r_e_p_l + routine. + + The routine returns zero if ok, or a Kerberos error code. + Modified messages and old messages cause errors, but it is + up to the caller to check the time sequence of messages, + and to check against recently replayed messages using + _k_r_b___c_k___r_e_p_l if so desired. + + + +MIT Project Athena Kerberos Version 4.0 5 + + + + + + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + + _k_r_b___m_k___e_r_r constructs an application level error message + that may be used along with _k_r_b___m_k___p_r_i_v or _k_r_b___m_k___s_a_f_e_. + _o_u_t is a pointer to the output buffer, _c_o_d_e is an applica- + tion specific error code, and _s_t_r_i_n_g is an application + specific error string. + + + _k_r_b___r_d___e_r_r unpacks a received _k_r_b___m_k___e_r_r message. _i_n + points to the beginning of the received message, whose + length is specified in _i_n___l_e_n_g_t_h_. _c_o_d_e is a pointer to a + value to be filled in with the error value provided by the + application. _m_s_g___d_a_t_a is a pointer to a _M_S_G___D_A_T struct, + defined in _k_r_b_._h _. The routine fills in these _M_S_G___D_A_T + fields: the _a_p_p___d_a_t_a field with a pointer to the applica- + tion error text, _a_p_p___l_e_n_g_t_h with the length of the + _a_p_p___d_a_t_a field, and _s_w_a_p with a 1 if the byte order of the + receiver is different than that of the sender. (The + application must still determine if it is appropriate to + byte-swap application data; the Kerberos protocol fields + are already taken care of). + + The routine returns zero if the error message has been + successfully received, or a Kerberos error code. + + The _K_T_E_X_T structure is used to pass around text of varying + lengths. It consists of a buffer for the data, and a + length. krb_rd_req takes an argument of this type con- + taining the authenticator, and krb_mk_req returns the + authenticator in a structure of this type. KTEXT itself + is really a pointer to the structure. The actual struc- + ture is of type KTEXT_ST. + + The _A_U_T_H___D_A_T structure is filled in by krb_rd_req. It + must be allocated before calling krb_rd_req, and a pointer + to it is passed. The structure is filled in with data + obtained from Kerberos. _M_S_G___D_A_T structure is filled in by + either krb_rd_priv, krb_rd_safe, or krb_rd_err. It must + be allocated before the call and a pointer to it is + passed. The structure is filled in with data obtained + from Kerberos. + + +FFIILLEESS + /usr/include/kerberosIV/krb.h + /usr/lib/libkrb.a + /usr/include/kerberosIV/des.h + /usr/lib/libdes.a + /etc/kerberosIV/aname + /etc/kerberosIV/srvtab + /tmp/tkt[uid] + + + + +MIT Project Athena Kerberos Version 4.0 6 + + + + + + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + +SSEEEE AALLSSOO + kerberos(1), des_crypt(3) + +DDIIAAGGNNOOSSTTIICCSS +BBUUGGSS + The caller of _k_r_b___r_d___r_e_q_, _k_r_b___r_d___p_r_i_v_, _a_n_d _k_r_b___r_d___s_a_f_e + must check time order and for replay attempts. + _k_r_b___c_k___r_e_p_l is not implemented yet. + +AAUUTTHHOORRSS + Clifford Neuman, MIT Project Athena + Steve Miller, MIT Project Athena/Digital Equipment Corpo- + ration + +RREESSTTRRIICCTTIIOONNSS + COPYRIGHT 1985,1986,1989 Massachusetts Institute of Tech- + nology + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +MIT Project Athena Kerberos Version 4.0 7 + + + + + diff --git a/usr/share/man/cat3/krb_get_cred.0 b/usr/share/man/cat3/krb_get_cred.0 new file mode 100644 index 0000000000..ac1157fbda --- /dev/null +++ b/usr/share/man/cat3/krb_get_cred.0 @@ -0,0 +1,462 @@ + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + +NNAAMMEE + krb_mk_req, krb_rd_req, krb_kntoln, krb_set_key, + krb_get_cred, krb_mk_priv, krb_rd_priv, krb_mk_safe, + krb_rd_safe, krb_mk_err, krb_rd_err, krb_ck_repl - Ker- + beros authentication library + +SSYYNNOOPPSSIISS + ##iinncclluuddee <> + ##iinncclluuddee <> + + eexxtteerrnn cchhaarr **kkrrbb__eerrrr__ttxxtt[[]];; + + iinntt kkrrbb__mmkk__rreeqq((aauutthheenntt,,sseerrvviiccee,,iinnssttaannccee,,rreeaallmm,,cchheecckkssuumm)) + KKTTEEXXTT aauutthheenntt;; + cchhaarr **sseerrvviiccee;; + cchhaarr **iinnssttaannccee;; + cchhaarr **rreeaallmm;; + uu__lloonngg cchheecckkssuumm;; + + iinntt kkrrbb__rrdd__rreeqq((aauutthheenntt,,sseerrvviiccee,,iinnssttaannccee,,ffrroomm__aaddddrr,,aadd,,ffnn)) + KKTTEEXXTT aauutthheenntt;; + cchhaarr **sseerrvviiccee;; + cchhaarr **iinnssttaannccee;; + uu__lloonngg ffrroomm__aaddddrr;; + AAUUTTHH__DDAATT **aadd;; + cchhaarr **ffnn;; + + iinntt kkrrbb__kknnttoollnn((aadd,,llnnaammee)) + AAUUTTHH__DDAATT **aadd;; + cchhaarr **llnnaammee;; + + iinntt kkrrbb__sseett__kkeeyy((kkeeyy,,ccvvtt)) + cchhaarr **kkeeyy;; + iinntt ccvvtt;; + + iinntt kkrrbb__ggeett__ccrreedd((sseerrvviiccee,,iinnssttaannccee,,rreeaallmm,,cc)) + cchhaarr **sseerrvviiccee;; + cchhaarr **iinnssttaannccee;; + cchhaarr **rreeaallmm;; + CCRREEDDEENNTTIIAALLSS **cc;; + + lloonngg kkrrbb__mmkk__pprriivv((iinn,,oouutt,,iinn__lleennggtthh,,sscchheedduullee,,kkeeyy,,sseennddeerr,,rreecceeiivveerr)) + uu__cchhaarr **iinn;; + uu__cchhaarr **oouutt;; + uu__lloonngg iinn__lleennggtthh;; + ddeess__ccbblloocckk kkeeyy;; + ddeess__kkeeyy__sscchheedduullee sscchheedduullee;; + ssttrruucctt ssoocckkaaddddrr__iinn **sseennddeerr;; + ssttrruucctt ssoocckkaaddddrr__iinn **rreecceeiivveerr;; + + lloonngg kkrrbb__rrdd__pprriivv((iinn,,iinn__lleennggtthh,,sscchheedduullee,,kkeeyy,,sseennddeerr,,rreecceeiivveerr,,mmssgg__ddaattaa)) + + + +MIT Project Athena Kerberos Version 4.0 1 + + + + + + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + + uu__cchhaarr **iinn;; + uu__lloonngg iinn__lleennggtthh;; + KKeeyy__sscchheedduullee sscchheedduullee;; + ddeess__ccbblloocckk kkeeyy;; + ssttrruucctt ssoocckkaaddddrr__iinn **sseennddeerr;; + ssttrruucctt ssoocckkaaddddrr__iinn **rreecceeiivveerr;; + MMSSGG__DDAATT **mmssgg__ddaattaa;; + + lloonngg kkrrbb__mmkk__ssaaffee((iinn,,oouutt,,iinn__lleennggtthh,,kkeeyy,,sseennddeerr,,rreecceeiivveerr)) + uu__cchhaarr **iinn;; + uu__cchhaarr **oouutt;; + uu__lloonngg iinn__lleennggtthh;; + ddeess__ccbblloocckk kkeeyy;; + ssttrruucctt ssoocckkaaddddrr__iinn **sseennddeerr;; + ssttrruucctt ssoocckkaaddddrr__iinn **rreecceeiivveerr;; + + lloonngg kkrrbb__rrdd__ssaaffee((iinn,,lleennggtthh,,kkeeyy,,sseennddeerr,,rreecceeiivveerr,,mmssgg__ddaattaa)) + uu__cchhaarr **iinn;; + uu__lloonngg lleennggtthh;; + ddeess__ccbblloocckk kkeeyy;; + ssttrruucctt ssoocckkaaddddrr__iinn **sseennddeerr;; + ssttrruucctt ssoocckkaaddddrr__iinn **rreecceeiivveerr;; + MMSSGG__DDAATT **mmssgg__ddaattaa;; + + lloonngg kkrrbb__mmkk__eerrrr((oouutt,,ccooddee,,ssttrriinngg)) + uu__cchhaarr **oouutt;; + lloonngg ccooddee;; + cchhaarr **ssttrriinngg;; + + lloonngg kkrrbb__rrdd__eerrrr((iinn,,lleennggtthh,,ccooddee,,mmssgg__ddaattaa)) + uu__cchhaarr **iinn;; + uu__lloonngg lleennggtthh;; + lloonngg ccooddee;; + MMSSGG__DDAATT **mmssgg__ddaattaa;; + +DDEESSCCRRIIPPTTIIOONN + This library supports network authentication and various + related operations. The library contains many routines + beyond those described in this man page, but they are not + intended to be used directly. Instead, they are called by + the routines that are described, the authentication server + and the login program. + + _k_r_b___e_r_r___t_x_t_[_] contains text string descriptions of various + Kerberos error codes returned by some of the routines + below. + + _k_r_b___m_k___r_e_q takes a pointer to a text structure in which an + authenticator is to be built. It also takes the name, + instance, and realm of the service to be used and an + optional checksum. It is up to the application to decide + + + +MIT Project Athena Kerberos Version 4.0 2 + + + + + + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + + how to generate the checksum. _k_r_b___m_k___r_e_q then retrieves a + ticket for the desired service and creates an authentica- + tor. The authenticator is built in _a_u_t_h_e_n_t and is acces- + sible to the calling procedure. + + It is up to the application to get the authenticator to + the service where it will be read by _k_r_b___r_d___r_e_q_. Unless + an attacker possesses the session key contained in the + ticket, it will be unable to modify the authenticator. + Thus, the checksum can be used to verify the authenticity + of the other data that will pass through a connection. + + _k_r_b___r_d___r_e_q takes an authenticator of type KKTTEEXXTT,, a service + name, an instance, the address of the host originating the + request, and a pointer to a structure of type AAUUTTHH__DDAATT + which is filled in with information obtained from the + authenticator. It also optionally takes the name of the + file in which it will find the secret key(s) for the ser- + vice. If the supplied _i_n_s_t_a_n_c_e contains "*", then the + first service key with the same service name found in the + service key file will be used, and the _i_n_s_t_a_n_c_e argument + will be filled in with the chosen instance. This means + that the caller must provide space for such an instance + name. + + It is used to find out information about the principal + when a request has been made to a service. It is up to + the application protocol to get the authenticator from the + client to the service. The authenticator is then passed + to _k_r_b___r_d___r_e_q to extract the desired information. + + _k_r_b___r_d___r_e_q returns zero (RD_AP_OK) upon successful authen- + tication. If a packet was forged, modified, or replayed, + authentication will fail. If the authentication fails, a + non-zero value is returned indicating the particular prob- + lem encountered. See _k_r_b_._h for the list of error codes. + + If the last argument is the null string (""), krb_rd_req + will use the file /etc/srvtab to find its keys. If the + last argument is NULL, it will assume that the key has + been set by _k_r_b___s_e_t___k_e_y and will not bother looking fur- + ther. + + _k_r_b___k_n_t_o_l_n converts a Kerberos name to a local name. It + takes a structure of type AUTH_DAT and uses the name and + instance to look in the database /etc/aname to find the + corresponding local name. The local name is returned and + can be used by an application to change uids, directories, + or other parameters. It is not an integral part of Ker- + beros, but is instead provided to support the use of Ker- + beros in existing utilities. + + + +MIT Project Athena Kerberos Version 4.0 3 + + + + + + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + + _k_r_b___s_e_t___k_e_y takes as an argument a des key. It then cre- + ates a key schedule from it and saves the original key to + be used as an initialization vector. It is used to set + the server's key which must be used to decrypt tickets. + + If called with a non-zero second argument, _k_r_b___s_e_t___k_e_y + will first convert the input from a string of arbitrary + length to a DES key by encrypting it with a one-way func- + tion. + + In most cases it should not be necessary to call + _k_r_b___s_e_t___k_e_y_. The necessary keys will usually be obtained + and set inside _k_r_b___r_d___r_e_q_. _k_r_b___s_e_t___k_e_y is provided for + those applications that do not wish to place the applica- + tion keys on disk. + + _k_r_b___g_e_t___c_r_e_d searches the caller's ticket file for a + ticket for the given service, instance, and realm; and, if + a ticket is found, fills in the given CREDENTIALS struc- + ture with the ticket information. + + If the ticket was found, _k_r_b___g_e_t___c_r_e_d returns GC_OK. If + the ticket file can't be found, can't be read, doesn't + belong to the user (other than root), isn't a regular + file, or is in the wrong mode, the error GC_TKFIL is + returned. + + _k_r_b___m_k___p_r_i_v creates an encrypted, authenticated message + from any arbitrary application data, pointed to by _i_n and + _i_n___l_e_n_g_t_h bytes long. The private session key, pointed to + by _k_e_y and the key schedule, _s_c_h_e_d_u_l_e_, are used to encrypt + the data and some header information using _p_c_b_c___e_n_c_r_y_p_t_. + _s_e_n_d_e_r and _r_e_c_e_i_v_e_r point to the Internet address of the + two parties. In addition to providing privacy, this pro- + tocol message protects against modifications, insertions + or replays. The encapsulated message and header are + placed in the area pointed to by _o_u_t and the routine + returns the length of the output, or -1 indicating an + error. + + _k_r_b___r_d___p_r_i_v decrypts and authenticates a received + _k_r_b___m_k___p_r_i_v message. _i_n points to the beginning of the + received message, whose length is specified in _i_n___l_e_n_g_t_h_. + The private session key, pointed to by _k_e_y_, and the key + schedule, _s_c_h_e_d_u_l_e_, are used to decrypt and verify the + received message. _m_s_g___d_a_t_a is a pointer to a _M_S_G___D_A_T + struct, defined in _k_r_b_._h_. The routine fills in the + _a_p_p___d_a_t_a field with a pointer to the decrypted application + data, _a_p_p___l_e_n_g_t_h with the length of the _a_p_p___d_a_t_a field, + _t_i_m_e___s_e_c and _t_i_m_e___5_m_s with the timestamps in the message, + and _s_w_a_p with a 1 if the byte order of the receiver is + + + +MIT Project Athena Kerberos Version 4.0 4 + + + + + + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + + different than that of the sender. (The application must + still determine if it is appropriate to byte-swap applica- + tion data; the Kerberos protocol fields are already taken + care of). The _h_a_s_h field returns a value useful as input + to the _k_r_b___c_k___r_e_p_l routine. + + The routine returns zero if ok, or a Kerberos error code. + Modified messages and old messages cause errors, but it is + up to the caller to check the time sequence of messages, + and to check against recently replayed messages using + _k_r_b___c_k___r_e_p_l if so desired. + + _k_r_b___m_k___s_a_f_e creates an authenticated, but unencrypted mes- + sage from any arbitrary application data, pointed to by _i_n + and _i_n___l_e_n_g_t_h bytes long. The private session key, + pointed to by _k_e_y_, is used to seed the _q_u_a_d___c_k_s_u_m_(_) check- + sum algorithm used as part of the authentication. _s_e_n_d_e_r + and _r_e_c_e_i_v_e_r point to the Internet address of the two par- + ties. This message does not provide privacy, but does + protect (via detection) against modifications, insertions + or replays. The encapsulated message and header are + placed in the area pointed to by _o_u_t and the routine + returns the length of the output, or -1 indicating an + error. The authentication provided by this routine is not + as strong as that provided by _k_r_b___m_k___p_r_i_v or by computing + the checksum using _c_b_c___c_k_s_u_m instead, both of which + authenticate via DES. + + + _k_r_b___r_d___s_a_f_e authenticates a received _k_r_b___m_k___s_a_f_e message. + _i_n points to the beginning of the received message, whose + length is specified in _i_n___l_e_n_g_t_h_. The private session + key, pointed to by _k_e_y_, is used to seed the quad_cksum() + routine as part of the authentication. _m_s_g___d_a_t_a is a + pointer to a _M_S_G___D_A_T struct, defined in _k_r_b_._h _. The rou- + tine fills in these _M_S_G___D_A_T fields: the _a_p_p___d_a_t_a field + with a pointer to the application data, _a_p_p___l_e_n_g_t_h with + the length of the _a_p_p___d_a_t_a field, _t_i_m_e___s_e_c and _t_i_m_e___5_m_s + with the timestamps in the message, and _s_w_a_p with a 1 if + the byte order of the receiver is different than that of + the sender. (The application must still determine if it + is appropriate to byte-swap application data; the Kerberos + protocol fields are already taken care of). The _h_a_s_h + field returns a value useful as input to the _k_r_b___c_k___r_e_p_l + routine. + + The routine returns zero if ok, or a Kerberos error code. + Modified messages and old messages cause errors, but it is + up to the caller to check the time sequence of messages, + and to check against recently replayed messages using + _k_r_b___c_k___r_e_p_l if so desired. + + + +MIT Project Athena Kerberos Version 4.0 5 + + + + + + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + + _k_r_b___m_k___e_r_r constructs an application level error message + that may be used along with _k_r_b___m_k___p_r_i_v or _k_r_b___m_k___s_a_f_e_. + _o_u_t is a pointer to the output buffer, _c_o_d_e is an applica- + tion specific error code, and _s_t_r_i_n_g is an application + specific error string. + + + _k_r_b___r_d___e_r_r unpacks a received _k_r_b___m_k___e_r_r message. _i_n + points to the beginning of the received message, whose + length is specified in _i_n___l_e_n_g_t_h_. _c_o_d_e is a pointer to a + value to be filled in with the error value provided by the + application. _m_s_g___d_a_t_a is a pointer to a _M_S_G___D_A_T struct, + defined in _k_r_b_._h _. The routine fills in these _M_S_G___D_A_T + fields: the _a_p_p___d_a_t_a field with a pointer to the applica- + tion error text, _a_p_p___l_e_n_g_t_h with the length of the + _a_p_p___d_a_t_a field, and _s_w_a_p with a 1 if the byte order of the + receiver is different than that of the sender. (The + application must still determine if it is appropriate to + byte-swap application data; the Kerberos protocol fields + are already taken care of). + + The routine returns zero if the error message has been + successfully received, or a Kerberos error code. + + The _K_T_E_X_T structure is used to pass around text of varying + lengths. It consists of a buffer for the data, and a + length. krb_rd_req takes an argument of this type con- + taining the authenticator, and krb_mk_req returns the + authenticator in a structure of this type. KTEXT itself + is really a pointer to the structure. The actual struc- + ture is of type KTEXT_ST. + + The _A_U_T_H___D_A_T structure is filled in by krb_rd_req. It + must be allocated before calling krb_rd_req, and a pointer + to it is passed. The structure is filled in with data + obtained from Kerberos. _M_S_G___D_A_T structure is filled in by + either krb_rd_priv, krb_rd_safe, or krb_rd_err. It must + be allocated before the call and a pointer to it is + passed. The structure is filled in with data obtained + from Kerberos. + + +FFIILLEESS + /usr/include/kerberosIV/krb.h + /usr/lib/libkrb.a + /usr/include/kerberosIV/des.h + /usr/lib/libdes.a + /etc/kerberosIV/aname + /etc/kerberosIV/srvtab + /tmp/tkt[uid] + + + + +MIT Project Athena Kerberos Version 4.0 6 + + + + + + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + +SSEEEE AALLSSOO + kerberos(1), des_crypt(3) + +DDIIAAGGNNOOSSTTIICCSS +BBUUGGSS + The caller of _k_r_b___r_d___r_e_q_, _k_r_b___r_d___p_r_i_v_, _a_n_d _k_r_b___r_d___s_a_f_e + must check time order and for replay attempts. + _k_r_b___c_k___r_e_p_l is not implemented yet. + +AAUUTTHHOORRSS + Clifford Neuman, MIT Project Athena + Steve Miller, MIT Project Athena/Digital Equipment Corpo- + ration + +RREESSTTRRIICCTTIIOONNSS + COPYRIGHT 1985,1986,1989 Massachusetts Institute of Tech- + nology + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +MIT Project Athena Kerberos Version 4.0 7 + + + + + diff --git a/usr/share/man/cat3/krb_kntoln.0 b/usr/share/man/cat3/krb_kntoln.0 new file mode 100644 index 0000000000..ac1157fbda --- /dev/null +++ b/usr/share/man/cat3/krb_kntoln.0 @@ -0,0 +1,462 @@ + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + +NNAAMMEE + krb_mk_req, krb_rd_req, krb_kntoln, krb_set_key, + krb_get_cred, krb_mk_priv, krb_rd_priv, krb_mk_safe, + krb_rd_safe, krb_mk_err, krb_rd_err, krb_ck_repl - Ker- + beros authentication library + +SSYYNNOOPPSSIISS + ##iinncclluuddee <> + ##iinncclluuddee <> + + eexxtteerrnn cchhaarr **kkrrbb__eerrrr__ttxxtt[[]];; + + iinntt kkrrbb__mmkk__rreeqq((aauutthheenntt,,sseerrvviiccee,,iinnssttaannccee,,rreeaallmm,,cchheecckkssuumm)) + KKTTEEXXTT aauutthheenntt;; + cchhaarr **sseerrvviiccee;; + cchhaarr **iinnssttaannccee;; + cchhaarr **rreeaallmm;; + uu__lloonngg cchheecckkssuumm;; + + iinntt kkrrbb__rrdd__rreeqq((aauutthheenntt,,sseerrvviiccee,,iinnssttaannccee,,ffrroomm__aaddddrr,,aadd,,ffnn)) + KKTTEEXXTT aauutthheenntt;; + cchhaarr **sseerrvviiccee;; + cchhaarr **iinnssttaannccee;; + uu__lloonngg ffrroomm__aaddddrr;; + AAUUTTHH__DDAATT **aadd;; + cchhaarr **ffnn;; + + iinntt kkrrbb__kknnttoollnn((aadd,,llnnaammee)) + AAUUTTHH__DDAATT **aadd;; + cchhaarr **llnnaammee;; + + iinntt kkrrbb__sseett__kkeeyy((kkeeyy,,ccvvtt)) + cchhaarr **kkeeyy;; + iinntt ccvvtt;; + + iinntt kkrrbb__ggeett__ccrreedd((sseerrvviiccee,,iinnssttaannccee,,rreeaallmm,,cc)) + cchhaarr **sseerrvviiccee;; + cchhaarr **iinnssttaannccee;; + cchhaarr **rreeaallmm;; + CCRREEDDEENNTTIIAALLSS **cc;; + + lloonngg kkrrbb__mmkk__pprriivv((iinn,,oouutt,,iinn__lleennggtthh,,sscchheedduullee,,kkeeyy,,sseennddeerr,,rreecceeiivveerr)) + uu__cchhaarr **iinn;; + uu__cchhaarr **oouutt;; + uu__lloonngg iinn__lleennggtthh;; + ddeess__ccbblloocckk kkeeyy;; + ddeess__kkeeyy__sscchheedduullee sscchheedduullee;; + ssttrruucctt ssoocckkaaddddrr__iinn **sseennddeerr;; + ssttrruucctt ssoocckkaaddddrr__iinn **rreecceeiivveerr;; + + lloonngg kkrrbb__rrdd__pprriivv((iinn,,iinn__lleennggtthh,,sscchheedduullee,,kkeeyy,,sseennddeerr,,rreecceeiivveerr,,mmssgg__ddaattaa)) + + + +MIT Project Athena Kerberos Version 4.0 1 + + + + + + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + + uu__cchhaarr **iinn;; + uu__lloonngg iinn__lleennggtthh;; + KKeeyy__sscchheedduullee sscchheedduullee;; + ddeess__ccbblloocckk kkeeyy;; + ssttrruucctt ssoocckkaaddddrr__iinn **sseennddeerr;; + ssttrruucctt ssoocckkaaddddrr__iinn **rreecceeiivveerr;; + MMSSGG__DDAATT **mmssgg__ddaattaa;; + + lloonngg kkrrbb__mmkk__ssaaffee((iinn,,oouutt,,iinn__lleennggtthh,,kkeeyy,,sseennddeerr,,rreecceeiivveerr)) + uu__cchhaarr **iinn;; + uu__cchhaarr **oouutt;; + uu__lloonngg iinn__lleennggtthh;; + ddeess__ccbblloocckk kkeeyy;; + ssttrruucctt ssoocckkaaddddrr__iinn **sseennddeerr;; + ssttrruucctt ssoocckkaaddddrr__iinn **rreecceeiivveerr;; + + lloonngg kkrrbb__rrdd__ssaaffee((iinn,,lleennggtthh,,kkeeyy,,sseennddeerr,,rreecceeiivveerr,,mmssgg__ddaattaa)) + uu__cchhaarr **iinn;; + uu__lloonngg lleennggtthh;; + ddeess__ccbblloocckk kkeeyy;; + ssttrruucctt ssoocckkaaddddrr__iinn **sseennddeerr;; + ssttrruucctt ssoocckkaaddddrr__iinn **rreecceeiivveerr;; + MMSSGG__DDAATT **mmssgg__ddaattaa;; + + lloonngg kkrrbb__mmkk__eerrrr((oouutt,,ccooddee,,ssttrriinngg)) + uu__cchhaarr **oouutt;; + lloonngg ccooddee;; + cchhaarr **ssttrriinngg;; + + lloonngg kkrrbb__rrdd__eerrrr((iinn,,lleennggtthh,,ccooddee,,mmssgg__ddaattaa)) + uu__cchhaarr **iinn;; + uu__lloonngg lleennggtthh;; + lloonngg ccooddee;; + MMSSGG__DDAATT **mmssgg__ddaattaa;; + +DDEESSCCRRIIPPTTIIOONN + This library supports network authentication and various + related operations. The library contains many routines + beyond those described in this man page, but they are not + intended to be used directly. Instead, they are called by + the routines that are described, the authentication server + and the login program. + + _k_r_b___e_r_r___t_x_t_[_] contains text string descriptions of various + Kerberos error codes returned by some of the routines + below. + + _k_r_b___m_k___r_e_q takes a pointer to a text structure in which an + authenticator is to be built. It also takes the name, + instance, and realm of the service to be used and an + optional checksum. It is up to the application to decide + + + +MIT Project Athena Kerberos Version 4.0 2 + + + + + + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + + how to generate the checksum. _k_r_b___m_k___r_e_q then retrieves a + ticket for the desired service and creates an authentica- + tor. The authenticator is built in _a_u_t_h_e_n_t and is acces- + sible to the calling procedure. + + It is up to the application to get the authenticator to + the service where it will be read by _k_r_b___r_d___r_e_q_. Unless + an attacker possesses the session key contained in the + ticket, it will be unable to modify the authenticator. + Thus, the checksum can be used to verify the authenticity + of the other data that will pass through a connection. + + _k_r_b___r_d___r_e_q takes an authenticator of type KKTTEEXXTT,, a service + name, an instance, the address of the host originating the + request, and a pointer to a structure of type AAUUTTHH__DDAATT + which is filled in with information obtained from the + authenticator. It also optionally takes the name of the + file in which it will find the secret key(s) for the ser- + vice. If the supplied _i_n_s_t_a_n_c_e contains "*", then the + first service key with the same service name found in the + service key file will be used, and the _i_n_s_t_a_n_c_e argument + will be filled in with the chosen instance. This means + that the caller must provide space for such an instance + name. + + It is used to find out information about the principal + when a request has been made to a service. It is up to + the application protocol to get the authenticator from the + client to the service. The authenticator is then passed + to _k_r_b___r_d___r_e_q to extract the desired information. + + _k_r_b___r_d___r_e_q returns zero (RD_AP_OK) upon successful authen- + tication. If a packet was forged, modified, or replayed, + authentication will fail. If the authentication fails, a + non-zero value is returned indicating the particular prob- + lem encountered. See _k_r_b_._h for the list of error codes. + + If the last argument is the null string (""), krb_rd_req + will use the file /etc/srvtab to find its keys. If the + last argument is NULL, it will assume that the key has + been set by _k_r_b___s_e_t___k_e_y and will not bother looking fur- + ther. + + _k_r_b___k_n_t_o_l_n converts a Kerberos name to a local name. It + takes a structure of type AUTH_DAT and uses the name and + instance to look in the database /etc/aname to find the + corresponding local name. The local name is returned and + can be used by an application to change uids, directories, + or other parameters. It is not an integral part of Ker- + beros, but is instead provided to support the use of Ker- + beros in existing utilities. + + + +MIT Project Athena Kerberos Version 4.0 3 + + + + + + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + + _k_r_b___s_e_t___k_e_y takes as an argument a des key. It then cre- + ates a key schedule from it and saves the original key to + be used as an initialization vector. It is used to set + the server's key which must be used to decrypt tickets. + + If called with a non-zero second argument, _k_r_b___s_e_t___k_e_y + will first convert the input from a string of arbitrary + length to a DES key by encrypting it with a one-way func- + tion. + + In most cases it should not be necessary to call + _k_r_b___s_e_t___k_e_y_. The necessary keys will usually be obtained + and set inside _k_r_b___r_d___r_e_q_. _k_r_b___s_e_t___k_e_y is provided for + those applications that do not wish to place the applica- + tion keys on disk. + + _k_r_b___g_e_t___c_r_e_d searches the caller's ticket file for a + ticket for the given service, instance, and realm; and, if + a ticket is found, fills in the given CREDENTIALS struc- + ture with the ticket information. + + If the ticket was found, _k_r_b___g_e_t___c_r_e_d returns GC_OK. If + the ticket file can't be found, can't be read, doesn't + belong to the user (other than root), isn't a regular + file, or is in the wrong mode, the error GC_TKFIL is + returned. + + _k_r_b___m_k___p_r_i_v creates an encrypted, authenticated message + from any arbitrary application data, pointed to by _i_n and + _i_n___l_e_n_g_t_h bytes long. The private session key, pointed to + by _k_e_y and the key schedule, _s_c_h_e_d_u_l_e_, are used to encrypt + the data and some header information using _p_c_b_c___e_n_c_r_y_p_t_. + _s_e_n_d_e_r and _r_e_c_e_i_v_e_r point to the Internet address of the + two parties. In addition to providing privacy, this pro- + tocol message protects against modifications, insertions + or replays. The encapsulated message and header are + placed in the area pointed to by _o_u_t and the routine + returns the length of the output, or -1 indicating an + error. + + _k_r_b___r_d___p_r_i_v decrypts and authenticates a received + _k_r_b___m_k___p_r_i_v message. _i_n points to the beginning of the + received message, whose length is specified in _i_n___l_e_n_g_t_h_. + The private session key, pointed to by _k_e_y_, and the key + schedule, _s_c_h_e_d_u_l_e_, are used to decrypt and verify the + received message. _m_s_g___d_a_t_a is a pointer to a _M_S_G___D_A_T + struct, defined in _k_r_b_._h_. The routine fills in the + _a_p_p___d_a_t_a field with a pointer to the decrypted application + data, _a_p_p___l_e_n_g_t_h with the length of the _a_p_p___d_a_t_a field, + _t_i_m_e___s_e_c and _t_i_m_e___5_m_s with the timestamps in the message, + and _s_w_a_p with a 1 if the byte order of the receiver is + + + +MIT Project Athena Kerberos Version 4.0 4 + + + + + + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + + different than that of the sender. (The application must + still determine if it is appropriate to byte-swap applica- + tion data; the Kerberos protocol fields are already taken + care of). The _h_a_s_h field returns a value useful as input + to the _k_r_b___c_k___r_e_p_l routine. + + The routine returns zero if ok, or a Kerberos error code. + Modified messages and old messages cause errors, but it is + up to the caller to check the time sequence of messages, + and to check against recently replayed messages using + _k_r_b___c_k___r_e_p_l if so desired. + + _k_r_b___m_k___s_a_f_e creates an authenticated, but unencrypted mes- + sage from any arbitrary application data, pointed to by _i_n + and _i_n___l_e_n_g_t_h bytes long. The private session key, + pointed to by _k_e_y_, is used to seed the _q_u_a_d___c_k_s_u_m_(_) check- + sum algorithm used as part of the authentication. _s_e_n_d_e_r + and _r_e_c_e_i_v_e_r point to the Internet address of the two par- + ties. This message does not provide privacy, but does + protect (via detection) against modifications, insertions + or replays. The encapsulated message and header are + placed in the area pointed to by _o_u_t and the routine + returns the length of the output, or -1 indicating an + error. The authentication provided by this routine is not + as strong as that provided by _k_r_b___m_k___p_r_i_v or by computing + the checksum using _c_b_c___c_k_s_u_m instead, both of which + authenticate via DES. + + + _k_r_b___r_d___s_a_f_e authenticates a received _k_r_b___m_k___s_a_f_e message. + _i_n points to the beginning of the received message, whose + length is specified in _i_n___l_e_n_g_t_h_. The private session + key, pointed to by _k_e_y_, is used to seed the quad_cksum() + routine as part of the authentication. _m_s_g___d_a_t_a is a + pointer to a _M_S_G___D_A_T struct, defined in _k_r_b_._h _. The rou- + tine fills in these _M_S_G___D_A_T fields: the _a_p_p___d_a_t_a field + with a pointer to the application data, _a_p_p___l_e_n_g_t_h with + the length of the _a_p_p___d_a_t_a field, _t_i_m_e___s_e_c and _t_i_m_e___5_m_s + with the timestamps in the message, and _s_w_a_p with a 1 if + the byte order of the receiver is different than that of + the sender. (The application must still determine if it + is appropriate to byte-swap application data; the Kerberos + protocol fields are already taken care of). The _h_a_s_h + field returns a value useful as input to the _k_r_b___c_k___r_e_p_l + routine. + + The routine returns zero if ok, or a Kerberos error code. + Modified messages and old messages cause errors, but it is + up to the caller to check the time sequence of messages, + and to check against recently replayed messages using + _k_r_b___c_k___r_e_p_l if so desired. + + + +MIT Project Athena Kerberos Version 4.0 5 + + + + + + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + + _k_r_b___m_k___e_r_r constructs an application level error message + that may be used along with _k_r_b___m_k___p_r_i_v or _k_r_b___m_k___s_a_f_e_. + _o_u_t is a pointer to the output buffer, _c_o_d_e is an applica- + tion specific error code, and _s_t_r_i_n_g is an application + specific error string. + + + _k_r_b___r_d___e_r_r unpacks a received _k_r_b___m_k___e_r_r message. _i_n + points to the beginning of the received message, whose + length is specified in _i_n___l_e_n_g_t_h_. _c_o_d_e is a pointer to a + value to be filled in with the error value provided by the + application. _m_s_g___d_a_t_a is a pointer to a _M_S_G___D_A_T struct, + defined in _k_r_b_._h _. The routine fills in these _M_S_G___D_A_T + fields: the _a_p_p___d_a_t_a field with a pointer to the applica- + tion error text, _a_p_p___l_e_n_g_t_h with the length of the + _a_p_p___d_a_t_a field, and _s_w_a_p with a 1 if the byte order of the + receiver is different than that of the sender. (The + application must still determine if it is appropriate to + byte-swap application data; the Kerberos protocol fields + are already taken care of). + + The routine returns zero if the error message has been + successfully received, or a Kerberos error code. + + The _K_T_E_X_T structure is used to pass around text of varying + lengths. It consists of a buffer for the data, and a + length. krb_rd_req takes an argument of this type con- + taining the authenticator, and krb_mk_req returns the + authenticator in a structure of this type. KTEXT itself + is really a pointer to the structure. The actual struc- + ture is of type KTEXT_ST. + + The _A_U_T_H___D_A_T structure is filled in by krb_rd_req. It + must be allocated before calling krb_rd_req, and a pointer + to it is passed. The structure is filled in with data + obtained from Kerberos. _M_S_G___D_A_T structure is filled in by + either krb_rd_priv, krb_rd_safe, or krb_rd_err. It must + be allocated before the call and a pointer to it is + passed. The structure is filled in with data obtained + from Kerberos. + + +FFIILLEESS + /usr/include/kerberosIV/krb.h + /usr/lib/libkrb.a + /usr/include/kerberosIV/des.h + /usr/lib/libdes.a + /etc/kerberosIV/aname + /etc/kerberosIV/srvtab + /tmp/tkt[uid] + + + + +MIT Project Athena Kerberos Version 4.0 6 + + + + + + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + +SSEEEE AALLSSOO + kerberos(1), des_crypt(3) + +DDIIAAGGNNOOSSTTIICCSS +BBUUGGSS + The caller of _k_r_b___r_d___r_e_q_, _k_r_b___r_d___p_r_i_v_, _a_n_d _k_r_b___r_d___s_a_f_e + must check time order and for replay attempts. + _k_r_b___c_k___r_e_p_l is not implemented yet. + +AAUUTTHHOORRSS + Clifford Neuman, MIT Project Athena + Steve Miller, MIT Project Athena/Digital Equipment Corpo- + ration + +RREESSTTRRIICCTTIIOONNSS + COPYRIGHT 1985,1986,1989 Massachusetts Institute of Tech- + nology + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +MIT Project Athena Kerberos Version 4.0 7 + + + + + diff --git a/usr/share/man/cat3/krb_mk_err.0 b/usr/share/man/cat3/krb_mk_err.0 new file mode 100644 index 0000000000..ac1157fbda --- /dev/null +++ b/usr/share/man/cat3/krb_mk_err.0 @@ -0,0 +1,462 @@ + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + +NNAAMMEE + krb_mk_req, krb_rd_req, krb_kntoln, krb_set_key, + krb_get_cred, krb_mk_priv, krb_rd_priv, krb_mk_safe, + krb_rd_safe, krb_mk_err, krb_rd_err, krb_ck_repl - Ker- + beros authentication library + +SSYYNNOOPPSSIISS + ##iinncclluuddee <> + ##iinncclluuddee <> + + eexxtteerrnn cchhaarr **kkrrbb__eerrrr__ttxxtt[[]];; + + iinntt kkrrbb__mmkk__rreeqq((aauutthheenntt,,sseerrvviiccee,,iinnssttaannccee,,rreeaallmm,,cchheecckkssuumm)) + KKTTEEXXTT aauutthheenntt;; + cchhaarr **sseerrvviiccee;; + cchhaarr **iinnssttaannccee;; + cchhaarr **rreeaallmm;; + uu__lloonngg cchheecckkssuumm;; + + iinntt kkrrbb__rrdd__rreeqq((aauutthheenntt,,sseerrvviiccee,,iinnssttaannccee,,ffrroomm__aaddddrr,,aadd,,ffnn)) + KKTTEEXXTT aauutthheenntt;; + cchhaarr **sseerrvviiccee;; + cchhaarr **iinnssttaannccee;; + uu__lloonngg ffrroomm__aaddddrr;; + AAUUTTHH__DDAATT **aadd;; + cchhaarr **ffnn;; + + iinntt kkrrbb__kknnttoollnn((aadd,,llnnaammee)) + AAUUTTHH__DDAATT **aadd;; + cchhaarr **llnnaammee;; + + iinntt kkrrbb__sseett__kkeeyy((kkeeyy,,ccvvtt)) + cchhaarr **kkeeyy;; + iinntt ccvvtt;; + + iinntt kkrrbb__ggeett__ccrreedd((sseerrvviiccee,,iinnssttaannccee,,rreeaallmm,,cc)) + cchhaarr **sseerrvviiccee;; + cchhaarr **iinnssttaannccee;; + cchhaarr **rreeaallmm;; + CCRREEDDEENNTTIIAALLSS **cc;; + + lloonngg kkrrbb__mmkk__pprriivv((iinn,,oouutt,,iinn__lleennggtthh,,sscchheedduullee,,kkeeyy,,sseennddeerr,,rreecceeiivveerr)) + uu__cchhaarr **iinn;; + uu__cchhaarr **oouutt;; + uu__lloonngg iinn__lleennggtthh;; + ddeess__ccbblloocckk kkeeyy;; + ddeess__kkeeyy__sscchheedduullee sscchheedduullee;; + ssttrruucctt ssoocckkaaddddrr__iinn **sseennddeerr;; + ssttrruucctt ssoocckkaaddddrr__iinn **rreecceeiivveerr;; + + lloonngg kkrrbb__rrdd__pprriivv((iinn,,iinn__lleennggtthh,,sscchheedduullee,,kkeeyy,,sseennddeerr,,rreecceeiivveerr,,mmssgg__ddaattaa)) + + + +MIT Project Athena Kerberos Version 4.0 1 + + + + + + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + + uu__cchhaarr **iinn;; + uu__lloonngg iinn__lleennggtthh;; + KKeeyy__sscchheedduullee sscchheedduullee;; + ddeess__ccbblloocckk kkeeyy;; + ssttrruucctt ssoocckkaaddddrr__iinn **sseennddeerr;; + ssttrruucctt ssoocckkaaddddrr__iinn **rreecceeiivveerr;; + MMSSGG__DDAATT **mmssgg__ddaattaa;; + + lloonngg kkrrbb__mmkk__ssaaffee((iinn,,oouutt,,iinn__lleennggtthh,,kkeeyy,,sseennddeerr,,rreecceeiivveerr)) + uu__cchhaarr **iinn;; + uu__cchhaarr **oouutt;; + uu__lloonngg iinn__lleennggtthh;; + ddeess__ccbblloocckk kkeeyy;; + ssttrruucctt ssoocckkaaddddrr__iinn **sseennddeerr;; + ssttrruucctt ssoocckkaaddddrr__iinn **rreecceeiivveerr;; + + lloonngg kkrrbb__rrdd__ssaaffee((iinn,,lleennggtthh,,kkeeyy,,sseennddeerr,,rreecceeiivveerr,,mmssgg__ddaattaa)) + uu__cchhaarr **iinn;; + uu__lloonngg lleennggtthh;; + ddeess__ccbblloocckk kkeeyy;; + ssttrruucctt ssoocckkaaddddrr__iinn **sseennddeerr;; + ssttrruucctt ssoocckkaaddddrr__iinn **rreecceeiivveerr;; + MMSSGG__DDAATT **mmssgg__ddaattaa;; + + lloonngg kkrrbb__mmkk__eerrrr((oouutt,,ccooddee,,ssttrriinngg)) + uu__cchhaarr **oouutt;; + lloonngg ccooddee;; + cchhaarr **ssttrriinngg;; + + lloonngg kkrrbb__rrdd__eerrrr((iinn,,lleennggtthh,,ccooddee,,mmssgg__ddaattaa)) + uu__cchhaarr **iinn;; + uu__lloonngg lleennggtthh;; + lloonngg ccooddee;; + MMSSGG__DDAATT **mmssgg__ddaattaa;; + +DDEESSCCRRIIPPTTIIOONN + This library supports network authentication and various + related operations. The library contains many routines + beyond those described in this man page, but they are not + intended to be used directly. Instead, they are called by + the routines that are described, the authentication server + and the login program. + + _k_r_b___e_r_r___t_x_t_[_] contains text string descriptions of various + Kerberos error codes returned by some of the routines + below. + + _k_r_b___m_k___r_e_q takes a pointer to a text structure in which an + authenticator is to be built. It also takes the name, + instance, and realm of the service to be used and an + optional checksum. It is up to the application to decide + + + +MIT Project Athena Kerberos Version 4.0 2 + + + + + + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + + how to generate the checksum. _k_r_b___m_k___r_e_q then retrieves a + ticket for the desired service and creates an authentica- + tor. The authenticator is built in _a_u_t_h_e_n_t and is acces- + sible to the calling procedure. + + It is up to the application to get the authenticator to + the service where it will be read by _k_r_b___r_d___r_e_q_. Unless + an attacker possesses the session key contained in the + ticket, it will be unable to modify the authenticator. + Thus, the checksum can be used to verify the authenticity + of the other data that will pass through a connection. + + _k_r_b___r_d___r_e_q takes an authenticator of type KKTTEEXXTT,, a service + name, an instance, the address of the host originating the + request, and a pointer to a structure of type AAUUTTHH__DDAATT + which is filled in with information obtained from the + authenticator. It also optionally takes the name of the + file in which it will find the secret key(s) for the ser- + vice. If the supplied _i_n_s_t_a_n_c_e contains "*", then the + first service key with the same service name found in the + service key file will be used, and the _i_n_s_t_a_n_c_e argument + will be filled in with the chosen instance. This means + that the caller must provide space for such an instance + name. + + It is used to find out information about the principal + when a request has been made to a service. It is up to + the application protocol to get the authenticator from the + client to the service. The authenticator is then passed + to _k_r_b___r_d___r_e_q to extract the desired information. + + _k_r_b___r_d___r_e_q returns zero (RD_AP_OK) upon successful authen- + tication. If a packet was forged, modified, or replayed, + authentication will fail. If the authentication fails, a + non-zero value is returned indicating the particular prob- + lem encountered. See _k_r_b_._h for the list of error codes. + + If the last argument is the null string (""), krb_rd_req + will use the file /etc/srvtab to find its keys. If the + last argument is NULL, it will assume that the key has + been set by _k_r_b___s_e_t___k_e_y and will not bother looking fur- + ther. + + _k_r_b___k_n_t_o_l_n converts a Kerberos name to a local name. It + takes a structure of type AUTH_DAT and uses the name and + instance to look in the database /etc/aname to find the + corresponding local name. The local name is returned and + can be used by an application to change uids, directories, + or other parameters. It is not an integral part of Ker- + beros, but is instead provided to support the use of Ker- + beros in existing utilities. + + + +MIT Project Athena Kerberos Version 4.0 3 + + + + + + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + + _k_r_b___s_e_t___k_e_y takes as an argument a des key. It then cre- + ates a key schedule from it and saves the original key to + be used as an initialization vector. It is used to set + the server's key which must be used to decrypt tickets. + + If called with a non-zero second argument, _k_r_b___s_e_t___k_e_y + will first convert the input from a string of arbitrary + length to a DES key by encrypting it with a one-way func- + tion. + + In most cases it should not be necessary to call + _k_r_b___s_e_t___k_e_y_. The necessary keys will usually be obtained + and set inside _k_r_b___r_d___r_e_q_. _k_r_b___s_e_t___k_e_y is provided for + those applications that do not wish to place the applica- + tion keys on disk. + + _k_r_b___g_e_t___c_r_e_d searches the caller's ticket file for a + ticket for the given service, instance, and realm; and, if + a ticket is found, fills in the given CREDENTIALS struc- + ture with the ticket information. + + If the ticket was found, _k_r_b___g_e_t___c_r_e_d returns GC_OK. If + the ticket file can't be found, can't be read, doesn't + belong to the user (other than root), isn't a regular + file, or is in the wrong mode, the error GC_TKFIL is + returned. + + _k_r_b___m_k___p_r_i_v creates an encrypted, authenticated message + from any arbitrary application data, pointed to by _i_n and + _i_n___l_e_n_g_t_h bytes long. The private session key, pointed to + by _k_e_y and the key schedule, _s_c_h_e_d_u_l_e_, are used to encrypt + the data and some header information using _p_c_b_c___e_n_c_r_y_p_t_. + _s_e_n_d_e_r and _r_e_c_e_i_v_e_r point to the Internet address of the + two parties. In addition to providing privacy, this pro- + tocol message protects against modifications, insertions + or replays. The encapsulated message and header are + placed in the area pointed to by _o_u_t and the routine + returns the length of the output, or -1 indicating an + error. + + _k_r_b___r_d___p_r_i_v decrypts and authenticates a received + _k_r_b___m_k___p_r_i_v message. _i_n points to the beginning of the + received message, whose length is specified in _i_n___l_e_n_g_t_h_. + The private session key, pointed to by _k_e_y_, and the key + schedule, _s_c_h_e_d_u_l_e_, are used to decrypt and verify the + received message. _m_s_g___d_a_t_a is a pointer to a _M_S_G___D_A_T + struct, defined in _k_r_b_._h_. The routine fills in the + _a_p_p___d_a_t_a field with a pointer to the decrypted application + data, _a_p_p___l_e_n_g_t_h with the length of the _a_p_p___d_a_t_a field, + _t_i_m_e___s_e_c and _t_i_m_e___5_m_s with the timestamps in the message, + and _s_w_a_p with a 1 if the byte order of the receiver is + + + +MIT Project Athena Kerberos Version 4.0 4 + + + + + + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + + different than that of the sender. (The application must + still determine if it is appropriate to byte-swap applica- + tion data; the Kerberos protocol fields are already taken + care of). The _h_a_s_h field returns a value useful as input + to the _k_r_b___c_k___r_e_p_l routine. + + The routine returns zero if ok, or a Kerberos error code. + Modified messages and old messages cause errors, but it is + up to the caller to check the time sequence of messages, + and to check against recently replayed messages using + _k_r_b___c_k___r_e_p_l if so desired. + + _k_r_b___m_k___s_a_f_e creates an authenticated, but unencrypted mes- + sage from any arbitrary application data, pointed to by _i_n + and _i_n___l_e_n_g_t_h bytes long. The private session key, + pointed to by _k_e_y_, is used to seed the _q_u_a_d___c_k_s_u_m_(_) check- + sum algorithm used as part of the authentication. _s_e_n_d_e_r + and _r_e_c_e_i_v_e_r point to the Internet address of the two par- + ties. This message does not provide privacy, but does + protect (via detection) against modifications, insertions + or replays. The encapsulated message and header are + placed in the area pointed to by _o_u_t and the routine + returns the length of the output, or -1 indicating an + error. The authentication provided by this routine is not + as strong as that provided by _k_r_b___m_k___p_r_i_v or by computing + the checksum using _c_b_c___c_k_s_u_m instead, both of which + authenticate via DES. + + + _k_r_b___r_d___s_a_f_e authenticates a received _k_r_b___m_k___s_a_f_e message. + _i_n points to the beginning of the received message, whose + length is specified in _i_n___l_e_n_g_t_h_. The private session + key, pointed to by _k_e_y_, is used to seed the quad_cksum() + routine as part of the authentication. _m_s_g___d_a_t_a is a + pointer to a _M_S_G___D_A_T struct, defined in _k_r_b_._h _. The rou- + tine fills in these _M_S_G___D_A_T fields: the _a_p_p___d_a_t_a field + with a pointer to the application data, _a_p_p___l_e_n_g_t_h with + the length of the _a_p_p___d_a_t_a field, _t_i_m_e___s_e_c and _t_i_m_e___5_m_s + with the timestamps in the message, and _s_w_a_p with a 1 if + the byte order of the receiver is different than that of + the sender. (The application must still determine if it + is appropriate to byte-swap application data; the Kerberos + protocol fields are already taken care of). The _h_a_s_h + field returns a value useful as input to the _k_r_b___c_k___r_e_p_l + routine. + + The routine returns zero if ok, or a Kerberos error code. + Modified messages and old messages cause errors, but it is + up to the caller to check the time sequence of messages, + and to check against recently replayed messages using + _k_r_b___c_k___r_e_p_l if so desired. + + + +MIT Project Athena Kerberos Version 4.0 5 + + + + + + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + + _k_r_b___m_k___e_r_r constructs an application level error message + that may be used along with _k_r_b___m_k___p_r_i_v or _k_r_b___m_k___s_a_f_e_. + _o_u_t is a pointer to the output buffer, _c_o_d_e is an applica- + tion specific error code, and _s_t_r_i_n_g is an application + specific error string. + + + _k_r_b___r_d___e_r_r unpacks a received _k_r_b___m_k___e_r_r message. _i_n + points to the beginning of the received message, whose + length is specified in _i_n___l_e_n_g_t_h_. _c_o_d_e is a pointer to a + value to be filled in with the error value provided by the + application. _m_s_g___d_a_t_a is a pointer to a _M_S_G___D_A_T struct, + defined in _k_r_b_._h _. The routine fills in these _M_S_G___D_A_T + fields: the _a_p_p___d_a_t_a field with a pointer to the applica- + tion error text, _a_p_p___l_e_n_g_t_h with the length of the + _a_p_p___d_a_t_a field, and _s_w_a_p with a 1 if the byte order of the + receiver is different than that of the sender. (The + application must still determine if it is appropriate to + byte-swap application data; the Kerberos protocol fields + are already taken care of). + + The routine returns zero if the error message has been + successfully received, or a Kerberos error code. + + The _K_T_E_X_T structure is used to pass around text of varying + lengths. It consists of a buffer for the data, and a + length. krb_rd_req takes an argument of this type con- + taining the authenticator, and krb_mk_req returns the + authenticator in a structure of this type. KTEXT itself + is really a pointer to the structure. The actual struc- + ture is of type KTEXT_ST. + + The _A_U_T_H___D_A_T structure is filled in by krb_rd_req. It + must be allocated before calling krb_rd_req, and a pointer + to it is passed. The structure is filled in with data + obtained from Kerberos. _M_S_G___D_A_T structure is filled in by + either krb_rd_priv, krb_rd_safe, or krb_rd_err. It must + be allocated before the call and a pointer to it is + passed. The structure is filled in with data obtained + from Kerberos. + + +FFIILLEESS + /usr/include/kerberosIV/krb.h + /usr/lib/libkrb.a + /usr/include/kerberosIV/des.h + /usr/lib/libdes.a + /etc/kerberosIV/aname + /etc/kerberosIV/srvtab + /tmp/tkt[uid] + + + + +MIT Project Athena Kerberos Version 4.0 6 + + + + + + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + +SSEEEE AALLSSOO + kerberos(1), des_crypt(3) + +DDIIAAGGNNOOSSTTIICCSS +BBUUGGSS + The caller of _k_r_b___r_d___r_e_q_, _k_r_b___r_d___p_r_i_v_, _a_n_d _k_r_b___r_d___s_a_f_e + must check time order and for replay attempts. + _k_r_b___c_k___r_e_p_l is not implemented yet. + +AAUUTTHHOORRSS + Clifford Neuman, MIT Project Athena + Steve Miller, MIT Project Athena/Digital Equipment Corpo- + ration + +RREESSTTRRIICCTTIIOONNSS + COPYRIGHT 1985,1986,1989 Massachusetts Institute of Tech- + nology + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +MIT Project Athena Kerberos Version 4.0 7 + + + + + diff --git a/usr/share/man/cat3/krb_mk_priv.0 b/usr/share/man/cat3/krb_mk_priv.0 new file mode 100644 index 0000000000..ac1157fbda --- /dev/null +++ b/usr/share/man/cat3/krb_mk_priv.0 @@ -0,0 +1,462 @@ + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + +NNAAMMEE + krb_mk_req, krb_rd_req, krb_kntoln, krb_set_key, + krb_get_cred, krb_mk_priv, krb_rd_priv, krb_mk_safe, + krb_rd_safe, krb_mk_err, krb_rd_err, krb_ck_repl - Ker- + beros authentication library + +SSYYNNOOPPSSIISS + ##iinncclluuddee <> + ##iinncclluuddee <> + + eexxtteerrnn cchhaarr **kkrrbb__eerrrr__ttxxtt[[]];; + + iinntt kkrrbb__mmkk__rreeqq((aauutthheenntt,,sseerrvviiccee,,iinnssttaannccee,,rreeaallmm,,cchheecckkssuumm)) + KKTTEEXXTT aauutthheenntt;; + cchhaarr **sseerrvviiccee;; + cchhaarr **iinnssttaannccee;; + cchhaarr **rreeaallmm;; + uu__lloonngg cchheecckkssuumm;; + + iinntt kkrrbb__rrdd__rreeqq((aauutthheenntt,,sseerrvviiccee,,iinnssttaannccee,,ffrroomm__aaddddrr,,aadd,,ffnn)) + KKTTEEXXTT aauutthheenntt;; + cchhaarr **sseerrvviiccee;; + cchhaarr **iinnssttaannccee;; + uu__lloonngg ffrroomm__aaddddrr;; + AAUUTTHH__DDAATT **aadd;; + cchhaarr **ffnn;; + + iinntt kkrrbb__kknnttoollnn((aadd,,llnnaammee)) + AAUUTTHH__DDAATT **aadd;; + cchhaarr **llnnaammee;; + + iinntt kkrrbb__sseett__kkeeyy((kkeeyy,,ccvvtt)) + cchhaarr **kkeeyy;; + iinntt ccvvtt;; + + iinntt kkrrbb__ggeett__ccrreedd((sseerrvviiccee,,iinnssttaannccee,,rreeaallmm,,cc)) + cchhaarr **sseerrvviiccee;; + cchhaarr **iinnssttaannccee;; + cchhaarr **rreeaallmm;; + CCRREEDDEENNTTIIAALLSS **cc;; + + lloonngg kkrrbb__mmkk__pprriivv((iinn,,oouutt,,iinn__lleennggtthh,,sscchheedduullee,,kkeeyy,,sseennddeerr,,rreecceeiivveerr)) + uu__cchhaarr **iinn;; + uu__cchhaarr **oouutt;; + uu__lloonngg iinn__lleennggtthh;; + ddeess__ccbblloocckk kkeeyy;; + ddeess__kkeeyy__sscchheedduullee sscchheedduullee;; + ssttrruucctt ssoocckkaaddddrr__iinn **sseennddeerr;; + ssttrruucctt ssoocckkaaddddrr__iinn **rreecceeiivveerr;; + + lloonngg kkrrbb__rrdd__pprriivv((iinn,,iinn__lleennggtthh,,sscchheedduullee,,kkeeyy,,sseennddeerr,,rreecceeiivveerr,,mmssgg__ddaattaa)) + + + +MIT Project Athena Kerberos Version 4.0 1 + + + + + + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + + uu__cchhaarr **iinn;; + uu__lloonngg iinn__lleennggtthh;; + KKeeyy__sscchheedduullee sscchheedduullee;; + ddeess__ccbblloocckk kkeeyy;; + ssttrruucctt ssoocckkaaddddrr__iinn **sseennddeerr;; + ssttrruucctt ssoocckkaaddddrr__iinn **rreecceeiivveerr;; + MMSSGG__DDAATT **mmssgg__ddaattaa;; + + lloonngg kkrrbb__mmkk__ssaaffee((iinn,,oouutt,,iinn__lleennggtthh,,kkeeyy,,sseennddeerr,,rreecceeiivveerr)) + uu__cchhaarr **iinn;; + uu__cchhaarr **oouutt;; + uu__lloonngg iinn__lleennggtthh;; + ddeess__ccbblloocckk kkeeyy;; + ssttrruucctt ssoocckkaaddddrr__iinn **sseennddeerr;; + ssttrruucctt ssoocckkaaddddrr__iinn **rreecceeiivveerr;; + + lloonngg kkrrbb__rrdd__ssaaffee((iinn,,lleennggtthh,,kkeeyy,,sseennddeerr,,rreecceeiivveerr,,mmssgg__ddaattaa)) + uu__cchhaarr **iinn;; + uu__lloonngg lleennggtthh;; + ddeess__ccbblloocckk kkeeyy;; + ssttrruucctt ssoocckkaaddddrr__iinn **sseennddeerr;; + ssttrruucctt ssoocckkaaddddrr__iinn **rreecceeiivveerr;; + MMSSGG__DDAATT **mmssgg__ddaattaa;; + + lloonngg kkrrbb__mmkk__eerrrr((oouutt,,ccooddee,,ssttrriinngg)) + uu__cchhaarr **oouutt;; + lloonngg ccooddee;; + cchhaarr **ssttrriinngg;; + + lloonngg kkrrbb__rrdd__eerrrr((iinn,,lleennggtthh,,ccooddee,,mmssgg__ddaattaa)) + uu__cchhaarr **iinn;; + uu__lloonngg lleennggtthh;; + lloonngg ccooddee;; + MMSSGG__DDAATT **mmssgg__ddaattaa;; + +DDEESSCCRRIIPPTTIIOONN + This library supports network authentication and various + related operations. The library contains many routines + beyond those described in this man page, but they are not + intended to be used directly. Instead, they are called by + the routines that are described, the authentication server + and the login program. + + _k_r_b___e_r_r___t_x_t_[_] contains text string descriptions of various + Kerberos error codes returned by some of the routines + below. + + _k_r_b___m_k___r_e_q takes a pointer to a text structure in which an + authenticator is to be built. It also takes the name, + instance, and realm of the service to be used and an + optional checksum. It is up to the application to decide + + + +MIT Project Athena Kerberos Version 4.0 2 + + + + + + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + + how to generate the checksum. _k_r_b___m_k___r_e_q then retrieves a + ticket for the desired service and creates an authentica- + tor. The authenticator is built in _a_u_t_h_e_n_t and is acces- + sible to the calling procedure. + + It is up to the application to get the authenticator to + the service where it will be read by _k_r_b___r_d___r_e_q_. Unless + an attacker possesses the session key contained in the + ticket, it will be unable to modify the authenticator. + Thus, the checksum can be used to verify the authenticity + of the other data that will pass through a connection. + + _k_r_b___r_d___r_e_q takes an authenticator of type KKTTEEXXTT,, a service + name, an instance, the address of the host originating the + request, and a pointer to a structure of type AAUUTTHH__DDAATT + which is filled in with information obtained from the + authenticator. It also optionally takes the name of the + file in which it will find the secret key(s) for the ser- + vice. If the supplied _i_n_s_t_a_n_c_e contains "*", then the + first service key with the same service name found in the + service key file will be used, and the _i_n_s_t_a_n_c_e argument + will be filled in with the chosen instance. This means + that the caller must provide space for such an instance + name. + + It is used to find out information about the principal + when a request has been made to a service. It is up to + the application protocol to get the authenticator from the + client to the service. The authenticator is then passed + to _k_r_b___r_d___r_e_q to extract the desired information. + + _k_r_b___r_d___r_e_q returns zero (RD_AP_OK) upon successful authen- + tication. If a packet was forged, modified, or replayed, + authentication will fail. If the authentication fails, a + non-zero value is returned indicating the particular prob- + lem encountered. See _k_r_b_._h for the list of error codes. + + If the last argument is the null string (""), krb_rd_req + will use the file /etc/srvtab to find its keys. If the + last argument is NULL, it will assume that the key has + been set by _k_r_b___s_e_t___k_e_y and will not bother looking fur- + ther. + + _k_r_b___k_n_t_o_l_n converts a Kerberos name to a local name. It + takes a structure of type AUTH_DAT and uses the name and + instance to look in the database /etc/aname to find the + corresponding local name. The local name is returned and + can be used by an application to change uids, directories, + or other parameters. It is not an integral part of Ker- + beros, but is instead provided to support the use of Ker- + beros in existing utilities. + + + +MIT Project Athena Kerberos Version 4.0 3 + + + + + + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + + _k_r_b___s_e_t___k_e_y takes as an argument a des key. It then cre- + ates a key schedule from it and saves the original key to + be used as an initialization vector. It is used to set + the server's key which must be used to decrypt tickets. + + If called with a non-zero second argument, _k_r_b___s_e_t___k_e_y + will first convert the input from a string of arbitrary + length to a DES key by encrypting it with a one-way func- + tion. + + In most cases it should not be necessary to call + _k_r_b___s_e_t___k_e_y_. The necessary keys will usually be obtained + and set inside _k_r_b___r_d___r_e_q_. _k_r_b___s_e_t___k_e_y is provided for + those applications that do not wish to place the applica- + tion keys on disk. + + _k_r_b___g_e_t___c_r_e_d searches the caller's ticket file for a + ticket for the given service, instance, and realm; and, if + a ticket is found, fills in the given CREDENTIALS struc- + ture with the ticket information. + + If the ticket was found, _k_r_b___g_e_t___c_r_e_d returns GC_OK. If + the ticket file can't be found, can't be read, doesn't + belong to the user (other than root), isn't a regular + file, or is in the wrong mode, the error GC_TKFIL is + returned. + + _k_r_b___m_k___p_r_i_v creates an encrypted, authenticated message + from any arbitrary application data, pointed to by _i_n and + _i_n___l_e_n_g_t_h bytes long. The private session key, pointed to + by _k_e_y and the key schedule, _s_c_h_e_d_u_l_e_, are used to encrypt + the data and some header information using _p_c_b_c___e_n_c_r_y_p_t_. + _s_e_n_d_e_r and _r_e_c_e_i_v_e_r point to the Internet address of the + two parties. In addition to providing privacy, this pro- + tocol message protects against modifications, insertions + or replays. The encapsulated message and header are + placed in the area pointed to by _o_u_t and the routine + returns the length of the output, or -1 indicating an + error. + + _k_r_b___r_d___p_r_i_v decrypts and authenticates a received + _k_r_b___m_k___p_r_i_v message. _i_n points to the beginning of the + received message, whose length is specified in _i_n___l_e_n_g_t_h_. + The private session key, pointed to by _k_e_y_, and the key + schedule, _s_c_h_e_d_u_l_e_, are used to decrypt and verify the + received message. _m_s_g___d_a_t_a is a pointer to a _M_S_G___D_A_T + struct, defined in _k_r_b_._h_. The routine fills in the + _a_p_p___d_a_t_a field with a pointer to the decrypted application + data, _a_p_p___l_e_n_g_t_h with the length of the _a_p_p___d_a_t_a field, + _t_i_m_e___s_e_c and _t_i_m_e___5_m_s with the timestamps in the message, + and _s_w_a_p with a 1 if the byte order of the receiver is + + + +MIT Project Athena Kerberos Version 4.0 4 + + + + + + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + + different than that of the sender. (The application must + still determine if it is appropriate to byte-swap applica- + tion data; the Kerberos protocol fields are already taken + care of). The _h_a_s_h field returns a value useful as input + to the _k_r_b___c_k___r_e_p_l routine. + + The routine returns zero if ok, or a Kerberos error code. + Modified messages and old messages cause errors, but it is + up to the caller to check the time sequence of messages, + and to check against recently replayed messages using + _k_r_b___c_k___r_e_p_l if so desired. + + _k_r_b___m_k___s_a_f_e creates an authenticated, but unencrypted mes- + sage from any arbitrary application data, pointed to by _i_n + and _i_n___l_e_n_g_t_h bytes long. The private session key, + pointed to by _k_e_y_, is used to seed the _q_u_a_d___c_k_s_u_m_(_) check- + sum algorithm used as part of the authentication. _s_e_n_d_e_r + and _r_e_c_e_i_v_e_r point to the Internet address of the two par- + ties. This message does not provide privacy, but does + protect (via detection) against modifications, insertions + or replays. The encapsulated message and header are + placed in the area pointed to by _o_u_t and the routine + returns the length of the output, or -1 indicating an + error. The authentication provided by this routine is not + as strong as that provided by _k_r_b___m_k___p_r_i_v or by computing + the checksum using _c_b_c___c_k_s_u_m instead, both of which + authenticate via DES. + + + _k_r_b___r_d___s_a_f_e authenticates a received _k_r_b___m_k___s_a_f_e message. + _i_n points to the beginning of the received message, whose + length is specified in _i_n___l_e_n_g_t_h_. The private session + key, pointed to by _k_e_y_, is used to seed the quad_cksum() + routine as part of the authentication. _m_s_g___d_a_t_a is a + pointer to a _M_S_G___D_A_T struct, defined in _k_r_b_._h _. The rou- + tine fills in these _M_S_G___D_A_T fields: the _a_p_p___d_a_t_a field + with a pointer to the application data, _a_p_p___l_e_n_g_t_h with + the length of the _a_p_p___d_a_t_a field, _t_i_m_e___s_e_c and _t_i_m_e___5_m_s + with the timestamps in the message, and _s_w_a_p with a 1 if + the byte order of the receiver is different than that of + the sender. (The application must still determine if it + is appropriate to byte-swap application data; the Kerberos + protocol fields are already taken care of). The _h_a_s_h + field returns a value useful as input to the _k_r_b___c_k___r_e_p_l + routine. + + The routine returns zero if ok, or a Kerberos error code. + Modified messages and old messages cause errors, but it is + up to the caller to check the time sequence of messages, + and to check against recently replayed messages using + _k_r_b___c_k___r_e_p_l if so desired. + + + +MIT Project Athena Kerberos Version 4.0 5 + + + + + + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + + _k_r_b___m_k___e_r_r constructs an application level error message + that may be used along with _k_r_b___m_k___p_r_i_v or _k_r_b___m_k___s_a_f_e_. + _o_u_t is a pointer to the output buffer, _c_o_d_e is an applica- + tion specific error code, and _s_t_r_i_n_g is an application + specific error string. + + + _k_r_b___r_d___e_r_r unpacks a received _k_r_b___m_k___e_r_r message. _i_n + points to the beginning of the received message, whose + length is specified in _i_n___l_e_n_g_t_h_. _c_o_d_e is a pointer to a + value to be filled in with the error value provided by the + application. _m_s_g___d_a_t_a is a pointer to a _M_S_G___D_A_T struct, + defined in _k_r_b_._h _. The routine fills in these _M_S_G___D_A_T + fields: the _a_p_p___d_a_t_a field with a pointer to the applica- + tion error text, _a_p_p___l_e_n_g_t_h with the length of the + _a_p_p___d_a_t_a field, and _s_w_a_p with a 1 if the byte order of the + receiver is different than that of the sender. (The + application must still determine if it is appropriate to + byte-swap application data; the Kerberos protocol fields + are already taken care of). + + The routine returns zero if the error message has been + successfully received, or a Kerberos error code. + + The _K_T_E_X_T structure is used to pass around text of varying + lengths. It consists of a buffer for the data, and a + length. krb_rd_req takes an argument of this type con- + taining the authenticator, and krb_mk_req returns the + authenticator in a structure of this type. KTEXT itself + is really a pointer to the structure. The actual struc- + ture is of type KTEXT_ST. + + The _A_U_T_H___D_A_T structure is filled in by krb_rd_req. It + must be allocated before calling krb_rd_req, and a pointer + to it is passed. The structure is filled in with data + obtained from Kerberos. _M_S_G___D_A_T structure is filled in by + either krb_rd_priv, krb_rd_safe, or krb_rd_err. It must + be allocated before the call and a pointer to it is + passed. The structure is filled in with data obtained + from Kerberos. + + +FFIILLEESS + /usr/include/kerberosIV/krb.h + /usr/lib/libkrb.a + /usr/include/kerberosIV/des.h + /usr/lib/libdes.a + /etc/kerberosIV/aname + /etc/kerberosIV/srvtab + /tmp/tkt[uid] + + + + +MIT Project Athena Kerberos Version 4.0 6 + + + + + + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + +SSEEEE AALLSSOO + kerberos(1), des_crypt(3) + +DDIIAAGGNNOOSSTTIICCSS +BBUUGGSS + The caller of _k_r_b___r_d___r_e_q_, _k_r_b___r_d___p_r_i_v_, _a_n_d _k_r_b___r_d___s_a_f_e + must check time order and for replay attempts. + _k_r_b___c_k___r_e_p_l is not implemented yet. + +AAUUTTHHOORRSS + Clifford Neuman, MIT Project Athena + Steve Miller, MIT Project Athena/Digital Equipment Corpo- + ration + +RREESSTTRRIICCTTIIOONNSS + COPYRIGHT 1985,1986,1989 Massachusetts Institute of Tech- + nology + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +MIT Project Athena Kerberos Version 4.0 7 + + + + + diff --git a/usr/share/man/cat3/krb_mk_req.0 b/usr/share/man/cat3/krb_mk_req.0 new file mode 100644 index 0000000000..ac1157fbda --- /dev/null +++ b/usr/share/man/cat3/krb_mk_req.0 @@ -0,0 +1,462 @@ + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + +NNAAMMEE + krb_mk_req, krb_rd_req, krb_kntoln, krb_set_key, + krb_get_cred, krb_mk_priv, krb_rd_priv, krb_mk_safe, + krb_rd_safe, krb_mk_err, krb_rd_err, krb_ck_repl - Ker- + beros authentication library + +SSYYNNOOPPSSIISS + ##iinncclluuddee <> + ##iinncclluuddee <> + + eexxtteerrnn cchhaarr **kkrrbb__eerrrr__ttxxtt[[]];; + + iinntt kkrrbb__mmkk__rreeqq((aauutthheenntt,,sseerrvviiccee,,iinnssttaannccee,,rreeaallmm,,cchheecckkssuumm)) + KKTTEEXXTT aauutthheenntt;; + cchhaarr **sseerrvviiccee;; + cchhaarr **iinnssttaannccee;; + cchhaarr **rreeaallmm;; + uu__lloonngg cchheecckkssuumm;; + + iinntt kkrrbb__rrdd__rreeqq((aauutthheenntt,,sseerrvviiccee,,iinnssttaannccee,,ffrroomm__aaddddrr,,aadd,,ffnn)) + KKTTEEXXTT aauutthheenntt;; + cchhaarr **sseerrvviiccee;; + cchhaarr **iinnssttaannccee;; + uu__lloonngg ffrroomm__aaddddrr;; + AAUUTTHH__DDAATT **aadd;; + cchhaarr **ffnn;; + + iinntt kkrrbb__kknnttoollnn((aadd,,llnnaammee)) + AAUUTTHH__DDAATT **aadd;; + cchhaarr **llnnaammee;; + + iinntt kkrrbb__sseett__kkeeyy((kkeeyy,,ccvvtt)) + cchhaarr **kkeeyy;; + iinntt ccvvtt;; + + iinntt kkrrbb__ggeett__ccrreedd((sseerrvviiccee,,iinnssttaannccee,,rreeaallmm,,cc)) + cchhaarr **sseerrvviiccee;; + cchhaarr **iinnssttaannccee;; + cchhaarr **rreeaallmm;; + CCRREEDDEENNTTIIAALLSS **cc;; + + lloonngg kkrrbb__mmkk__pprriivv((iinn,,oouutt,,iinn__lleennggtthh,,sscchheedduullee,,kkeeyy,,sseennddeerr,,rreecceeiivveerr)) + uu__cchhaarr **iinn;; + uu__cchhaarr **oouutt;; + uu__lloonngg iinn__lleennggtthh;; + ddeess__ccbblloocckk kkeeyy;; + ddeess__kkeeyy__sscchheedduullee sscchheedduullee;; + ssttrruucctt ssoocckkaaddddrr__iinn **sseennddeerr;; + ssttrruucctt ssoocckkaaddddrr__iinn **rreecceeiivveerr;; + + lloonngg kkrrbb__rrdd__pprriivv((iinn,,iinn__lleennggtthh,,sscchheedduullee,,kkeeyy,,sseennddeerr,,rreecceeiivveerr,,mmssgg__ddaattaa)) + + + +MIT Project Athena Kerberos Version 4.0 1 + + + + + + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + + uu__cchhaarr **iinn;; + uu__lloonngg iinn__lleennggtthh;; + KKeeyy__sscchheedduullee sscchheedduullee;; + ddeess__ccbblloocckk kkeeyy;; + ssttrruucctt ssoocckkaaddddrr__iinn **sseennddeerr;; + ssttrruucctt ssoocckkaaddddrr__iinn **rreecceeiivveerr;; + MMSSGG__DDAATT **mmssgg__ddaattaa;; + + lloonngg kkrrbb__mmkk__ssaaffee((iinn,,oouutt,,iinn__lleennggtthh,,kkeeyy,,sseennddeerr,,rreecceeiivveerr)) + uu__cchhaarr **iinn;; + uu__cchhaarr **oouutt;; + uu__lloonngg iinn__lleennggtthh;; + ddeess__ccbblloocckk kkeeyy;; + ssttrruucctt ssoocckkaaddddrr__iinn **sseennddeerr;; + ssttrruucctt ssoocckkaaddddrr__iinn **rreecceeiivveerr;; + + lloonngg kkrrbb__rrdd__ssaaffee((iinn,,lleennggtthh,,kkeeyy,,sseennddeerr,,rreecceeiivveerr,,mmssgg__ddaattaa)) + uu__cchhaarr **iinn;; + uu__lloonngg lleennggtthh;; + ddeess__ccbblloocckk kkeeyy;; + ssttrruucctt ssoocckkaaddddrr__iinn **sseennddeerr;; + ssttrruucctt ssoocckkaaddddrr__iinn **rreecceeiivveerr;; + MMSSGG__DDAATT **mmssgg__ddaattaa;; + + lloonngg kkrrbb__mmkk__eerrrr((oouutt,,ccooddee,,ssttrriinngg)) + uu__cchhaarr **oouutt;; + lloonngg ccooddee;; + cchhaarr **ssttrriinngg;; + + lloonngg kkrrbb__rrdd__eerrrr((iinn,,lleennggtthh,,ccooddee,,mmssgg__ddaattaa)) + uu__cchhaarr **iinn;; + uu__lloonngg lleennggtthh;; + lloonngg ccooddee;; + MMSSGG__DDAATT **mmssgg__ddaattaa;; + +DDEESSCCRRIIPPTTIIOONN + This library supports network authentication and various + related operations. The library contains many routines + beyond those described in this man page, but they are not + intended to be used directly. Instead, they are called by + the routines that are described, the authentication server + and the login program. + + _k_r_b___e_r_r___t_x_t_[_] contains text string descriptions of various + Kerberos error codes returned by some of the routines + below. + + _k_r_b___m_k___r_e_q takes a pointer to a text structure in which an + authenticator is to be built. It also takes the name, + instance, and realm of the service to be used and an + optional checksum. It is up to the application to decide + + + +MIT Project Athena Kerberos Version 4.0 2 + + + + + + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + + how to generate the checksum. _k_r_b___m_k___r_e_q then retrieves a + ticket for the desired service and creates an authentica- + tor. The authenticator is built in _a_u_t_h_e_n_t and is acces- + sible to the calling procedure. + + It is up to the application to get the authenticator to + the service where it will be read by _k_r_b___r_d___r_e_q_. Unless + an attacker possesses the session key contained in the + ticket, it will be unable to modify the authenticator. + Thus, the checksum can be used to verify the authenticity + of the other data that will pass through a connection. + + _k_r_b___r_d___r_e_q takes an authenticator of type KKTTEEXXTT,, a service + name, an instance, the address of the host originating the + request, and a pointer to a structure of type AAUUTTHH__DDAATT + which is filled in with information obtained from the + authenticator. It also optionally takes the name of the + file in which it will find the secret key(s) for the ser- + vice. If the supplied _i_n_s_t_a_n_c_e contains "*", then the + first service key with the same service name found in the + service key file will be used, and the _i_n_s_t_a_n_c_e argument + will be filled in with the chosen instance. This means + that the caller must provide space for such an instance + name. + + It is used to find out information about the principal + when a request has been made to a service. It is up to + the application protocol to get the authenticator from the + client to the service. The authenticator is then passed + to _k_r_b___r_d___r_e_q to extract the desired information. + + _k_r_b___r_d___r_e_q returns zero (RD_AP_OK) upon successful authen- + tication. If a packet was forged, modified, or replayed, + authentication will fail. If the authentication fails, a + non-zero value is returned indicating the particular prob- + lem encountered. See _k_r_b_._h for the list of error codes. + + If the last argument is the null string (""), krb_rd_req + will use the file /etc/srvtab to find its keys. If the + last argument is NULL, it will assume that the key has + been set by _k_r_b___s_e_t___k_e_y and will not bother looking fur- + ther. + + _k_r_b___k_n_t_o_l_n converts a Kerberos name to a local name. It + takes a structure of type AUTH_DAT and uses the name and + instance to look in the database /etc/aname to find the + corresponding local name. The local name is returned and + can be used by an application to change uids, directories, + or other parameters. It is not an integral part of Ker- + beros, but is instead provided to support the use of Ker- + beros in existing utilities. + + + +MIT Project Athena Kerberos Version 4.0 3 + + + + + + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + + _k_r_b___s_e_t___k_e_y takes as an argument a des key. It then cre- + ates a key schedule from it and saves the original key to + be used as an initialization vector. It is used to set + the server's key which must be used to decrypt tickets. + + If called with a non-zero second argument, _k_r_b___s_e_t___k_e_y + will first convert the input from a string of arbitrary + length to a DES key by encrypting it with a one-way func- + tion. + + In most cases it should not be necessary to call + _k_r_b___s_e_t___k_e_y_. The necessary keys will usually be obtained + and set inside _k_r_b___r_d___r_e_q_. _k_r_b___s_e_t___k_e_y is provided for + those applications that do not wish to place the applica- + tion keys on disk. + + _k_r_b___g_e_t___c_r_e_d searches the caller's ticket file for a + ticket for the given service, instance, and realm; and, if + a ticket is found, fills in the given CREDENTIALS struc- + ture with the ticket information. + + If the ticket was found, _k_r_b___g_e_t___c_r_e_d returns GC_OK. If + the ticket file can't be found, can't be read, doesn't + belong to the user (other than root), isn't a regular + file, or is in the wrong mode, the error GC_TKFIL is + returned. + + _k_r_b___m_k___p_r_i_v creates an encrypted, authenticated message + from any arbitrary application data, pointed to by _i_n and + _i_n___l_e_n_g_t_h bytes long. The private session key, pointed to + by _k_e_y and the key schedule, _s_c_h_e_d_u_l_e_, are used to encrypt + the data and some header information using _p_c_b_c___e_n_c_r_y_p_t_. + _s_e_n_d_e_r and _r_e_c_e_i_v_e_r point to the Internet address of the + two parties. In addition to providing privacy, this pro- + tocol message protects against modifications, insertions + or replays. The encapsulated message and header are + placed in the area pointed to by _o_u_t and the routine + returns the length of the output, or -1 indicating an + error. + + _k_r_b___r_d___p_r_i_v decrypts and authenticates a received + _k_r_b___m_k___p_r_i_v message. _i_n points to the beginning of the + received message, whose length is specified in _i_n___l_e_n_g_t_h_. + The private session key, pointed to by _k_e_y_, and the key + schedule, _s_c_h_e_d_u_l_e_, are used to decrypt and verify the + received message. _m_s_g___d_a_t_a is a pointer to a _M_S_G___D_A_T + struct, defined in _k_r_b_._h_. The routine fills in the + _a_p_p___d_a_t_a field with a pointer to the decrypted application + data, _a_p_p___l_e_n_g_t_h with the length of the _a_p_p___d_a_t_a field, + _t_i_m_e___s_e_c and _t_i_m_e___5_m_s with the timestamps in the message, + and _s_w_a_p with a 1 if the byte order of the receiver is + + + +MIT Project Athena Kerberos Version 4.0 4 + + + + + + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + + different than that of the sender. (The application must + still determine if it is appropriate to byte-swap applica- + tion data; the Kerberos protocol fields are already taken + care of). The _h_a_s_h field returns a value useful as input + to the _k_r_b___c_k___r_e_p_l routine. + + The routine returns zero if ok, or a Kerberos error code. + Modified messages and old messages cause errors, but it is + up to the caller to check the time sequence of messages, + and to check against recently replayed messages using + _k_r_b___c_k___r_e_p_l if so desired. + + _k_r_b___m_k___s_a_f_e creates an authenticated, but unencrypted mes- + sage from any arbitrary application data, pointed to by _i_n + and _i_n___l_e_n_g_t_h bytes long. The private session key, + pointed to by _k_e_y_, is used to seed the _q_u_a_d___c_k_s_u_m_(_) check- + sum algorithm used as part of the authentication. _s_e_n_d_e_r + and _r_e_c_e_i_v_e_r point to the Internet address of the two par- + ties. This message does not provide privacy, but does + protect (via detection) against modifications, insertions + or replays. The encapsulated message and header are + placed in the area pointed to by _o_u_t and the routine + returns the length of the output, or -1 indicating an + error. The authentication provided by this routine is not + as strong as that provided by _k_r_b___m_k___p_r_i_v or by computing + the checksum using _c_b_c___c_k_s_u_m instead, both of which + authenticate via DES. + + + _k_r_b___r_d___s_a_f_e authenticates a received _k_r_b___m_k___s_a_f_e message. + _i_n points to the beginning of the received message, whose + length is specified in _i_n___l_e_n_g_t_h_. The private session + key, pointed to by _k_e_y_, is used to seed the quad_cksum() + routine as part of the authentication. _m_s_g___d_a_t_a is a + pointer to a _M_S_G___D_A_T struct, defined in _k_r_b_._h _. The rou- + tine fills in these _M_S_G___D_A_T fields: the _a_p_p___d_a_t_a field + with a pointer to the application data, _a_p_p___l_e_n_g_t_h with + the length of the _a_p_p___d_a_t_a field, _t_i_m_e___s_e_c and _t_i_m_e___5_m_s + with the timestamps in the message, and _s_w_a_p with a 1 if + the byte order of the receiver is different than that of + the sender. (The application must still determine if it + is appropriate to byte-swap application data; the Kerberos + protocol fields are already taken care of). The _h_a_s_h + field returns a value useful as input to the _k_r_b___c_k___r_e_p_l + routine. + + The routine returns zero if ok, or a Kerberos error code. + Modified messages and old messages cause errors, but it is + up to the caller to check the time sequence of messages, + and to check against recently replayed messages using + _k_r_b___c_k___r_e_p_l if so desired. + + + +MIT Project Athena Kerberos Version 4.0 5 + + + + + + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + + _k_r_b___m_k___e_r_r constructs an application level error message + that may be used along with _k_r_b___m_k___p_r_i_v or _k_r_b___m_k___s_a_f_e_. + _o_u_t is a pointer to the output buffer, _c_o_d_e is an applica- + tion specific error code, and _s_t_r_i_n_g is an application + specific error string. + + + _k_r_b___r_d___e_r_r unpacks a received _k_r_b___m_k___e_r_r message. _i_n + points to the beginning of the received message, whose + length is specified in _i_n___l_e_n_g_t_h_. _c_o_d_e is a pointer to a + value to be filled in with the error value provided by the + application. _m_s_g___d_a_t_a is a pointer to a _M_S_G___D_A_T struct, + defined in _k_r_b_._h _. The routine fills in these _M_S_G___D_A_T + fields: the _a_p_p___d_a_t_a field with a pointer to the applica- + tion error text, _a_p_p___l_e_n_g_t_h with the length of the + _a_p_p___d_a_t_a field, and _s_w_a_p with a 1 if the byte order of the + receiver is different than that of the sender. (The + application must still determine if it is appropriate to + byte-swap application data; the Kerberos protocol fields + are already taken care of). + + The routine returns zero if the error message has been + successfully received, or a Kerberos error code. + + The _K_T_E_X_T structure is used to pass around text of varying + lengths. It consists of a buffer for the data, and a + length. krb_rd_req takes an argument of this type con- + taining the authenticator, and krb_mk_req returns the + authenticator in a structure of this type. KTEXT itself + is really a pointer to the structure. The actual struc- + ture is of type KTEXT_ST. + + The _A_U_T_H___D_A_T structure is filled in by krb_rd_req. It + must be allocated before calling krb_rd_req, and a pointer + to it is passed. The structure is filled in with data + obtained from Kerberos. _M_S_G___D_A_T structure is filled in by + either krb_rd_priv, krb_rd_safe, or krb_rd_err. It must + be allocated before the call and a pointer to it is + passed. The structure is filled in with data obtained + from Kerberos. + + +FFIILLEESS + /usr/include/kerberosIV/krb.h + /usr/lib/libkrb.a + /usr/include/kerberosIV/des.h + /usr/lib/libdes.a + /etc/kerberosIV/aname + /etc/kerberosIV/srvtab + /tmp/tkt[uid] + + + + +MIT Project Athena Kerberos Version 4.0 6 + + + + + + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + +SSEEEE AALLSSOO + kerberos(1), des_crypt(3) + +DDIIAAGGNNOOSSTTIICCSS +BBUUGGSS + The caller of _k_r_b___r_d___r_e_q_, _k_r_b___r_d___p_r_i_v_, _a_n_d _k_r_b___r_d___s_a_f_e + must check time order and for replay attempts. + _k_r_b___c_k___r_e_p_l is not implemented yet. + +AAUUTTHHOORRSS + Clifford Neuman, MIT Project Athena + Steve Miller, MIT Project Athena/Digital Equipment Corpo- + ration + +RREESSTTRRIICCTTIIOONNSS + COPYRIGHT 1985,1986,1989 Massachusetts Institute of Tech- + nology + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +MIT Project Athena Kerberos Version 4.0 7 + + + + + diff --git a/usr/share/man/cat3/krb_mk_safe.0 b/usr/share/man/cat3/krb_mk_safe.0 new file mode 100644 index 0000000000..ac1157fbda --- /dev/null +++ b/usr/share/man/cat3/krb_mk_safe.0 @@ -0,0 +1,462 @@ + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + +NNAAMMEE + krb_mk_req, krb_rd_req, krb_kntoln, krb_set_key, + krb_get_cred, krb_mk_priv, krb_rd_priv, krb_mk_safe, + krb_rd_safe, krb_mk_err, krb_rd_err, krb_ck_repl - Ker- + beros authentication library + +SSYYNNOOPPSSIISS + ##iinncclluuddee <> + ##iinncclluuddee <> + + eexxtteerrnn cchhaarr **kkrrbb__eerrrr__ttxxtt[[]];; + + iinntt kkrrbb__mmkk__rreeqq((aauutthheenntt,,sseerrvviiccee,,iinnssttaannccee,,rreeaallmm,,cchheecckkssuumm)) + KKTTEEXXTT aauutthheenntt;; + cchhaarr **sseerrvviiccee;; + cchhaarr **iinnssttaannccee;; + cchhaarr **rreeaallmm;; + uu__lloonngg cchheecckkssuumm;; + + iinntt kkrrbb__rrdd__rreeqq((aauutthheenntt,,sseerrvviiccee,,iinnssttaannccee,,ffrroomm__aaddddrr,,aadd,,ffnn)) + KKTTEEXXTT aauutthheenntt;; + cchhaarr **sseerrvviiccee;; + cchhaarr **iinnssttaannccee;; + uu__lloonngg ffrroomm__aaddddrr;; + AAUUTTHH__DDAATT **aadd;; + cchhaarr **ffnn;; + + iinntt kkrrbb__kknnttoollnn((aadd,,llnnaammee)) + AAUUTTHH__DDAATT **aadd;; + cchhaarr **llnnaammee;; + + iinntt kkrrbb__sseett__kkeeyy((kkeeyy,,ccvvtt)) + cchhaarr **kkeeyy;; + iinntt ccvvtt;; + + iinntt kkrrbb__ggeett__ccrreedd((sseerrvviiccee,,iinnssttaannccee,,rreeaallmm,,cc)) + cchhaarr **sseerrvviiccee;; + cchhaarr **iinnssttaannccee;; + cchhaarr **rreeaallmm;; + CCRREEDDEENNTTIIAALLSS **cc;; + + lloonngg kkrrbb__mmkk__pprriivv((iinn,,oouutt,,iinn__lleennggtthh,,sscchheedduullee,,kkeeyy,,sseennddeerr,,rreecceeiivveerr)) + uu__cchhaarr **iinn;; + uu__cchhaarr **oouutt;; + uu__lloonngg iinn__lleennggtthh;; + ddeess__ccbblloocckk kkeeyy;; + ddeess__kkeeyy__sscchheedduullee sscchheedduullee;; + ssttrruucctt ssoocckkaaddddrr__iinn **sseennddeerr;; + ssttrruucctt ssoocckkaaddddrr__iinn **rreecceeiivveerr;; + + lloonngg kkrrbb__rrdd__pprriivv((iinn,,iinn__lleennggtthh,,sscchheedduullee,,kkeeyy,,sseennddeerr,,rreecceeiivveerr,,mmssgg__ddaattaa)) + + + +MIT Project Athena Kerberos Version 4.0 1 + + + + + + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + + uu__cchhaarr **iinn;; + uu__lloonngg iinn__lleennggtthh;; + KKeeyy__sscchheedduullee sscchheedduullee;; + ddeess__ccbblloocckk kkeeyy;; + ssttrruucctt ssoocckkaaddddrr__iinn **sseennddeerr;; + ssttrruucctt ssoocckkaaddddrr__iinn **rreecceeiivveerr;; + MMSSGG__DDAATT **mmssgg__ddaattaa;; + + lloonngg kkrrbb__mmkk__ssaaffee((iinn,,oouutt,,iinn__lleennggtthh,,kkeeyy,,sseennddeerr,,rreecceeiivveerr)) + uu__cchhaarr **iinn;; + uu__cchhaarr **oouutt;; + uu__lloonngg iinn__lleennggtthh;; + ddeess__ccbblloocckk kkeeyy;; + ssttrruucctt ssoocckkaaddddrr__iinn **sseennddeerr;; + ssttrruucctt ssoocckkaaddddrr__iinn **rreecceeiivveerr;; + + lloonngg kkrrbb__rrdd__ssaaffee((iinn,,lleennggtthh,,kkeeyy,,sseennddeerr,,rreecceeiivveerr,,mmssgg__ddaattaa)) + uu__cchhaarr **iinn;; + uu__lloonngg lleennggtthh;; + ddeess__ccbblloocckk kkeeyy;; + ssttrruucctt ssoocckkaaddddrr__iinn **sseennddeerr;; + ssttrruucctt ssoocckkaaddddrr__iinn **rreecceeiivveerr;; + MMSSGG__DDAATT **mmssgg__ddaattaa;; + + lloonngg kkrrbb__mmkk__eerrrr((oouutt,,ccooddee,,ssttrriinngg)) + uu__cchhaarr **oouutt;; + lloonngg ccooddee;; + cchhaarr **ssttrriinngg;; + + lloonngg kkrrbb__rrdd__eerrrr((iinn,,lleennggtthh,,ccooddee,,mmssgg__ddaattaa)) + uu__cchhaarr **iinn;; + uu__lloonngg lleennggtthh;; + lloonngg ccooddee;; + MMSSGG__DDAATT **mmssgg__ddaattaa;; + +DDEESSCCRRIIPPTTIIOONN + This library supports network authentication and various + related operations. The library contains many routines + beyond those described in this man page, but they are not + intended to be used directly. Instead, they are called by + the routines that are described, the authentication server + and the login program. + + _k_r_b___e_r_r___t_x_t_[_] contains text string descriptions of various + Kerberos error codes returned by some of the routines + below. + + _k_r_b___m_k___r_e_q takes a pointer to a text structure in which an + authenticator is to be built. It also takes the name, + instance, and realm of the service to be used and an + optional checksum. It is up to the application to decide + + + +MIT Project Athena Kerberos Version 4.0 2 + + + + + + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + + how to generate the checksum. _k_r_b___m_k___r_e_q then retrieves a + ticket for the desired service and creates an authentica- + tor. The authenticator is built in _a_u_t_h_e_n_t and is acces- + sible to the calling procedure. + + It is up to the application to get the authenticator to + the service where it will be read by _k_r_b___r_d___r_e_q_. Unless + an attacker possesses the session key contained in the + ticket, it will be unable to modify the authenticator. + Thus, the checksum can be used to verify the authenticity + of the other data that will pass through a connection. + + _k_r_b___r_d___r_e_q takes an authenticator of type KKTTEEXXTT,, a service + name, an instance, the address of the host originating the + request, and a pointer to a structure of type AAUUTTHH__DDAATT + which is filled in with information obtained from the + authenticator. It also optionally takes the name of the + file in which it will find the secret key(s) for the ser- + vice. If the supplied _i_n_s_t_a_n_c_e contains "*", then the + first service key with the same service name found in the + service key file will be used, and the _i_n_s_t_a_n_c_e argument + will be filled in with the chosen instance. This means + that the caller must provide space for such an instance + name. + + It is used to find out information about the principal + when a request has been made to a service. It is up to + the application protocol to get the authenticator from the + client to the service. The authenticator is then passed + to _k_r_b___r_d___r_e_q to extract the desired information. + + _k_r_b___r_d___r_e_q returns zero (RD_AP_OK) upon successful authen- + tication. If a packet was forged, modified, or replayed, + authentication will fail. If the authentication fails, a + non-zero value is returned indicating the particular prob- + lem encountered. See _k_r_b_._h for the list of error codes. + + If the last argument is the null string (""), krb_rd_req + will use the file /etc/srvtab to find its keys. If the + last argument is NULL, it will assume that the key has + been set by _k_r_b___s_e_t___k_e_y and will not bother looking fur- + ther. + + _k_r_b___k_n_t_o_l_n converts a Kerberos name to a local name. It + takes a structure of type AUTH_DAT and uses the name and + instance to look in the database /etc/aname to find the + corresponding local name. The local name is returned and + can be used by an application to change uids, directories, + or other parameters. It is not an integral part of Ker- + beros, but is instead provided to support the use of Ker- + beros in existing utilities. + + + +MIT Project Athena Kerberos Version 4.0 3 + + + + + + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + + _k_r_b___s_e_t___k_e_y takes as an argument a des key. It then cre- + ates a key schedule from it and saves the original key to + be used as an initialization vector. It is used to set + the server's key which must be used to decrypt tickets. + + If called with a non-zero second argument, _k_r_b___s_e_t___k_e_y + will first convert the input from a string of arbitrary + length to a DES key by encrypting it with a one-way func- + tion. + + In most cases it should not be necessary to call + _k_r_b___s_e_t___k_e_y_. The necessary keys will usually be obtained + and set inside _k_r_b___r_d___r_e_q_. _k_r_b___s_e_t___k_e_y is provided for + those applications that do not wish to place the applica- + tion keys on disk. + + _k_r_b___g_e_t___c_r_e_d searches the caller's ticket file for a + ticket for the given service, instance, and realm; and, if + a ticket is found, fills in the given CREDENTIALS struc- + ture with the ticket information. + + If the ticket was found, _k_r_b___g_e_t___c_r_e_d returns GC_OK. If + the ticket file can't be found, can't be read, doesn't + belong to the user (other than root), isn't a regular + file, or is in the wrong mode, the error GC_TKFIL is + returned. + + _k_r_b___m_k___p_r_i_v creates an encrypted, authenticated message + from any arbitrary application data, pointed to by _i_n and + _i_n___l_e_n_g_t_h bytes long. The private session key, pointed to + by _k_e_y and the key schedule, _s_c_h_e_d_u_l_e_, are used to encrypt + the data and some header information using _p_c_b_c___e_n_c_r_y_p_t_. + _s_e_n_d_e_r and _r_e_c_e_i_v_e_r point to the Internet address of the + two parties. In addition to providing privacy, this pro- + tocol message protects against modifications, insertions + or replays. The encapsulated message and header are + placed in the area pointed to by _o_u_t and the routine + returns the length of the output, or -1 indicating an + error. + + _k_r_b___r_d___p_r_i_v decrypts and authenticates a received + _k_r_b___m_k___p_r_i_v message. _i_n points to the beginning of the + received message, whose length is specified in _i_n___l_e_n_g_t_h_. + The private session key, pointed to by _k_e_y_, and the key + schedule, _s_c_h_e_d_u_l_e_, are used to decrypt and verify the + received message. _m_s_g___d_a_t_a is a pointer to a _M_S_G___D_A_T + struct, defined in _k_r_b_._h_. The routine fills in the + _a_p_p___d_a_t_a field with a pointer to the decrypted application + data, _a_p_p___l_e_n_g_t_h with the length of the _a_p_p___d_a_t_a field, + _t_i_m_e___s_e_c and _t_i_m_e___5_m_s with the timestamps in the message, + and _s_w_a_p with a 1 if the byte order of the receiver is + + + +MIT Project Athena Kerberos Version 4.0 4 + + + + + + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + + different than that of the sender. (The application must + still determine if it is appropriate to byte-swap applica- + tion data; the Kerberos protocol fields are already taken + care of). The _h_a_s_h field returns a value useful as input + to the _k_r_b___c_k___r_e_p_l routine. + + The routine returns zero if ok, or a Kerberos error code. + Modified messages and old messages cause errors, but it is + up to the caller to check the time sequence of messages, + and to check against recently replayed messages using + _k_r_b___c_k___r_e_p_l if so desired. + + _k_r_b___m_k___s_a_f_e creates an authenticated, but unencrypted mes- + sage from any arbitrary application data, pointed to by _i_n + and _i_n___l_e_n_g_t_h bytes long. The private session key, + pointed to by _k_e_y_, is used to seed the _q_u_a_d___c_k_s_u_m_(_) check- + sum algorithm used as part of the authentication. _s_e_n_d_e_r + and _r_e_c_e_i_v_e_r point to the Internet address of the two par- + ties. This message does not provide privacy, but does + protect (via detection) against modifications, insertions + or replays. The encapsulated message and header are + placed in the area pointed to by _o_u_t and the routine + returns the length of the output, or -1 indicating an + error. The authentication provided by this routine is not + as strong as that provided by _k_r_b___m_k___p_r_i_v or by computing + the checksum using _c_b_c___c_k_s_u_m instead, both of which + authenticate via DES. + + + _k_r_b___r_d___s_a_f_e authenticates a received _k_r_b___m_k___s_a_f_e message. + _i_n points to the beginning of the received message, whose + length is specified in _i_n___l_e_n_g_t_h_. The private session + key, pointed to by _k_e_y_, is used to seed the quad_cksum() + routine as part of the authentication. _m_s_g___d_a_t_a is a + pointer to a _M_S_G___D_A_T struct, defined in _k_r_b_._h _. The rou- + tine fills in these _M_S_G___D_A_T fields: the _a_p_p___d_a_t_a field + with a pointer to the application data, _a_p_p___l_e_n_g_t_h with + the length of the _a_p_p___d_a_t_a field, _t_i_m_e___s_e_c and _t_i_m_e___5_m_s + with the timestamps in the message, and _s_w_a_p with a 1 if + the byte order of the receiver is different than that of + the sender. (The application must still determine if it + is appropriate to byte-swap application data; the Kerberos + protocol fields are already taken care of). The _h_a_s_h + field returns a value useful as input to the _k_r_b___c_k___r_e_p_l + routine. + + The routine returns zero if ok, or a Kerberos error code. + Modified messages and old messages cause errors, but it is + up to the caller to check the time sequence of messages, + and to check against recently replayed messages using + _k_r_b___c_k___r_e_p_l if so desired. + + + +MIT Project Athena Kerberos Version 4.0 5 + + + + + + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + + _k_r_b___m_k___e_r_r constructs an application level error message + that may be used along with _k_r_b___m_k___p_r_i_v or _k_r_b___m_k___s_a_f_e_. + _o_u_t is a pointer to the output buffer, _c_o_d_e is an applica- + tion specific error code, and _s_t_r_i_n_g is an application + specific error string. + + + _k_r_b___r_d___e_r_r unpacks a received _k_r_b___m_k___e_r_r message. _i_n + points to the beginning of the received message, whose + length is specified in _i_n___l_e_n_g_t_h_. _c_o_d_e is a pointer to a + value to be filled in with the error value provided by the + application. _m_s_g___d_a_t_a is a pointer to a _M_S_G___D_A_T struct, + defined in _k_r_b_._h _. The routine fills in these _M_S_G___D_A_T + fields: the _a_p_p___d_a_t_a field with a pointer to the applica- + tion error text, _a_p_p___l_e_n_g_t_h with the length of the + _a_p_p___d_a_t_a field, and _s_w_a_p with a 1 if the byte order of the + receiver is different than that of the sender. (The + application must still determine if it is appropriate to + byte-swap application data; the Kerberos protocol fields + are already taken care of). + + The routine returns zero if the error message has been + successfully received, or a Kerberos error code. + + The _K_T_E_X_T structure is used to pass around text of varying + lengths. It consists of a buffer for the data, and a + length. krb_rd_req takes an argument of this type con- + taining the authenticator, and krb_mk_req returns the + authenticator in a structure of this type. KTEXT itself + is really a pointer to the structure. The actual struc- + ture is of type KTEXT_ST. + + The _A_U_T_H___D_A_T structure is filled in by krb_rd_req. It + must be allocated before calling krb_rd_req, and a pointer + to it is passed. The structure is filled in with data + obtained from Kerberos. _M_S_G___D_A_T structure is filled in by + either krb_rd_priv, krb_rd_safe, or krb_rd_err. It must + be allocated before the call and a pointer to it is + passed. The structure is filled in with data obtained + from Kerberos. + + +FFIILLEESS + /usr/include/kerberosIV/krb.h + /usr/lib/libkrb.a + /usr/include/kerberosIV/des.h + /usr/lib/libdes.a + /etc/kerberosIV/aname + /etc/kerberosIV/srvtab + /tmp/tkt[uid] + + + + +MIT Project Athena Kerberos Version 4.0 6 + + + + + + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + +SSEEEE AALLSSOO + kerberos(1), des_crypt(3) + +DDIIAAGGNNOOSSTTIICCSS +BBUUGGSS + The caller of _k_r_b___r_d___r_e_q_, _k_r_b___r_d___p_r_i_v_, _a_n_d _k_r_b___r_d___s_a_f_e + must check time order and for replay attempts. + _k_r_b___c_k___r_e_p_l is not implemented yet. + +AAUUTTHHOORRSS + Clifford Neuman, MIT Project Athena + Steve Miller, MIT Project Athena/Digital Equipment Corpo- + ration + +RREESSTTRRIICCTTIIOONNSS + COPYRIGHT 1985,1986,1989 Massachusetts Institute of Tech- + nology + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +MIT Project Athena Kerberos Version 4.0 7 + + + + + diff --git a/usr/share/man/cat3/krb_rd_err.0 b/usr/share/man/cat3/krb_rd_err.0 new file mode 100644 index 0000000000..ac1157fbda --- /dev/null +++ b/usr/share/man/cat3/krb_rd_err.0 @@ -0,0 +1,462 @@ + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + +NNAAMMEE + krb_mk_req, krb_rd_req, krb_kntoln, krb_set_key, + krb_get_cred, krb_mk_priv, krb_rd_priv, krb_mk_safe, + krb_rd_safe, krb_mk_err, krb_rd_err, krb_ck_repl - Ker- + beros authentication library + +SSYYNNOOPPSSIISS + ##iinncclluuddee <> + ##iinncclluuddee <> + + eexxtteerrnn cchhaarr **kkrrbb__eerrrr__ttxxtt[[]];; + + iinntt kkrrbb__mmkk__rreeqq((aauutthheenntt,,sseerrvviiccee,,iinnssttaannccee,,rreeaallmm,,cchheecckkssuumm)) + KKTTEEXXTT aauutthheenntt;; + cchhaarr **sseerrvviiccee;; + cchhaarr **iinnssttaannccee;; + cchhaarr **rreeaallmm;; + uu__lloonngg cchheecckkssuumm;; + + iinntt kkrrbb__rrdd__rreeqq((aauutthheenntt,,sseerrvviiccee,,iinnssttaannccee,,ffrroomm__aaddddrr,,aadd,,ffnn)) + KKTTEEXXTT aauutthheenntt;; + cchhaarr **sseerrvviiccee;; + cchhaarr **iinnssttaannccee;; + uu__lloonngg ffrroomm__aaddddrr;; + AAUUTTHH__DDAATT **aadd;; + cchhaarr **ffnn;; + + iinntt kkrrbb__kknnttoollnn((aadd,,llnnaammee)) + AAUUTTHH__DDAATT **aadd;; + cchhaarr **llnnaammee;; + + iinntt kkrrbb__sseett__kkeeyy((kkeeyy,,ccvvtt)) + cchhaarr **kkeeyy;; + iinntt ccvvtt;; + + iinntt kkrrbb__ggeett__ccrreedd((sseerrvviiccee,,iinnssttaannccee,,rreeaallmm,,cc)) + cchhaarr **sseerrvviiccee;; + cchhaarr **iinnssttaannccee;; + cchhaarr **rreeaallmm;; + CCRREEDDEENNTTIIAALLSS **cc;; + + lloonngg kkrrbb__mmkk__pprriivv((iinn,,oouutt,,iinn__lleennggtthh,,sscchheedduullee,,kkeeyy,,sseennddeerr,,rreecceeiivveerr)) + uu__cchhaarr **iinn;; + uu__cchhaarr **oouutt;; + uu__lloonngg iinn__lleennggtthh;; + ddeess__ccbblloocckk kkeeyy;; + ddeess__kkeeyy__sscchheedduullee sscchheedduullee;; + ssttrruucctt ssoocckkaaddddrr__iinn **sseennddeerr;; + ssttrruucctt ssoocckkaaddddrr__iinn **rreecceeiivveerr;; + + lloonngg kkrrbb__rrdd__pprriivv((iinn,,iinn__lleennggtthh,,sscchheedduullee,,kkeeyy,,sseennddeerr,,rreecceeiivveerr,,mmssgg__ddaattaa)) + + + +MIT Project Athena Kerberos Version 4.0 1 + + + + + + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + + uu__cchhaarr **iinn;; + uu__lloonngg iinn__lleennggtthh;; + KKeeyy__sscchheedduullee sscchheedduullee;; + ddeess__ccbblloocckk kkeeyy;; + ssttrruucctt ssoocckkaaddddrr__iinn **sseennddeerr;; + ssttrruucctt ssoocckkaaddddrr__iinn **rreecceeiivveerr;; + MMSSGG__DDAATT **mmssgg__ddaattaa;; + + lloonngg kkrrbb__mmkk__ssaaffee((iinn,,oouutt,,iinn__lleennggtthh,,kkeeyy,,sseennddeerr,,rreecceeiivveerr)) + uu__cchhaarr **iinn;; + uu__cchhaarr **oouutt;; + uu__lloonngg iinn__lleennggtthh;; + ddeess__ccbblloocckk kkeeyy;; + ssttrruucctt ssoocckkaaddddrr__iinn **sseennddeerr;; + ssttrruucctt ssoocckkaaddddrr__iinn **rreecceeiivveerr;; + + lloonngg kkrrbb__rrdd__ssaaffee((iinn,,lleennggtthh,,kkeeyy,,sseennddeerr,,rreecceeiivveerr,,mmssgg__ddaattaa)) + uu__cchhaarr **iinn;; + uu__lloonngg lleennggtthh;; + ddeess__ccbblloocckk kkeeyy;; + ssttrruucctt ssoocckkaaddddrr__iinn **sseennddeerr;; + ssttrruucctt ssoocckkaaddddrr__iinn **rreecceeiivveerr;; + MMSSGG__DDAATT **mmssgg__ddaattaa;; + + lloonngg kkrrbb__mmkk__eerrrr((oouutt,,ccooddee,,ssttrriinngg)) + uu__cchhaarr **oouutt;; + lloonngg ccooddee;; + cchhaarr **ssttrriinngg;; + + lloonngg kkrrbb__rrdd__eerrrr((iinn,,lleennggtthh,,ccooddee,,mmssgg__ddaattaa)) + uu__cchhaarr **iinn;; + uu__lloonngg lleennggtthh;; + lloonngg ccooddee;; + MMSSGG__DDAATT **mmssgg__ddaattaa;; + +DDEESSCCRRIIPPTTIIOONN + This library supports network authentication and various + related operations. The library contains many routines + beyond those described in this man page, but they are not + intended to be used directly. Instead, they are called by + the routines that are described, the authentication server + and the login program. + + _k_r_b___e_r_r___t_x_t_[_] contains text string descriptions of various + Kerberos error codes returned by some of the routines + below. + + _k_r_b___m_k___r_e_q takes a pointer to a text structure in which an + authenticator is to be built. It also takes the name, + instance, and realm of the service to be used and an + optional checksum. It is up to the application to decide + + + +MIT Project Athena Kerberos Version 4.0 2 + + + + + + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + + how to generate the checksum. _k_r_b___m_k___r_e_q then retrieves a + ticket for the desired service and creates an authentica- + tor. The authenticator is built in _a_u_t_h_e_n_t and is acces- + sible to the calling procedure. + + It is up to the application to get the authenticator to + the service where it will be read by _k_r_b___r_d___r_e_q_. Unless + an attacker possesses the session key contained in the + ticket, it will be unable to modify the authenticator. + Thus, the checksum can be used to verify the authenticity + of the other data that will pass through a connection. + + _k_r_b___r_d___r_e_q takes an authenticator of type KKTTEEXXTT,, a service + name, an instance, the address of the host originating the + request, and a pointer to a structure of type AAUUTTHH__DDAATT + which is filled in with information obtained from the + authenticator. It also optionally takes the name of the + file in which it will find the secret key(s) for the ser- + vice. If the supplied _i_n_s_t_a_n_c_e contains "*", then the + first service key with the same service name found in the + service key file will be used, and the _i_n_s_t_a_n_c_e argument + will be filled in with the chosen instance. This means + that the caller must provide space for such an instance + name. + + It is used to find out information about the principal + when a request has been made to a service. It is up to + the application protocol to get the authenticator from the + client to the service. The authenticator is then passed + to _k_r_b___r_d___r_e_q to extract the desired information. + + _k_r_b___r_d___r_e_q returns zero (RD_AP_OK) upon successful authen- + tication. If a packet was forged, modified, or replayed, + authentication will fail. If the authentication fails, a + non-zero value is returned indicating the particular prob- + lem encountered. See _k_r_b_._h for the list of error codes. + + If the last argument is the null string (""), krb_rd_req + will use the file /etc/srvtab to find its keys. If the + last argument is NULL, it will assume that the key has + been set by _k_r_b___s_e_t___k_e_y and will not bother looking fur- + ther. + + _k_r_b___k_n_t_o_l_n converts a Kerberos name to a local name. It + takes a structure of type AUTH_DAT and uses the name and + instance to look in the database /etc/aname to find the + corresponding local name. The local name is returned and + can be used by an application to change uids, directories, + or other parameters. It is not an integral part of Ker- + beros, but is instead provided to support the use of Ker- + beros in existing utilities. + + + +MIT Project Athena Kerberos Version 4.0 3 + + + + + + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + + _k_r_b___s_e_t___k_e_y takes as an argument a des key. It then cre- + ates a key schedule from it and saves the original key to + be used as an initialization vector. It is used to set + the server's key which must be used to decrypt tickets. + + If called with a non-zero second argument, _k_r_b___s_e_t___k_e_y + will first convert the input from a string of arbitrary + length to a DES key by encrypting it with a one-way func- + tion. + + In most cases it should not be necessary to call + _k_r_b___s_e_t___k_e_y_. The necessary keys will usually be obtained + and set inside _k_r_b___r_d___r_e_q_. _k_r_b___s_e_t___k_e_y is provided for + those applications that do not wish to place the applica- + tion keys on disk. + + _k_r_b___g_e_t___c_r_e_d searches the caller's ticket file for a + ticket for the given service, instance, and realm; and, if + a ticket is found, fills in the given CREDENTIALS struc- + ture with the ticket information. + + If the ticket was found, _k_r_b___g_e_t___c_r_e_d returns GC_OK. If + the ticket file can't be found, can't be read, doesn't + belong to the user (other than root), isn't a regular + file, or is in the wrong mode, the error GC_TKFIL is + returned. + + _k_r_b___m_k___p_r_i_v creates an encrypted, authenticated message + from any arbitrary application data, pointed to by _i_n and + _i_n___l_e_n_g_t_h bytes long. The private session key, pointed to + by _k_e_y and the key schedule, _s_c_h_e_d_u_l_e_, are used to encrypt + the data and some header information using _p_c_b_c___e_n_c_r_y_p_t_. + _s_e_n_d_e_r and _r_e_c_e_i_v_e_r point to the Internet address of the + two parties. In addition to providing privacy, this pro- + tocol message protects against modifications, insertions + or replays. The encapsulated message and header are + placed in the area pointed to by _o_u_t and the routine + returns the length of the output, or -1 indicating an + error. + + _k_r_b___r_d___p_r_i_v decrypts and authenticates a received + _k_r_b___m_k___p_r_i_v message. _i_n points to the beginning of the + received message, whose length is specified in _i_n___l_e_n_g_t_h_. + The private session key, pointed to by _k_e_y_, and the key + schedule, _s_c_h_e_d_u_l_e_, are used to decrypt and verify the + received message. _m_s_g___d_a_t_a is a pointer to a _M_S_G___D_A_T + struct, defined in _k_r_b_._h_. The routine fills in the + _a_p_p___d_a_t_a field with a pointer to the decrypted application + data, _a_p_p___l_e_n_g_t_h with the length of the _a_p_p___d_a_t_a field, + _t_i_m_e___s_e_c and _t_i_m_e___5_m_s with the timestamps in the message, + and _s_w_a_p with a 1 if the byte order of the receiver is + + + +MIT Project Athena Kerberos Version 4.0 4 + + + + + + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + + different than that of the sender. (The application must + still determine if it is appropriate to byte-swap applica- + tion data; the Kerberos protocol fields are already taken + care of). The _h_a_s_h field returns a value useful as input + to the _k_r_b___c_k___r_e_p_l routine. + + The routine returns zero if ok, or a Kerberos error code. + Modified messages and old messages cause errors, but it is + up to the caller to check the time sequence of messages, + and to check against recently replayed messages using + _k_r_b___c_k___r_e_p_l if so desired. + + _k_r_b___m_k___s_a_f_e creates an authenticated, but unencrypted mes- + sage from any arbitrary application data, pointed to by _i_n + and _i_n___l_e_n_g_t_h bytes long. The private session key, + pointed to by _k_e_y_, is used to seed the _q_u_a_d___c_k_s_u_m_(_) check- + sum algorithm used as part of the authentication. _s_e_n_d_e_r + and _r_e_c_e_i_v_e_r point to the Internet address of the two par- + ties. This message does not provide privacy, but does + protect (via detection) against modifications, insertions + or replays. The encapsulated message and header are + placed in the area pointed to by _o_u_t and the routine + returns the length of the output, or -1 indicating an + error. The authentication provided by this routine is not + as strong as that provided by _k_r_b___m_k___p_r_i_v or by computing + the checksum using _c_b_c___c_k_s_u_m instead, both of which + authenticate via DES. + + + _k_r_b___r_d___s_a_f_e authenticates a received _k_r_b___m_k___s_a_f_e message. + _i_n points to the beginning of the received message, whose + length is specified in _i_n___l_e_n_g_t_h_. The private session + key, pointed to by _k_e_y_, is used to seed the quad_cksum() + routine as part of the authentication. _m_s_g___d_a_t_a is a + pointer to a _M_S_G___D_A_T struct, defined in _k_r_b_._h _. The rou- + tine fills in these _M_S_G___D_A_T fields: the _a_p_p___d_a_t_a field + with a pointer to the application data, _a_p_p___l_e_n_g_t_h with + the length of the _a_p_p___d_a_t_a field, _t_i_m_e___s_e_c and _t_i_m_e___5_m_s + with the timestamps in the message, and _s_w_a_p with a 1 if + the byte order of the receiver is different than that of + the sender. (The application must still determine if it + is appropriate to byte-swap application data; the Kerberos + protocol fields are already taken care of). The _h_a_s_h + field returns a value useful as input to the _k_r_b___c_k___r_e_p_l + routine. + + The routine returns zero if ok, or a Kerberos error code. + Modified messages and old messages cause errors, but it is + up to the caller to check the time sequence of messages, + and to check against recently replayed messages using + _k_r_b___c_k___r_e_p_l if so desired. + + + +MIT Project Athena Kerberos Version 4.0 5 + + + + + + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + + _k_r_b___m_k___e_r_r constructs an application level error message + that may be used along with _k_r_b___m_k___p_r_i_v or _k_r_b___m_k___s_a_f_e_. + _o_u_t is a pointer to the output buffer, _c_o_d_e is an applica- + tion specific error code, and _s_t_r_i_n_g is an application + specific error string. + + + _k_r_b___r_d___e_r_r unpacks a received _k_r_b___m_k___e_r_r message. _i_n + points to the beginning of the received message, whose + length is specified in _i_n___l_e_n_g_t_h_. _c_o_d_e is a pointer to a + value to be filled in with the error value provided by the + application. _m_s_g___d_a_t_a is a pointer to a _M_S_G___D_A_T struct, + defined in _k_r_b_._h _. The routine fills in these _M_S_G___D_A_T + fields: the _a_p_p___d_a_t_a field with a pointer to the applica- + tion error text, _a_p_p___l_e_n_g_t_h with the length of the + _a_p_p___d_a_t_a field, and _s_w_a_p with a 1 if the byte order of the + receiver is different than that of the sender. (The + application must still determine if it is appropriate to + byte-swap application data; the Kerberos protocol fields + are already taken care of). + + The routine returns zero if the error message has been + successfully received, or a Kerberos error code. + + The _K_T_E_X_T structure is used to pass around text of varying + lengths. It consists of a buffer for the data, and a + length. krb_rd_req takes an argument of this type con- + taining the authenticator, and krb_mk_req returns the + authenticator in a structure of this type. KTEXT itself + is really a pointer to the structure. The actual struc- + ture is of type KTEXT_ST. + + The _A_U_T_H___D_A_T structure is filled in by krb_rd_req. It + must be allocated before calling krb_rd_req, and a pointer + to it is passed. The structure is filled in with data + obtained from Kerberos. _M_S_G___D_A_T structure is filled in by + either krb_rd_priv, krb_rd_safe, or krb_rd_err. It must + be allocated before the call and a pointer to it is + passed. The structure is filled in with data obtained + from Kerberos. + + +FFIILLEESS + /usr/include/kerberosIV/krb.h + /usr/lib/libkrb.a + /usr/include/kerberosIV/des.h + /usr/lib/libdes.a + /etc/kerberosIV/aname + /etc/kerberosIV/srvtab + /tmp/tkt[uid] + + + + +MIT Project Athena Kerberos Version 4.0 6 + + + + + + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + +SSEEEE AALLSSOO + kerberos(1), des_crypt(3) + +DDIIAAGGNNOOSSTTIICCSS +BBUUGGSS + The caller of _k_r_b___r_d___r_e_q_, _k_r_b___r_d___p_r_i_v_, _a_n_d _k_r_b___r_d___s_a_f_e + must check time order and for replay attempts. + _k_r_b___c_k___r_e_p_l is not implemented yet. + +AAUUTTHHOORRSS + Clifford Neuman, MIT Project Athena + Steve Miller, MIT Project Athena/Digital Equipment Corpo- + ration + +RREESSTTRRIICCTTIIOONNSS + COPYRIGHT 1985,1986,1989 Massachusetts Institute of Tech- + nology + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +MIT Project Athena Kerberos Version 4.0 7 + + + + + diff --git a/usr/share/man/cat3/krb_rd_req.0 b/usr/share/man/cat3/krb_rd_req.0 new file mode 100644 index 0000000000..ac1157fbda --- /dev/null +++ b/usr/share/man/cat3/krb_rd_req.0 @@ -0,0 +1,462 @@ + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + +NNAAMMEE + krb_mk_req, krb_rd_req, krb_kntoln, krb_set_key, + krb_get_cred, krb_mk_priv, krb_rd_priv, krb_mk_safe, + krb_rd_safe, krb_mk_err, krb_rd_err, krb_ck_repl - Ker- + beros authentication library + +SSYYNNOOPPSSIISS + ##iinncclluuddee <> + ##iinncclluuddee <> + + eexxtteerrnn cchhaarr **kkrrbb__eerrrr__ttxxtt[[]];; + + iinntt kkrrbb__mmkk__rreeqq((aauutthheenntt,,sseerrvviiccee,,iinnssttaannccee,,rreeaallmm,,cchheecckkssuumm)) + KKTTEEXXTT aauutthheenntt;; + cchhaarr **sseerrvviiccee;; + cchhaarr **iinnssttaannccee;; + cchhaarr **rreeaallmm;; + uu__lloonngg cchheecckkssuumm;; + + iinntt kkrrbb__rrdd__rreeqq((aauutthheenntt,,sseerrvviiccee,,iinnssttaannccee,,ffrroomm__aaddddrr,,aadd,,ffnn)) + KKTTEEXXTT aauutthheenntt;; + cchhaarr **sseerrvviiccee;; + cchhaarr **iinnssttaannccee;; + uu__lloonngg ffrroomm__aaddddrr;; + AAUUTTHH__DDAATT **aadd;; + cchhaarr **ffnn;; + + iinntt kkrrbb__kknnttoollnn((aadd,,llnnaammee)) + AAUUTTHH__DDAATT **aadd;; + cchhaarr **llnnaammee;; + + iinntt kkrrbb__sseett__kkeeyy((kkeeyy,,ccvvtt)) + cchhaarr **kkeeyy;; + iinntt ccvvtt;; + + iinntt kkrrbb__ggeett__ccrreedd((sseerrvviiccee,,iinnssttaannccee,,rreeaallmm,,cc)) + cchhaarr **sseerrvviiccee;; + cchhaarr **iinnssttaannccee;; + cchhaarr **rreeaallmm;; + CCRREEDDEENNTTIIAALLSS **cc;; + + lloonngg kkrrbb__mmkk__pprriivv((iinn,,oouutt,,iinn__lleennggtthh,,sscchheedduullee,,kkeeyy,,sseennddeerr,,rreecceeiivveerr)) + uu__cchhaarr **iinn;; + uu__cchhaarr **oouutt;; + uu__lloonngg iinn__lleennggtthh;; + ddeess__ccbblloocckk kkeeyy;; + ddeess__kkeeyy__sscchheedduullee sscchheedduullee;; + ssttrruucctt ssoocckkaaddddrr__iinn **sseennddeerr;; + ssttrruucctt ssoocckkaaddddrr__iinn **rreecceeiivveerr;; + + lloonngg kkrrbb__rrdd__pprriivv((iinn,,iinn__lleennggtthh,,sscchheedduullee,,kkeeyy,,sseennddeerr,,rreecceeiivveerr,,mmssgg__ddaattaa)) + + + +MIT Project Athena Kerberos Version 4.0 1 + + + + + + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + + uu__cchhaarr **iinn;; + uu__lloonngg iinn__lleennggtthh;; + KKeeyy__sscchheedduullee sscchheedduullee;; + ddeess__ccbblloocckk kkeeyy;; + ssttrruucctt ssoocckkaaddddrr__iinn **sseennddeerr;; + ssttrruucctt ssoocckkaaddddrr__iinn **rreecceeiivveerr;; + MMSSGG__DDAATT **mmssgg__ddaattaa;; + + lloonngg kkrrbb__mmkk__ssaaffee((iinn,,oouutt,,iinn__lleennggtthh,,kkeeyy,,sseennddeerr,,rreecceeiivveerr)) + uu__cchhaarr **iinn;; + uu__cchhaarr **oouutt;; + uu__lloonngg iinn__lleennggtthh;; + ddeess__ccbblloocckk kkeeyy;; + ssttrruucctt ssoocckkaaddddrr__iinn **sseennddeerr;; + ssttrruucctt ssoocckkaaddddrr__iinn **rreecceeiivveerr;; + + lloonngg kkrrbb__rrdd__ssaaffee((iinn,,lleennggtthh,,kkeeyy,,sseennddeerr,,rreecceeiivveerr,,mmssgg__ddaattaa)) + uu__cchhaarr **iinn;; + uu__lloonngg lleennggtthh;; + ddeess__ccbblloocckk kkeeyy;; + ssttrruucctt ssoocckkaaddddrr__iinn **sseennddeerr;; + ssttrruucctt ssoocckkaaddddrr__iinn **rreecceeiivveerr;; + MMSSGG__DDAATT **mmssgg__ddaattaa;; + + lloonngg kkrrbb__mmkk__eerrrr((oouutt,,ccooddee,,ssttrriinngg)) + uu__cchhaarr **oouutt;; + lloonngg ccooddee;; + cchhaarr **ssttrriinngg;; + + lloonngg kkrrbb__rrdd__eerrrr((iinn,,lleennggtthh,,ccooddee,,mmssgg__ddaattaa)) + uu__cchhaarr **iinn;; + uu__lloonngg lleennggtthh;; + lloonngg ccooddee;; + MMSSGG__DDAATT **mmssgg__ddaattaa;; + +DDEESSCCRRIIPPTTIIOONN + This library supports network authentication and various + related operations. The library contains many routines + beyond those described in this man page, but they are not + intended to be used directly. Instead, they are called by + the routines that are described, the authentication server + and the login program. + + _k_r_b___e_r_r___t_x_t_[_] contains text string descriptions of various + Kerberos error codes returned by some of the routines + below. + + _k_r_b___m_k___r_e_q takes a pointer to a text structure in which an + authenticator is to be built. It also takes the name, + instance, and realm of the service to be used and an + optional checksum. It is up to the application to decide + + + +MIT Project Athena Kerberos Version 4.0 2 + + + + + + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + + how to generate the checksum. _k_r_b___m_k___r_e_q then retrieves a + ticket for the desired service and creates an authentica- + tor. The authenticator is built in _a_u_t_h_e_n_t and is acces- + sible to the calling procedure. + + It is up to the application to get the authenticator to + the service where it will be read by _k_r_b___r_d___r_e_q_. Unless + an attacker possesses the session key contained in the + ticket, it will be unable to modify the authenticator. + Thus, the checksum can be used to verify the authenticity + of the other data that will pass through a connection. + + _k_r_b___r_d___r_e_q takes an authenticator of type KKTTEEXXTT,, a service + name, an instance, the address of the host originating the + request, and a pointer to a structure of type AAUUTTHH__DDAATT + which is filled in with information obtained from the + authenticator. It also optionally takes the name of the + file in which it will find the secret key(s) for the ser- + vice. If the supplied _i_n_s_t_a_n_c_e contains "*", then the + first service key with the same service name found in the + service key file will be used, and the _i_n_s_t_a_n_c_e argument + will be filled in with the chosen instance. This means + that the caller must provide space for such an instance + name. + + It is used to find out information about the principal + when a request has been made to a service. It is up to + the application protocol to get the authenticator from the + client to the service. The authenticator is then passed + to _k_r_b___r_d___r_e_q to extract the desired information. + + _k_r_b___r_d___r_e_q returns zero (RD_AP_OK) upon successful authen- + tication. If a packet was forged, modified, or replayed, + authentication will fail. If the authentication fails, a + non-zero value is returned indicating the particular prob- + lem encountered. See _k_r_b_._h for the list of error codes. + + If the last argument is the null string (""), krb_rd_req + will use the file /etc/srvtab to find its keys. If the + last argument is NULL, it will assume that the key has + been set by _k_r_b___s_e_t___k_e_y and will not bother looking fur- + ther. + + _k_r_b___k_n_t_o_l_n converts a Kerberos name to a local name. It + takes a structure of type AUTH_DAT and uses the name and + instance to look in the database /etc/aname to find the + corresponding local name. The local name is returned and + can be used by an application to change uids, directories, + or other parameters. It is not an integral part of Ker- + beros, but is instead provided to support the use of Ker- + beros in existing utilities. + + + +MIT Project Athena Kerberos Version 4.0 3 + + + + + + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + + _k_r_b___s_e_t___k_e_y takes as an argument a des key. It then cre- + ates a key schedule from it and saves the original key to + be used as an initialization vector. It is used to set + the server's key which must be used to decrypt tickets. + + If called with a non-zero second argument, _k_r_b___s_e_t___k_e_y + will first convert the input from a string of arbitrary + length to a DES key by encrypting it with a one-way func- + tion. + + In most cases it should not be necessary to call + _k_r_b___s_e_t___k_e_y_. The necessary keys will usually be obtained + and set inside _k_r_b___r_d___r_e_q_. _k_r_b___s_e_t___k_e_y is provided for + those applications that do not wish to place the applica- + tion keys on disk. + + _k_r_b___g_e_t___c_r_e_d searches the caller's ticket file for a + ticket for the given service, instance, and realm; and, if + a ticket is found, fills in the given CREDENTIALS struc- + ture with the ticket information. + + If the ticket was found, _k_r_b___g_e_t___c_r_e_d returns GC_OK. If + the ticket file can't be found, can't be read, doesn't + belong to the user (other than root), isn't a regular + file, or is in the wrong mode, the error GC_TKFIL is + returned. + + _k_r_b___m_k___p_r_i_v creates an encrypted, authenticated message + from any arbitrary application data, pointed to by _i_n and + _i_n___l_e_n_g_t_h bytes long. The private session key, pointed to + by _k_e_y and the key schedule, _s_c_h_e_d_u_l_e_, are used to encrypt + the data and some header information using _p_c_b_c___e_n_c_r_y_p_t_. + _s_e_n_d_e_r and _r_e_c_e_i_v_e_r point to the Internet address of the + two parties. In addition to providing privacy, this pro- + tocol message protects against modifications, insertions + or replays. The encapsulated message and header are + placed in the area pointed to by _o_u_t and the routine + returns the length of the output, or -1 indicating an + error. + + _k_r_b___r_d___p_r_i_v decrypts and authenticates a received + _k_r_b___m_k___p_r_i_v message. _i_n points to the beginning of the + received message, whose length is specified in _i_n___l_e_n_g_t_h_. + The private session key, pointed to by _k_e_y_, and the key + schedule, _s_c_h_e_d_u_l_e_, are used to decrypt and verify the + received message. _m_s_g___d_a_t_a is a pointer to a _M_S_G___D_A_T + struct, defined in _k_r_b_._h_. The routine fills in the + _a_p_p___d_a_t_a field with a pointer to the decrypted application + data, _a_p_p___l_e_n_g_t_h with the length of the _a_p_p___d_a_t_a field, + _t_i_m_e___s_e_c and _t_i_m_e___5_m_s with the timestamps in the message, + and _s_w_a_p with a 1 if the byte order of the receiver is + + + +MIT Project Athena Kerberos Version 4.0 4 + + + + + + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + + different than that of the sender. (The application must + still determine if it is appropriate to byte-swap applica- + tion data; the Kerberos protocol fields are already taken + care of). The _h_a_s_h field returns a value useful as input + to the _k_r_b___c_k___r_e_p_l routine. + + The routine returns zero if ok, or a Kerberos error code. + Modified messages and old messages cause errors, but it is + up to the caller to check the time sequence of messages, + and to check against recently replayed messages using + _k_r_b___c_k___r_e_p_l if so desired. + + _k_r_b___m_k___s_a_f_e creates an authenticated, but unencrypted mes- + sage from any arbitrary application data, pointed to by _i_n + and _i_n___l_e_n_g_t_h bytes long. The private session key, + pointed to by _k_e_y_, is used to seed the _q_u_a_d___c_k_s_u_m_(_) check- + sum algorithm used as part of the authentication. _s_e_n_d_e_r + and _r_e_c_e_i_v_e_r point to the Internet address of the two par- + ties. This message does not provide privacy, but does + protect (via detection) against modifications, insertions + or replays. The encapsulated message and header are + placed in the area pointed to by _o_u_t and the routine + returns the length of the output, or -1 indicating an + error. The authentication provided by this routine is not + as strong as that provided by _k_r_b___m_k___p_r_i_v or by computing + the checksum using _c_b_c___c_k_s_u_m instead, both of which + authenticate via DES. + + + _k_r_b___r_d___s_a_f_e authenticates a received _k_r_b___m_k___s_a_f_e message. + _i_n points to the beginning of the received message, whose + length is specified in _i_n___l_e_n_g_t_h_. The private session + key, pointed to by _k_e_y_, is used to seed the quad_cksum() + routine as part of the authentication. _m_s_g___d_a_t_a is a + pointer to a _M_S_G___D_A_T struct, defined in _k_r_b_._h _. The rou- + tine fills in these _M_S_G___D_A_T fields: the _a_p_p___d_a_t_a field + with a pointer to the application data, _a_p_p___l_e_n_g_t_h with + the length of the _a_p_p___d_a_t_a field, _t_i_m_e___s_e_c and _t_i_m_e___5_m_s + with the timestamps in the message, and _s_w_a_p with a 1 if + the byte order of the receiver is different than that of + the sender. (The application must still determine if it + is appropriate to byte-swap application data; the Kerberos + protocol fields are already taken care of). The _h_a_s_h + field returns a value useful as input to the _k_r_b___c_k___r_e_p_l + routine. + + The routine returns zero if ok, or a Kerberos error code. + Modified messages and old messages cause errors, but it is + up to the caller to check the time sequence of messages, + and to check against recently replayed messages using + _k_r_b___c_k___r_e_p_l if so desired. + + + +MIT Project Athena Kerberos Version 4.0 5 + + + + + + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + + _k_r_b___m_k___e_r_r constructs an application level error message + that may be used along with _k_r_b___m_k___p_r_i_v or _k_r_b___m_k___s_a_f_e_. + _o_u_t is a pointer to the output buffer, _c_o_d_e is an applica- + tion specific error code, and _s_t_r_i_n_g is an application + specific error string. + + + _k_r_b___r_d___e_r_r unpacks a received _k_r_b___m_k___e_r_r message. _i_n + points to the beginning of the received message, whose + length is specified in _i_n___l_e_n_g_t_h_. _c_o_d_e is a pointer to a + value to be filled in with the error value provided by the + application. _m_s_g___d_a_t_a is a pointer to a _M_S_G___D_A_T struct, + defined in _k_r_b_._h _. The routine fills in these _M_S_G___D_A_T + fields: the _a_p_p___d_a_t_a field with a pointer to the applica- + tion error text, _a_p_p___l_e_n_g_t_h with the length of the + _a_p_p___d_a_t_a field, and _s_w_a_p with a 1 if the byte order of the + receiver is different than that of the sender. (The + application must still determine if it is appropriate to + byte-swap application data; the Kerberos protocol fields + are already taken care of). + + The routine returns zero if the error message has been + successfully received, or a Kerberos error code. + + The _K_T_E_X_T structure is used to pass around text of varying + lengths. It consists of a buffer for the data, and a + length. krb_rd_req takes an argument of this type con- + taining the authenticator, and krb_mk_req returns the + authenticator in a structure of this type. KTEXT itself + is really a pointer to the structure. The actual struc- + ture is of type KTEXT_ST. + + The _A_U_T_H___D_A_T structure is filled in by krb_rd_req. It + must be allocated before calling krb_rd_req, and a pointer + to it is passed. The structure is filled in with data + obtained from Kerberos. _M_S_G___D_A_T structure is filled in by + either krb_rd_priv, krb_rd_safe, or krb_rd_err. It must + be allocated before the call and a pointer to it is + passed. The structure is filled in with data obtained + from Kerberos. + + +FFIILLEESS + /usr/include/kerberosIV/krb.h + /usr/lib/libkrb.a + /usr/include/kerberosIV/des.h + /usr/lib/libdes.a + /etc/kerberosIV/aname + /etc/kerberosIV/srvtab + /tmp/tkt[uid] + + + + +MIT Project Athena Kerberos Version 4.0 6 + + + + + + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + +SSEEEE AALLSSOO + kerberos(1), des_crypt(3) + +DDIIAAGGNNOOSSTTIICCSS +BBUUGGSS + The caller of _k_r_b___r_d___r_e_q_, _k_r_b___r_d___p_r_i_v_, _a_n_d _k_r_b___r_d___s_a_f_e + must check time order and for replay attempts. + _k_r_b___c_k___r_e_p_l is not implemented yet. + +AAUUTTHHOORRSS + Clifford Neuman, MIT Project Athena + Steve Miller, MIT Project Athena/Digital Equipment Corpo- + ration + +RREESSTTRRIICCTTIIOONNSS + COPYRIGHT 1985,1986,1989 Massachusetts Institute of Tech- + nology + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +MIT Project Athena Kerberos Version 4.0 7 + + + + + diff --git a/usr/share/man/cat3/krb_rd_safe.0 b/usr/share/man/cat3/krb_rd_safe.0 new file mode 100644 index 0000000000..ac1157fbda --- /dev/null +++ b/usr/share/man/cat3/krb_rd_safe.0 @@ -0,0 +1,462 @@ + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + +NNAAMMEE + krb_mk_req, krb_rd_req, krb_kntoln, krb_set_key, + krb_get_cred, krb_mk_priv, krb_rd_priv, krb_mk_safe, + krb_rd_safe, krb_mk_err, krb_rd_err, krb_ck_repl - Ker- + beros authentication library + +SSYYNNOOPPSSIISS + ##iinncclluuddee <> + ##iinncclluuddee <> + + eexxtteerrnn cchhaarr **kkrrbb__eerrrr__ttxxtt[[]];; + + iinntt kkrrbb__mmkk__rreeqq((aauutthheenntt,,sseerrvviiccee,,iinnssttaannccee,,rreeaallmm,,cchheecckkssuumm)) + KKTTEEXXTT aauutthheenntt;; + cchhaarr **sseerrvviiccee;; + cchhaarr **iinnssttaannccee;; + cchhaarr **rreeaallmm;; + uu__lloonngg cchheecckkssuumm;; + + iinntt kkrrbb__rrdd__rreeqq((aauutthheenntt,,sseerrvviiccee,,iinnssttaannccee,,ffrroomm__aaddddrr,,aadd,,ffnn)) + KKTTEEXXTT aauutthheenntt;; + cchhaarr **sseerrvviiccee;; + cchhaarr **iinnssttaannccee;; + uu__lloonngg ffrroomm__aaddddrr;; + AAUUTTHH__DDAATT **aadd;; + cchhaarr **ffnn;; + + iinntt kkrrbb__kknnttoollnn((aadd,,llnnaammee)) + AAUUTTHH__DDAATT **aadd;; + cchhaarr **llnnaammee;; + + iinntt kkrrbb__sseett__kkeeyy((kkeeyy,,ccvvtt)) + cchhaarr **kkeeyy;; + iinntt ccvvtt;; + + iinntt kkrrbb__ggeett__ccrreedd((sseerrvviiccee,,iinnssttaannccee,,rreeaallmm,,cc)) + cchhaarr **sseerrvviiccee;; + cchhaarr **iinnssttaannccee;; + cchhaarr **rreeaallmm;; + CCRREEDDEENNTTIIAALLSS **cc;; + + lloonngg kkrrbb__mmkk__pprriivv((iinn,,oouutt,,iinn__lleennggtthh,,sscchheedduullee,,kkeeyy,,sseennddeerr,,rreecceeiivveerr)) + uu__cchhaarr **iinn;; + uu__cchhaarr **oouutt;; + uu__lloonngg iinn__lleennggtthh;; + ddeess__ccbblloocckk kkeeyy;; + ddeess__kkeeyy__sscchheedduullee sscchheedduullee;; + ssttrruucctt ssoocckkaaddddrr__iinn **sseennddeerr;; + ssttrruucctt ssoocckkaaddddrr__iinn **rreecceeiivveerr;; + + lloonngg kkrrbb__rrdd__pprriivv((iinn,,iinn__lleennggtthh,,sscchheedduullee,,kkeeyy,,sseennddeerr,,rreecceeiivveerr,,mmssgg__ddaattaa)) + + + +MIT Project Athena Kerberos Version 4.0 1 + + + + + + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + + uu__cchhaarr **iinn;; + uu__lloonngg iinn__lleennggtthh;; + KKeeyy__sscchheedduullee sscchheedduullee;; + ddeess__ccbblloocckk kkeeyy;; + ssttrruucctt ssoocckkaaddddrr__iinn **sseennddeerr;; + ssttrruucctt ssoocckkaaddddrr__iinn **rreecceeiivveerr;; + MMSSGG__DDAATT **mmssgg__ddaattaa;; + + lloonngg kkrrbb__mmkk__ssaaffee((iinn,,oouutt,,iinn__lleennggtthh,,kkeeyy,,sseennddeerr,,rreecceeiivveerr)) + uu__cchhaarr **iinn;; + uu__cchhaarr **oouutt;; + uu__lloonngg iinn__lleennggtthh;; + ddeess__ccbblloocckk kkeeyy;; + ssttrruucctt ssoocckkaaddddrr__iinn **sseennddeerr;; + ssttrruucctt ssoocckkaaddddrr__iinn **rreecceeiivveerr;; + + lloonngg kkrrbb__rrdd__ssaaffee((iinn,,lleennggtthh,,kkeeyy,,sseennddeerr,,rreecceeiivveerr,,mmssgg__ddaattaa)) + uu__cchhaarr **iinn;; + uu__lloonngg lleennggtthh;; + ddeess__ccbblloocckk kkeeyy;; + ssttrruucctt ssoocckkaaddddrr__iinn **sseennddeerr;; + ssttrruucctt ssoocckkaaddddrr__iinn **rreecceeiivveerr;; + MMSSGG__DDAATT **mmssgg__ddaattaa;; + + lloonngg kkrrbb__mmkk__eerrrr((oouutt,,ccooddee,,ssttrriinngg)) + uu__cchhaarr **oouutt;; + lloonngg ccooddee;; + cchhaarr **ssttrriinngg;; + + lloonngg kkrrbb__rrdd__eerrrr((iinn,,lleennggtthh,,ccooddee,,mmssgg__ddaattaa)) + uu__cchhaarr **iinn;; + uu__lloonngg lleennggtthh;; + lloonngg ccooddee;; + MMSSGG__DDAATT **mmssgg__ddaattaa;; + +DDEESSCCRRIIPPTTIIOONN + This library supports network authentication and various + related operations. The library contains many routines + beyond those described in this man page, but they are not + intended to be used directly. Instead, they are called by + the routines that are described, the authentication server + and the login program. + + _k_r_b___e_r_r___t_x_t_[_] contains text string descriptions of various + Kerberos error codes returned by some of the routines + below. + + _k_r_b___m_k___r_e_q takes a pointer to a text structure in which an + authenticator is to be built. It also takes the name, + instance, and realm of the service to be used and an + optional checksum. It is up to the application to decide + + + +MIT Project Athena Kerberos Version 4.0 2 + + + + + + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + + how to generate the checksum. _k_r_b___m_k___r_e_q then retrieves a + ticket for the desired service and creates an authentica- + tor. The authenticator is built in _a_u_t_h_e_n_t and is acces- + sible to the calling procedure. + + It is up to the application to get the authenticator to + the service where it will be read by _k_r_b___r_d___r_e_q_. Unless + an attacker possesses the session key contained in the + ticket, it will be unable to modify the authenticator. + Thus, the checksum can be used to verify the authenticity + of the other data that will pass through a connection. + + _k_r_b___r_d___r_e_q takes an authenticator of type KKTTEEXXTT,, a service + name, an instance, the address of the host originating the + request, and a pointer to a structure of type AAUUTTHH__DDAATT + which is filled in with information obtained from the + authenticator. It also optionally takes the name of the + file in which it will find the secret key(s) for the ser- + vice. If the supplied _i_n_s_t_a_n_c_e contains "*", then the + first service key with the same service name found in the + service key file will be used, and the _i_n_s_t_a_n_c_e argument + will be filled in with the chosen instance. This means + that the caller must provide space for such an instance + name. + + It is used to find out information about the principal + when a request has been made to a service. It is up to + the application protocol to get the authenticator from the + client to the service. The authenticator is then passed + to _k_r_b___r_d___r_e_q to extract the desired information. + + _k_r_b___r_d___r_e_q returns zero (RD_AP_OK) upon successful authen- + tication. If a packet was forged, modified, or replayed, + authentication will fail. If the authentication fails, a + non-zero value is returned indicating the particular prob- + lem encountered. See _k_r_b_._h for the list of error codes. + + If the last argument is the null string (""), krb_rd_req + will use the file /etc/srvtab to find its keys. If the + last argument is NULL, it will assume that the key has + been set by _k_r_b___s_e_t___k_e_y and will not bother looking fur- + ther. + + _k_r_b___k_n_t_o_l_n converts a Kerberos name to a local name. It + takes a structure of type AUTH_DAT and uses the name and + instance to look in the database /etc/aname to find the + corresponding local name. The local name is returned and + can be used by an application to change uids, directories, + or other parameters. It is not an integral part of Ker- + beros, but is instead provided to support the use of Ker- + beros in existing utilities. + + + +MIT Project Athena Kerberos Version 4.0 3 + + + + + + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + + _k_r_b___s_e_t___k_e_y takes as an argument a des key. It then cre- + ates a key schedule from it and saves the original key to + be used as an initialization vector. It is used to set + the server's key which must be used to decrypt tickets. + + If called with a non-zero second argument, _k_r_b___s_e_t___k_e_y + will first convert the input from a string of arbitrary + length to a DES key by encrypting it with a one-way func- + tion. + + In most cases it should not be necessary to call + _k_r_b___s_e_t___k_e_y_. The necessary keys will usually be obtained + and set inside _k_r_b___r_d___r_e_q_. _k_r_b___s_e_t___k_e_y is provided for + those applications that do not wish to place the applica- + tion keys on disk. + + _k_r_b___g_e_t___c_r_e_d searches the caller's ticket file for a + ticket for the given service, instance, and realm; and, if + a ticket is found, fills in the given CREDENTIALS struc- + ture with the ticket information. + + If the ticket was found, _k_r_b___g_e_t___c_r_e_d returns GC_OK. If + the ticket file can't be found, can't be read, doesn't + belong to the user (other than root), isn't a regular + file, or is in the wrong mode, the error GC_TKFIL is + returned. + + _k_r_b___m_k___p_r_i_v creates an encrypted, authenticated message + from any arbitrary application data, pointed to by _i_n and + _i_n___l_e_n_g_t_h bytes long. The private session key, pointed to + by _k_e_y and the key schedule, _s_c_h_e_d_u_l_e_, are used to encrypt + the data and some header information using _p_c_b_c___e_n_c_r_y_p_t_. + _s_e_n_d_e_r and _r_e_c_e_i_v_e_r point to the Internet address of the + two parties. In addition to providing privacy, this pro- + tocol message protects against modifications, insertions + or replays. The encapsulated message and header are + placed in the area pointed to by _o_u_t and the routine + returns the length of the output, or -1 indicating an + error. + + _k_r_b___r_d___p_r_i_v decrypts and authenticates a received + _k_r_b___m_k___p_r_i_v message. _i_n points to the beginning of the + received message, whose length is specified in _i_n___l_e_n_g_t_h_. + The private session key, pointed to by _k_e_y_, and the key + schedule, _s_c_h_e_d_u_l_e_, are used to decrypt and verify the + received message. _m_s_g___d_a_t_a is a pointer to a _M_S_G___D_A_T + struct, defined in _k_r_b_._h_. The routine fills in the + _a_p_p___d_a_t_a field with a pointer to the decrypted application + data, _a_p_p___l_e_n_g_t_h with the length of the _a_p_p___d_a_t_a field, + _t_i_m_e___s_e_c and _t_i_m_e___5_m_s with the timestamps in the message, + and _s_w_a_p with a 1 if the byte order of the receiver is + + + +MIT Project Athena Kerberos Version 4.0 4 + + + + + + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + + different than that of the sender. (The application must + still determine if it is appropriate to byte-swap applica- + tion data; the Kerberos protocol fields are already taken + care of). The _h_a_s_h field returns a value useful as input + to the _k_r_b___c_k___r_e_p_l routine. + + The routine returns zero if ok, or a Kerberos error code. + Modified messages and old messages cause errors, but it is + up to the caller to check the time sequence of messages, + and to check against recently replayed messages using + _k_r_b___c_k___r_e_p_l if so desired. + + _k_r_b___m_k___s_a_f_e creates an authenticated, but unencrypted mes- + sage from any arbitrary application data, pointed to by _i_n + and _i_n___l_e_n_g_t_h bytes long. The private session key, + pointed to by _k_e_y_, is used to seed the _q_u_a_d___c_k_s_u_m_(_) check- + sum algorithm used as part of the authentication. _s_e_n_d_e_r + and _r_e_c_e_i_v_e_r point to the Internet address of the two par- + ties. This message does not provide privacy, but does + protect (via detection) against modifications, insertions + or replays. The encapsulated message and header are + placed in the area pointed to by _o_u_t and the routine + returns the length of the output, or -1 indicating an + error. The authentication provided by this routine is not + as strong as that provided by _k_r_b___m_k___p_r_i_v or by computing + the checksum using _c_b_c___c_k_s_u_m instead, both of which + authenticate via DES. + + + _k_r_b___r_d___s_a_f_e authenticates a received _k_r_b___m_k___s_a_f_e message. + _i_n points to the beginning of the received message, whose + length is specified in _i_n___l_e_n_g_t_h_. The private session + key, pointed to by _k_e_y_, is used to seed the quad_cksum() + routine as part of the authentication. _m_s_g___d_a_t_a is a + pointer to a _M_S_G___D_A_T struct, defined in _k_r_b_._h _. The rou- + tine fills in these _M_S_G___D_A_T fields: the _a_p_p___d_a_t_a field + with a pointer to the application data, _a_p_p___l_e_n_g_t_h with + the length of the _a_p_p___d_a_t_a field, _t_i_m_e___s_e_c and _t_i_m_e___5_m_s + with the timestamps in the message, and _s_w_a_p with a 1 if + the byte order of the receiver is different than that of + the sender. (The application must still determine if it + is appropriate to byte-swap application data; the Kerberos + protocol fields are already taken care of). The _h_a_s_h + field returns a value useful as input to the _k_r_b___c_k___r_e_p_l + routine. + + The routine returns zero if ok, or a Kerberos error code. + Modified messages and old messages cause errors, but it is + up to the caller to check the time sequence of messages, + and to check against recently replayed messages using + _k_r_b___c_k___r_e_p_l if so desired. + + + +MIT Project Athena Kerberos Version 4.0 5 + + + + + + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + + _k_r_b___m_k___e_r_r constructs an application level error message + that may be used along with _k_r_b___m_k___p_r_i_v or _k_r_b___m_k___s_a_f_e_. + _o_u_t is a pointer to the output buffer, _c_o_d_e is an applica- + tion specific error code, and _s_t_r_i_n_g is an application + specific error string. + + + _k_r_b___r_d___e_r_r unpacks a received _k_r_b___m_k___e_r_r message. _i_n + points to the beginning of the received message, whose + length is specified in _i_n___l_e_n_g_t_h_. _c_o_d_e is a pointer to a + value to be filled in with the error value provided by the + application. _m_s_g___d_a_t_a is a pointer to a _M_S_G___D_A_T struct, + defined in _k_r_b_._h _. The routine fills in these _M_S_G___D_A_T + fields: the _a_p_p___d_a_t_a field with a pointer to the applica- + tion error text, _a_p_p___l_e_n_g_t_h with the length of the + _a_p_p___d_a_t_a field, and _s_w_a_p with a 1 if the byte order of the + receiver is different than that of the sender. (The + application must still determine if it is appropriate to + byte-swap application data; the Kerberos protocol fields + are already taken care of). + + The routine returns zero if the error message has been + successfully received, or a Kerberos error code. + + The _K_T_E_X_T structure is used to pass around text of varying + lengths. It consists of a buffer for the data, and a + length. krb_rd_req takes an argument of this type con- + taining the authenticator, and krb_mk_req returns the + authenticator in a structure of this type. KTEXT itself + is really a pointer to the structure. The actual struc- + ture is of type KTEXT_ST. + + The _A_U_T_H___D_A_T structure is filled in by krb_rd_req. It + must be allocated before calling krb_rd_req, and a pointer + to it is passed. The structure is filled in with data + obtained from Kerberos. _M_S_G___D_A_T structure is filled in by + either krb_rd_priv, krb_rd_safe, or krb_rd_err. It must + be allocated before the call and a pointer to it is + passed. The structure is filled in with data obtained + from Kerberos. + + +FFIILLEESS + /usr/include/kerberosIV/krb.h + /usr/lib/libkrb.a + /usr/include/kerberosIV/des.h + /usr/lib/libdes.a + /etc/kerberosIV/aname + /etc/kerberosIV/srvtab + /tmp/tkt[uid] + + + + +MIT Project Athena Kerberos Version 4.0 6 + + + + + + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + +SSEEEE AALLSSOO + kerberos(1), des_crypt(3) + +DDIIAAGGNNOOSSTTIICCSS +BBUUGGSS + The caller of _k_r_b___r_d___r_e_q_, _k_r_b___r_d___p_r_i_v_, _a_n_d _k_r_b___r_d___s_a_f_e + must check time order and for replay attempts. + _k_r_b___c_k___r_e_p_l is not implemented yet. + +AAUUTTHHOORRSS + Clifford Neuman, MIT Project Athena + Steve Miller, MIT Project Athena/Digital Equipment Corpo- + ration + +RREESSTTRRIICCTTIIOONNSS + COPYRIGHT 1985,1986,1989 Massachusetts Institute of Tech- + nology + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +MIT Project Athena Kerberos Version 4.0 7 + + + + + diff --git a/usr/share/man/cat3/krb_realmofhost.0 b/usr/share/man/cat3/krb_realmofhost.0 new file mode 100644 index 0000000000..901419e5e6 --- /dev/null +++ b/usr/share/man/cat3/krb_realmofhost.0 @@ -0,0 +1,198 @@ + + + +KRB_REALMOFHOST(3) BSD Programmer's Manual KRB_REALMOFHOST(3) + + +NNAAMMEE + krb_realmofhost, krb_get_phost, krb_get_krbhst, + krb_get_admhst, krb_get_lrealm - additional Kerberos util- + ity routines + +SSYYNNOOPPSSIISS + ##iinncclluuddee <> + ##iinncclluuddee <> + ##iinncclluuddee <> + + cchhaarr **kkrrbb__rreeaallmmooffhhoosstt((hhoosstt)) + cchhaarr **hhoosstt;; + + cchhaarr **kkrrbb__ggeett__pphhoosstt((aalliiaass)) + cchhaarr **aalliiaass;; + + kkrrbb__ggeett__kkrrbbhhsstt((hhoosstt,,rreeaallmm,,nn)) + cchhaarr **hhoosstt;; + cchhaarr **rreeaallmm;; + iinntt nn;; + + kkrrbb__ggeett__aaddmmhhsstt((hhoosstt,,rreeaallmm,,nn)) + cchhaarr **hhoosstt;; + cchhaarr **rreeaallmm;; + iinntt nn;; + + kkrrbb__ggeett__llrreeaallmm((rreeaallmm,,nn)) + cchhaarr **rreeaallmm;; + iinntt nn;; + +DDEESSCCRRIIPPTTIIOONN + _k_r_b___r_e_a_l_m_o_f_h_o_s_t returns the Kerberos realm of the host + _h_o_s_t, as determined by the translation table + _/_e_t_c_/_k_e_r_b_e_r_o_s_I_V_/_k_r_b_._r_e_a_l_m_s. _h_o_s_t should be the fully- + qualified domain-style primary host name of the host in + question. In order to prevent certain security attacks, + this routine must either have _a _p_r_i_o_r_i knowledge of a + host's realm, or obtain such information securely. + + The format of the translation file is described by + _k_r_b_._r_e_a_l_m_s(5). If _h_o_s_t exactly matches a host_name line, + the corresponding realm is returned. Otherwise, if the + domain portion of _h_o_s_t matches a domain_name line, the + corresponding realm is returned. If _h_o_s_t contains a + domain, but no translation is found, _h_o_s_t's domain is con- + verted to upper-case and returned. If _h_o_s_t contains no + discernible domain, or an error occurs, the local realm + name, as supplied by _k_r_b___g_e_t___l_r_e_a_l_m(3), is returned. + + _k_r_b___g_e_t___p_h_o_s_t converts the hostname _a_l_i_a_s (which can be + either an official name or an alias) into the instance + + + +MIT Project Athena Kerberos Version 4.0 1 + + + + + + + + +KRB_REALMOFHOST(3) BSD Programmer's Manual KRB_REALMOFHOST(3) + + + name to be used in obtaining Kerberos tickets for most + services, including the Berkeley rcmd suite (rlogin, rcp, + rsh). + The current convention is to return the first segment of + the official domain-style name after conversion to lower + case. + + _k_r_b___g_e_t___k_r_b_h_s_t fills in _h_o_s_t with the hostname of the _nth + host running a Kerberos key distribution center (KDC) for + realm _r_e_a_l_m, as specified in the configuration file + (_/_e_t_c_/_k_e_r_b_e_r_o_s_I_V_/_k_r_b_._c_o_n_f). The configuration file is + described by _k_r_b_._c_o_n_f(5). If the host is successfully + filled in, the routine returns KSUCCESS. If the file can- + not be opened, and _n equals 1, then the value of KRB_HOST + as defined in _<_k_r_b_._h_> is filled in, and KSUCCESS is + returned. If there are fewer than _n hosts running a Ker- + beros KDC for the requested realm, or the configuration + file is malformed, the routine returns KFAILURE. + + _k_r_b___g_e_t___a_d_m_h_s_t fills in _h_o_s_t with the hostname of the _nth + host running a Kerberos KDC database administration server + for realm _r_e_a_l_m, as specified in the configuration file + (_/_e_t_c_/_k_e_r_b_e_r_o_s_I_V_/_k_r_b_._c_o_n_f). If the file cannot be opened + or is malformed, or there are fewer than _n hosts running a + Kerberos KDC database administration server, the routine + returns KFAILURE. + + The character arrays used as return values for + _k_r_b___g_e_t___k_r_b_h_s_t, _k_r_b___g_e_t___a_d_m_h_s_t, should be large enough to + hold any hostname (MAXHOSTNAMELEN from ). + + _k_r_b___g_e_t___l_r_e_a_l_m fills in _r_e_a_l_m with the _nth realm of the + local host, as specified in the configuration file. _r_e_a_l_m + should be at least REALM_SZ (from _<_k_r_b_._h_>_)characters_l_o_n_g_. + + +SSEEEE AALLSSOO + kerberos(3), krb.conf(5), krb.realms(5) + +FFIILLEESS + /etc/kerberosIV/krb.realms + translation file for host-to-realm + mapping. + + /etc/kerberosIV/krb.conf + local realm-name and realm/server con- + figuration file. + +BBUUGGSS + The current convention for instance names is too limited; + the full domain name should be used. + + + +MIT Project Athena Kerberos Version 4.0 2 + + + + + + + + +KRB_REALMOFHOST(3) BSD Programmer's Manual KRB_REALMOFHOST(3) + + + _k_r_b___g_e_t___l_r_e_a_l_m currently only supports _n = 1. It should + really consult the user's ticket cache to determine the + user's current realm, rather than consulting a file on the + host. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +MIT Project Athena Kerberos Version 4.0 3 + + + + + diff --git a/usr/share/man/cat3/krb_sendauth.0 b/usr/share/man/cat3/krb_sendauth.0 new file mode 100644 index 0000000000..881666b67e --- /dev/null +++ b/usr/share/man/cat3/krb_sendauth.0 @@ -0,0 +1,264 @@ + + + +KRB_SENDAUTH(3) BSD Programmer's Manual KRB_SENDAUTH(3) + + +NNAAMMEE + krb_sendauth, krb_recvauth, krb_net_write, krb_net_read - + Kerberos routines for sending authentication via network + stream sockets + +SSYYNNOOPPSSIISS + ##iinncclluuddee <> + ##iinncclluuddee <> + ##iinncclluuddee <> + + + iinntt kkrrbb__sseennddaauutthh((ooppttiioonnss,, ffdd,, kktteexxtt,, sseerrvviiccee,, iinnsstt,, rreeaallmm,, + cchheecckkssuumm,, mmssgg__ddaattaa,, ccrreedd,, sscchheedduullee,, llaaddddrr,, + ffaaddddrr,, vveerrssiioonn)) + lloonngg ooppttiioonnss;; + iinntt ffdd;; + KKTTEEXXTT kktteexxtt;; + cchhaarr **sseerrvviiccee,, **iinnsstt,, **rreeaallmm;; + uu__lloonngg cchheecckkssuumm;; + MMSSGG__DDAATT **mmssgg__ddaattaa;; + CCRREEDDEENNTTIIAALLSS **ccrreedd;; + KKeeyy__sscchheedduullee sscchheedduullee;; + ssttrruucctt ssoocckkaaddddrr__iinn **llaaddddrr,, **ffaaddddrr;; + cchhaarr **vveerrssiioonn;; + + + iinntt kkrrbb__rreeccvvaauutthh((ooppttiioonnss,, ffdd,, kktteexxtt,, sseerrvviiccee,, iinnsstt,, ffaaddddrr,, + llaaddddrr,, aauutthh__ddaattaa,, ffiilleennaammee,, sscchheedduullee,, vveerrssiioonn)) + lloonngg ooppttiioonnss;; + iinntt ffdd;; + KKTTEEXXTT kktteexxtt;; + cchhaarr **sseerrvviiccee,, **iinnsstt;; + ssttrruucctt ssoocckkaaddddrr__iinn **ffaaddddrr,, **llaaddddrr;; + AAUUTTHH__DDAATT **aauutthh__ddaattaa;; + cchhaarr **ffiilleennaammee;; + KKeeyy__sscchheedduullee sscchheedduullee;; + cchhaarr **vveerrssiioonn;; + + iinntt kkrrbb__nneett__wwrriittee((ffdd,, bbuuff,, lleenn)) + iinntt ffdd;; + cchhaarr **bbuuff;; + iinntt lleenn;; + + iinntt kkrrbb__nneett__rreeaadd((ffdd,, bbuuff,, lleenn)) + iinntt ffdd;; + cchhaarr **bbuuff;; + iinntt lleenn;; + +DDEESSCCRRIIPPTTIIOONN + These functions, which are built on top of the core Ker- + beros library, provide a convenient means for client and + + + +MIT Project Athena Kerberos Version 4.0 1 + + + + + + + + +KRB_SENDAUTH(3) BSD Programmer's Manual KRB_SENDAUTH(3) + + + server programs to send authentication messages to one + another through network connections. The _k_r_b___s_e_n_d_a_u_t_h + function sends an authenticated ticket from the client + program to the server program by writing the ticket to a + network socket. The _k_r_b___r_e_c_v_a_u_t_h function receives the + ticket from the client by reading from a network socket. + + +KKRRBB__SSEENNDDAAUUTTHH + This function writes the ticket to the network socket + specified by the file descriptor _f_d_, returning KSUCCESS if + the write proceeds successfully, and an error code if it + does not. + + The _k_t_e_x_t argument should point to an allocated KTEXT_ST + structure. The _s_e_r_v_i_c_e_, _i_n_s_t_, and _r_e_a_l_m arguments specify + the server program's Kerberos principal name, instance, + and realm. If you are writing a client that uses the + local realm exclusively, you can set the _r_e_a_l_m argument to + NULL. + + The _v_e_r_s_i_o_n argument allows the client program to pass an + application-specific version string that the server pro- + gram can then match against its own version string. The + _v_e_r_s_i_o_n string can be up to KSEND_VNO_LEN (see _<_k_r_b_._h_>) + characters in length. + + The _c_h_e_c_k_s_u_m argument can be used to pass checksum infor- + mation to the server program. The client program is + responsible for specifying this information. This check- + sum information is difficult to corrupt because + _k_r_b___s_e_n_d_a_u_t_h passes it over the network in encrypted form. + The _c_h_e_c_k_s_u_m argument is passed as the checksum argument + to _k_r_b___m_k___r_e_q. + + You can set _k_r_b___s_e_n_d_a_u_t_h_'_s other arguments to NULL unless + you want the client and server programs to mutually + authenticate themselves. In the case of mutual authenti- + cation, the client authenticates itself to the server pro- + gram, and demands that the server in turn authenticate + itself to the client. + + +KKRRBB__SSEENNDDAAUUTTHH AANNDD MMUUTTUUAALL AAUUTTHHEENNTTIICCAATTIIOONN + If you want mutual authentication, make sure that you read + all pending data from the local socket before calling + _k_r_b___s_e_n_d_a_u_t_h_. Set _k_r_b___s_e_n_d_a_u_t_h_'_s _o_p_t_i_o_n_s argument to + KKOOPPTT__DDOO__MMUUTTUUAALL (this macro is defined in the _k_r_b_._h file); + make sure that the _l_a_d_d_r argument points to the address of + the local socket, and that _f_a_d_d_r points to the foreign + socket's network address. + + + +MIT Project Athena Kerberos Version 4.0 2 + + + + + + + + +KRB_SENDAUTH(3) BSD Programmer's Manual KRB_SENDAUTH(3) + + + _K_r_b___s_e_n_d_a_u_t_h fills in the other arguments-- _m_s_g___d_a_t_a, + _c_r_e_d, and _s_c_h_e_d_u_l_e--before sending the ticket to the + server program. You must, however, allocate space for + these arguments before calling the function. + + _K_r_b___s_e_n_d_a_u_t_h supports two other options: KKOOPPTT__DDOONNTT__MMKK__RREEQQ,, + and KKOOPPTT__DDOONNTT__CCAANNOONN.. If called with _o_p_t_i_o_n_s set as + KOPT_DONT_MK_REQ, _k_r_b___s_e_n_d_a_u_t_h will not use the _k_r_b___m_k___r_e_q + function to retrieve the ticket from the Kerberos server. + The _k_t_e_x_t argument must point to an existing ticket and + authenticator (such as would be created by _k_r_b___m_k___r_e_q), + and the _s_e_r_v_i_c_e_, _i_n_s_t_, and _r_e_a_l_m arguments can be set to + NULL. + + If called with _o_p_t_i_o_n_s set as KOPT_DONT_CANON, + _k_r_b___s_e_n_d_a_u_t_h will not convert the service's instance to + canonical form using _k_r_b___g_e_t___p_h_o_s_t(3). + + If you want to call _k_r_b___s_e_n_d_a_u_t_h with a multiple _o_p_t_i_o_n_s + specification, construct _o_p_t_i_o_n_s as a bitwise-OR of the + options you want to specify. + + +KKRRBB__RREECCVVAAUUTTHH + The _k_r_b___r_e_c_v_a_u_t_h function reads a ticket/authenticator + pair from the socket pointed to by the _f_d argument. Set + the _o_p_t_i_o_n_s argument as a bitwise-OR of the options + desired. Currently only KOPT_DO_MUTUAL is useful to the + receiver. + + The _k_t_e_x_t argument should point to an allocated KTEXT_ST + structure. _K_r_b___r_e_c_v_a_u_t_h fills _k_t_e_x_t with the + ticket/authenticator pair read from _f_d, then passes it to + _k_r_b___r_d___r_e_q. + + The _s_e_r_v_i_c_e and _i_n_s_t arguments specify the expected ser- + vice and instance for which the ticket was generated. + They are also passed to _k_r_b___r_d___r_e_q_. The _i_n_s_t argument may + be set to "*" if the caller wishes _k_r_b___m_k___r_e_q to fill in + the instance used (note that there must be space in the + _i_n_s_t argument to hold a full instance name, see + _k_r_b___m_k___r_e_q(3)). + + The _f_a_d_d_r argument should point to the address of the peer + which is presenting the ticket. It is also passed to + _k_r_b___r_d___r_e_q. + + If the client and server plan to mutually authenticate one + another, the _l_a_d_d_r argument should point to the local + address of the file descriptor. Otherwise you can set + this argument to NULL. + + + +MIT Project Athena Kerberos Version 4.0 3 + + + + + + + + +KRB_SENDAUTH(3) BSD Programmer's Manual KRB_SENDAUTH(3) + + + The _a_u_t_h___d_a_t_a argument should point to an allocated + AUTH_DAT area. It is passed to and filled in by + _k_r_b___r_d___r_e_q. The checksum passed to the corresponding + _k_r_b___s_e_n_d_a_u_t_h is available as part of the filled-in + AUTH_DAT area. + + The _f_i_l_e_n_a_m_e argument specifies the filename which the + service program should use to obtain its service key. + _K_r_b___r_e_c_v_a_u_t_h passes _f_i_l_e_n_a_m_e to the _k_r_b___r_d___r_e_q function. + If you set this argument to "", _k_r_b___r_d___r_e_q looks for the + service key in the file _/_e_t_c_/_k_e_r_b_e_r_o_s_I_V_/_s_r_v_t_a_b_. + + If the client and server are performing mutual authentica- + tion, the _s_c_h_e_d_u_l_e argument should point to an allocated + Key_schedule. Otherwise it is ignored and may be NULL. + + The _v_e_r_s_i_o_n argument should point to a character array of + at least KSEND_VNO_LEN characters. It is filled in with + the version string passed by the client to _k_r_b___s_e_n_d_a_u_t_h_. + + +KKRRBB__NNEETT__WWRRIITTEE AANNDD KKRRBB__NNEETT__RREEAADD + The _k_r_b___n_e_t___w_r_i_t_e function emulates the write(2) system + call, but guarantees that all data specified is written to + _f_d before returning, unless an error condition occurs. + + The _k_r_b___n_e_t___r_e_a_d function emulates the read(2) system + call, but guarantees that the requested amount of data is + read from _f_d before returning, unless an error condition + occurs. + + +BBUUGGSS + _k_r_b___s_e_n_d_a_u_t_h_, _k_r_b___r_e_c_v_a_u_t_h_, _k_r_b___n_e_t___w_r_i_t_e_, and + _k_r_b___n_e_t___r_e_a_d will not work properly on sockets set to non- + blocking I/O mode. + + +SSEEEE AALLSSOO + krb_mk_req(3), krb_rd_req(3), krb_get_phost(3) + + +AAUUTTHHOORR + John T. Kohl, MIT Project Athena + +RREESSTTRRIICCTTIIOONNSS + Copyright 1988, Massachusetts Instititute of Technology. + For copying and distribution information, please see the + file . + + + + + +MIT Project Athena Kerberos Version 4.0 4 + + + + + diff --git a/usr/share/man/cat3/krb_set_key.0 b/usr/share/man/cat3/krb_set_key.0 new file mode 100644 index 0000000000..ac1157fbda --- /dev/null +++ b/usr/share/man/cat3/krb_set_key.0 @@ -0,0 +1,462 @@ + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + +NNAAMMEE + krb_mk_req, krb_rd_req, krb_kntoln, krb_set_key, + krb_get_cred, krb_mk_priv, krb_rd_priv, krb_mk_safe, + krb_rd_safe, krb_mk_err, krb_rd_err, krb_ck_repl - Ker- + beros authentication library + +SSYYNNOOPPSSIISS + ##iinncclluuddee <> + ##iinncclluuddee <> + + eexxtteerrnn cchhaarr **kkrrbb__eerrrr__ttxxtt[[]];; + + iinntt kkrrbb__mmkk__rreeqq((aauutthheenntt,,sseerrvviiccee,,iinnssttaannccee,,rreeaallmm,,cchheecckkssuumm)) + KKTTEEXXTT aauutthheenntt;; + cchhaarr **sseerrvviiccee;; + cchhaarr **iinnssttaannccee;; + cchhaarr **rreeaallmm;; + uu__lloonngg cchheecckkssuumm;; + + iinntt kkrrbb__rrdd__rreeqq((aauutthheenntt,,sseerrvviiccee,,iinnssttaannccee,,ffrroomm__aaddddrr,,aadd,,ffnn)) + KKTTEEXXTT aauutthheenntt;; + cchhaarr **sseerrvviiccee;; + cchhaarr **iinnssttaannccee;; + uu__lloonngg ffrroomm__aaddddrr;; + AAUUTTHH__DDAATT **aadd;; + cchhaarr **ffnn;; + + iinntt kkrrbb__kknnttoollnn((aadd,,llnnaammee)) + AAUUTTHH__DDAATT **aadd;; + cchhaarr **llnnaammee;; + + iinntt kkrrbb__sseett__kkeeyy((kkeeyy,,ccvvtt)) + cchhaarr **kkeeyy;; + iinntt ccvvtt;; + + iinntt kkrrbb__ggeett__ccrreedd((sseerrvviiccee,,iinnssttaannccee,,rreeaallmm,,cc)) + cchhaarr **sseerrvviiccee;; + cchhaarr **iinnssttaannccee;; + cchhaarr **rreeaallmm;; + CCRREEDDEENNTTIIAALLSS **cc;; + + lloonngg kkrrbb__mmkk__pprriivv((iinn,,oouutt,,iinn__lleennggtthh,,sscchheedduullee,,kkeeyy,,sseennddeerr,,rreecceeiivveerr)) + uu__cchhaarr **iinn;; + uu__cchhaarr **oouutt;; + uu__lloonngg iinn__lleennggtthh;; + ddeess__ccbblloocckk kkeeyy;; + ddeess__kkeeyy__sscchheedduullee sscchheedduullee;; + ssttrruucctt ssoocckkaaddddrr__iinn **sseennddeerr;; + ssttrruucctt ssoocckkaaddddrr__iinn **rreecceeiivveerr;; + + lloonngg kkrrbb__rrdd__pprriivv((iinn,,iinn__lleennggtthh,,sscchheedduullee,,kkeeyy,,sseennddeerr,,rreecceeiivveerr,,mmssgg__ddaattaa)) + + + +MIT Project Athena Kerberos Version 4.0 1 + + + + + + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + + uu__cchhaarr **iinn;; + uu__lloonngg iinn__lleennggtthh;; + KKeeyy__sscchheedduullee sscchheedduullee;; + ddeess__ccbblloocckk kkeeyy;; + ssttrruucctt ssoocckkaaddddrr__iinn **sseennddeerr;; + ssttrruucctt ssoocckkaaddddrr__iinn **rreecceeiivveerr;; + MMSSGG__DDAATT **mmssgg__ddaattaa;; + + lloonngg kkrrbb__mmkk__ssaaffee((iinn,,oouutt,,iinn__lleennggtthh,,kkeeyy,,sseennddeerr,,rreecceeiivveerr)) + uu__cchhaarr **iinn;; + uu__cchhaarr **oouutt;; + uu__lloonngg iinn__lleennggtthh;; + ddeess__ccbblloocckk kkeeyy;; + ssttrruucctt ssoocckkaaddddrr__iinn **sseennddeerr;; + ssttrruucctt ssoocckkaaddddrr__iinn **rreecceeiivveerr;; + + lloonngg kkrrbb__rrdd__ssaaffee((iinn,,lleennggtthh,,kkeeyy,,sseennddeerr,,rreecceeiivveerr,,mmssgg__ddaattaa)) + uu__cchhaarr **iinn;; + uu__lloonngg lleennggtthh;; + ddeess__ccbblloocckk kkeeyy;; + ssttrruucctt ssoocckkaaddddrr__iinn **sseennddeerr;; + ssttrruucctt ssoocckkaaddddrr__iinn **rreecceeiivveerr;; + MMSSGG__DDAATT **mmssgg__ddaattaa;; + + lloonngg kkrrbb__mmkk__eerrrr((oouutt,,ccooddee,,ssttrriinngg)) + uu__cchhaarr **oouutt;; + lloonngg ccooddee;; + cchhaarr **ssttrriinngg;; + + lloonngg kkrrbb__rrdd__eerrrr((iinn,,lleennggtthh,,ccooddee,,mmssgg__ddaattaa)) + uu__cchhaarr **iinn;; + uu__lloonngg lleennggtthh;; + lloonngg ccooddee;; + MMSSGG__DDAATT **mmssgg__ddaattaa;; + +DDEESSCCRRIIPPTTIIOONN + This library supports network authentication and various + related operations. The library contains many routines + beyond those described in this man page, but they are not + intended to be used directly. Instead, they are called by + the routines that are described, the authentication server + and the login program. + + _k_r_b___e_r_r___t_x_t_[_] contains text string descriptions of various + Kerberos error codes returned by some of the routines + below. + + _k_r_b___m_k___r_e_q takes a pointer to a text structure in which an + authenticator is to be built. It also takes the name, + instance, and realm of the service to be used and an + optional checksum. It is up to the application to decide + + + +MIT Project Athena Kerberos Version 4.0 2 + + + + + + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + + how to generate the checksum. _k_r_b___m_k___r_e_q then retrieves a + ticket for the desired service and creates an authentica- + tor. The authenticator is built in _a_u_t_h_e_n_t and is acces- + sible to the calling procedure. + + It is up to the application to get the authenticator to + the service where it will be read by _k_r_b___r_d___r_e_q_. Unless + an attacker possesses the session key contained in the + ticket, it will be unable to modify the authenticator. + Thus, the checksum can be used to verify the authenticity + of the other data that will pass through a connection. + + _k_r_b___r_d___r_e_q takes an authenticator of type KKTTEEXXTT,, a service + name, an instance, the address of the host originating the + request, and a pointer to a structure of type AAUUTTHH__DDAATT + which is filled in with information obtained from the + authenticator. It also optionally takes the name of the + file in which it will find the secret key(s) for the ser- + vice. If the supplied _i_n_s_t_a_n_c_e contains "*", then the + first service key with the same service name found in the + service key file will be used, and the _i_n_s_t_a_n_c_e argument + will be filled in with the chosen instance. This means + that the caller must provide space for such an instance + name. + + It is used to find out information about the principal + when a request has been made to a service. It is up to + the application protocol to get the authenticator from the + client to the service. The authenticator is then passed + to _k_r_b___r_d___r_e_q to extract the desired information. + + _k_r_b___r_d___r_e_q returns zero (RD_AP_OK) upon successful authen- + tication. If a packet was forged, modified, or replayed, + authentication will fail. If the authentication fails, a + non-zero value is returned indicating the particular prob- + lem encountered. See _k_r_b_._h for the list of error codes. + + If the last argument is the null string (""), krb_rd_req + will use the file /etc/srvtab to find its keys. If the + last argument is NULL, it will assume that the key has + been set by _k_r_b___s_e_t___k_e_y and will not bother looking fur- + ther. + + _k_r_b___k_n_t_o_l_n converts a Kerberos name to a local name. It + takes a structure of type AUTH_DAT and uses the name and + instance to look in the database /etc/aname to find the + corresponding local name. The local name is returned and + can be used by an application to change uids, directories, + or other parameters. It is not an integral part of Ker- + beros, but is instead provided to support the use of Ker- + beros in existing utilities. + + + +MIT Project Athena Kerberos Version 4.0 3 + + + + + + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + + _k_r_b___s_e_t___k_e_y takes as an argument a des key. It then cre- + ates a key schedule from it and saves the original key to + be used as an initialization vector. It is used to set + the server's key which must be used to decrypt tickets. + + If called with a non-zero second argument, _k_r_b___s_e_t___k_e_y + will first convert the input from a string of arbitrary + length to a DES key by encrypting it with a one-way func- + tion. + + In most cases it should not be necessary to call + _k_r_b___s_e_t___k_e_y_. The necessary keys will usually be obtained + and set inside _k_r_b___r_d___r_e_q_. _k_r_b___s_e_t___k_e_y is provided for + those applications that do not wish to place the applica- + tion keys on disk. + + _k_r_b___g_e_t___c_r_e_d searches the caller's ticket file for a + ticket for the given service, instance, and realm; and, if + a ticket is found, fills in the given CREDENTIALS struc- + ture with the ticket information. + + If the ticket was found, _k_r_b___g_e_t___c_r_e_d returns GC_OK. If + the ticket file can't be found, can't be read, doesn't + belong to the user (other than root), isn't a regular + file, or is in the wrong mode, the error GC_TKFIL is + returned. + + _k_r_b___m_k___p_r_i_v creates an encrypted, authenticated message + from any arbitrary application data, pointed to by _i_n and + _i_n___l_e_n_g_t_h bytes long. The private session key, pointed to + by _k_e_y and the key schedule, _s_c_h_e_d_u_l_e_, are used to encrypt + the data and some header information using _p_c_b_c___e_n_c_r_y_p_t_. + _s_e_n_d_e_r and _r_e_c_e_i_v_e_r point to the Internet address of the + two parties. In addition to providing privacy, this pro- + tocol message protects against modifications, insertions + or replays. The encapsulated message and header are + placed in the area pointed to by _o_u_t and the routine + returns the length of the output, or -1 indicating an + error. + + _k_r_b___r_d___p_r_i_v decrypts and authenticates a received + _k_r_b___m_k___p_r_i_v message. _i_n points to the beginning of the + received message, whose length is specified in _i_n___l_e_n_g_t_h_. + The private session key, pointed to by _k_e_y_, and the key + schedule, _s_c_h_e_d_u_l_e_, are used to decrypt and verify the + received message. _m_s_g___d_a_t_a is a pointer to a _M_S_G___D_A_T + struct, defined in _k_r_b_._h_. The routine fills in the + _a_p_p___d_a_t_a field with a pointer to the decrypted application + data, _a_p_p___l_e_n_g_t_h with the length of the _a_p_p___d_a_t_a field, + _t_i_m_e___s_e_c and _t_i_m_e___5_m_s with the timestamps in the message, + and _s_w_a_p with a 1 if the byte order of the receiver is + + + +MIT Project Athena Kerberos Version 4.0 4 + + + + + + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + + different than that of the sender. (The application must + still determine if it is appropriate to byte-swap applica- + tion data; the Kerberos protocol fields are already taken + care of). The _h_a_s_h field returns a value useful as input + to the _k_r_b___c_k___r_e_p_l routine. + + The routine returns zero if ok, or a Kerberos error code. + Modified messages and old messages cause errors, but it is + up to the caller to check the time sequence of messages, + and to check against recently replayed messages using + _k_r_b___c_k___r_e_p_l if so desired. + + _k_r_b___m_k___s_a_f_e creates an authenticated, but unencrypted mes- + sage from any arbitrary application data, pointed to by _i_n + and _i_n___l_e_n_g_t_h bytes long. The private session key, + pointed to by _k_e_y_, is used to seed the _q_u_a_d___c_k_s_u_m_(_) check- + sum algorithm used as part of the authentication. _s_e_n_d_e_r + and _r_e_c_e_i_v_e_r point to the Internet address of the two par- + ties. This message does not provide privacy, but does + protect (via detection) against modifications, insertions + or replays. The encapsulated message and header are + placed in the area pointed to by _o_u_t and the routine + returns the length of the output, or -1 indicating an + error. The authentication provided by this routine is not + as strong as that provided by _k_r_b___m_k___p_r_i_v or by computing + the checksum using _c_b_c___c_k_s_u_m instead, both of which + authenticate via DES. + + + _k_r_b___r_d___s_a_f_e authenticates a received _k_r_b___m_k___s_a_f_e message. + _i_n points to the beginning of the received message, whose + length is specified in _i_n___l_e_n_g_t_h_. The private session + key, pointed to by _k_e_y_, is used to seed the quad_cksum() + routine as part of the authentication. _m_s_g___d_a_t_a is a + pointer to a _M_S_G___D_A_T struct, defined in _k_r_b_._h _. The rou- + tine fills in these _M_S_G___D_A_T fields: the _a_p_p___d_a_t_a field + with a pointer to the application data, _a_p_p___l_e_n_g_t_h with + the length of the _a_p_p___d_a_t_a field, _t_i_m_e___s_e_c and _t_i_m_e___5_m_s + with the timestamps in the message, and _s_w_a_p with a 1 if + the byte order of the receiver is different than that of + the sender. (The application must still determine if it + is appropriate to byte-swap application data; the Kerberos + protocol fields are already taken care of). The _h_a_s_h + field returns a value useful as input to the _k_r_b___c_k___r_e_p_l + routine. + + The routine returns zero if ok, or a Kerberos error code. + Modified messages and old messages cause errors, but it is + up to the caller to check the time sequence of messages, + and to check against recently replayed messages using + _k_r_b___c_k___r_e_p_l if so desired. + + + +MIT Project Athena Kerberos Version 4.0 5 + + + + + + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + + _k_r_b___m_k___e_r_r constructs an application level error message + that may be used along with _k_r_b___m_k___p_r_i_v or _k_r_b___m_k___s_a_f_e_. + _o_u_t is a pointer to the output buffer, _c_o_d_e is an applica- + tion specific error code, and _s_t_r_i_n_g is an application + specific error string. + + + _k_r_b___r_d___e_r_r unpacks a received _k_r_b___m_k___e_r_r message. _i_n + points to the beginning of the received message, whose + length is specified in _i_n___l_e_n_g_t_h_. _c_o_d_e is a pointer to a + value to be filled in with the error value provided by the + application. _m_s_g___d_a_t_a is a pointer to a _M_S_G___D_A_T struct, + defined in _k_r_b_._h _. The routine fills in these _M_S_G___D_A_T + fields: the _a_p_p___d_a_t_a field with a pointer to the applica- + tion error text, _a_p_p___l_e_n_g_t_h with the length of the + _a_p_p___d_a_t_a field, and _s_w_a_p with a 1 if the byte order of the + receiver is different than that of the sender. (The + application must still determine if it is appropriate to + byte-swap application data; the Kerberos protocol fields + are already taken care of). + + The routine returns zero if the error message has been + successfully received, or a Kerberos error code. + + The _K_T_E_X_T structure is used to pass around text of varying + lengths. It consists of a buffer for the data, and a + length. krb_rd_req takes an argument of this type con- + taining the authenticator, and krb_mk_req returns the + authenticator in a structure of this type. KTEXT itself + is really a pointer to the structure. The actual struc- + ture is of type KTEXT_ST. + + The _A_U_T_H___D_A_T structure is filled in by krb_rd_req. It + must be allocated before calling krb_rd_req, and a pointer + to it is passed. The structure is filled in with data + obtained from Kerberos. _M_S_G___D_A_T structure is filled in by + either krb_rd_priv, krb_rd_safe, or krb_rd_err. It must + be allocated before the call and a pointer to it is + passed. The structure is filled in with data obtained + from Kerberos. + + +FFIILLEESS + /usr/include/kerberosIV/krb.h + /usr/lib/libkrb.a + /usr/include/kerberosIV/des.h + /usr/lib/libdes.a + /etc/kerberosIV/aname + /etc/kerberosIV/srvtab + /tmp/tkt[uid] + + + + +MIT Project Athena Kerberos Version 4.0 6 + + + + + + + + +KERBEROS(3) BSD Programmer's Manual KERBEROS(3) + + +SSEEEE AALLSSOO + kerberos(1), des_crypt(3) + +DDIIAAGGNNOOSSTTIICCSS +BBUUGGSS + The caller of _k_r_b___r_d___r_e_q_, _k_r_b___r_d___p_r_i_v_, _a_n_d _k_r_b___r_d___s_a_f_e + must check time order and for replay attempts. + _k_r_b___c_k___r_e_p_l is not implemented yet. + +AAUUTTHHOORRSS + Clifford Neuman, MIT Project Athena + Steve Miller, MIT Project Athena/Digital Equipment Corpo- + ration + +RREESSTTRRIICCTTIIOONNSS + COPYRIGHT 1985,1986,1989 Massachusetts Institute of Tech- + nology + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +MIT Project Athena Kerberos Version 4.0 7 + + + + + diff --git a/usr/share/man/cat3/krb_set_tkt_string.0 b/usr/share/man/cat3/krb_set_tkt_string.0 new file mode 100644 index 0000000000..3fe3198d2e --- /dev/null +++ b/usr/share/man/cat3/krb_set_tkt_string.0 @@ -0,0 +1,66 @@ + + + +KRB_SET_TKT_STRING(3)BSD Programmer's ManualKRB_SET_TKT_STRING(3) + + +NNAAMMEE + krb_set_tkt_string - set Kerberos ticket cache file name + +SSYYNNOOPPSSIISS + ##iinncclluuddee <> + + vvooiidd kkrrbb__sseett__ttkktt__ssttrriinngg((ffiilleennaammee)) + cchhaarr **ffiilleennaammee;; + +DDEESSCCRRIIPPTTIIOONN + _k_r_b___s_e_t___t_k_t___s_t_r_i_n_g sets the name of the file that holds + the user's cache of Kerberos server tickets and associated + session keys. + + The string _f_i_l_e_n_a_m_e passed in is copied into local stor- + age. Only MAXPATHLEN-1 (see ) characters of + the filename are copied in for use as the cache file name. + + This routine should be called during initialization, + before other Kerberos routines are called; otherwise the + routines which fetch the ticket cache file name may be + called and return an undesired ticket file name until this + routine is called. + +FFIILLEESS + /tmp/tkt[uid] default ticket file name, unless the + environment variable KRBTKFILE is set. + [uid] denotes the user's uid, in deci- + mal. + +SSEEEE AALLSSOO + kerberos(3), setenv(3) + + + + + + + + + + + + + + + + + + + + + + +MIT Project Athena Kerberos Version 4.0 1 + + + + + diff --git a/usr/share/man/cat3/ksend.0 b/usr/share/man/cat3/ksend.0 new file mode 100644 index 0000000000..881666b67e --- /dev/null +++ b/usr/share/man/cat3/ksend.0 @@ -0,0 +1,264 @@ + + + +KRB_SENDAUTH(3) BSD Programmer's Manual KRB_SENDAUTH(3) + + +NNAAMMEE + krb_sendauth, krb_recvauth, krb_net_write, krb_net_read - + Kerberos routines for sending authentication via network + stream sockets + +SSYYNNOOPPSSIISS + ##iinncclluuddee <> + ##iinncclluuddee <> + ##iinncclluuddee <> + + + iinntt kkrrbb__sseennddaauutthh((ooppttiioonnss,, ffdd,, kktteexxtt,, sseerrvviiccee,, iinnsstt,, rreeaallmm,, + cchheecckkssuumm,, mmssgg__ddaattaa,, ccrreedd,, sscchheedduullee,, llaaddddrr,, + ffaaddddrr,, vveerrssiioonn)) + lloonngg ooppttiioonnss;; + iinntt ffdd;; + KKTTEEXXTT kktteexxtt;; + cchhaarr **sseerrvviiccee,, **iinnsstt,, **rreeaallmm;; + uu__lloonngg cchheecckkssuumm;; + MMSSGG__DDAATT **mmssgg__ddaattaa;; + CCRREEDDEENNTTIIAALLSS **ccrreedd;; + KKeeyy__sscchheedduullee sscchheedduullee;; + ssttrruucctt ssoocckkaaddddrr__iinn **llaaddddrr,, **ffaaddddrr;; + cchhaarr **vveerrssiioonn;; + + + iinntt kkrrbb__rreeccvvaauutthh((ooppttiioonnss,, ffdd,, kktteexxtt,, sseerrvviiccee,, iinnsstt,, ffaaddddrr,, + llaaddddrr,, aauutthh__ddaattaa,, ffiilleennaammee,, sscchheedduullee,, vveerrssiioonn)) + lloonngg ooppttiioonnss;; + iinntt ffdd;; + KKTTEEXXTT kktteexxtt;; + cchhaarr **sseerrvviiccee,, **iinnsstt;; + ssttrruucctt ssoocckkaaddddrr__iinn **ffaaddddrr,, **llaaddddrr;; + AAUUTTHH__DDAATT **aauutthh__ddaattaa;; + cchhaarr **ffiilleennaammee;; + KKeeyy__sscchheedduullee sscchheedduullee;; + cchhaarr **vveerrssiioonn;; + + iinntt kkrrbb__nneett__wwrriittee((ffdd,, bbuuff,, lleenn)) + iinntt ffdd;; + cchhaarr **bbuuff;; + iinntt lleenn;; + + iinntt kkrrbb__nneett__rreeaadd((ffdd,, bbuuff,, lleenn)) + iinntt ffdd;; + cchhaarr **bbuuff;; + iinntt lleenn;; + +DDEESSCCRRIIPPTTIIOONN + These functions, which are built on top of the core Ker- + beros library, provide a convenient means for client and + + + +MIT Project Athena Kerberos Version 4.0 1 + + + + + + + + +KRB_SENDAUTH(3) BSD Programmer's Manual KRB_SENDAUTH(3) + + + server programs to send authentication messages to one + another through network connections. The _k_r_b___s_e_n_d_a_u_t_h + function sends an authenticated ticket from the client + program to the server program by writing the ticket to a + network socket. The _k_r_b___r_e_c_v_a_u_t_h function receives the + ticket from the client by reading from a network socket. + + +KKRRBB__SSEENNDDAAUUTTHH + This function writes the ticket to the network socket + specified by the file descriptor _f_d_, returning KSUCCESS if + the write proceeds successfully, and an error code if it + does not. + + The _k_t_e_x_t argument should point to an allocated KTEXT_ST + structure. The _s_e_r_v_i_c_e_, _i_n_s_t_, and _r_e_a_l_m arguments specify + the server program's Kerberos principal name, instance, + and realm. If you are writing a client that uses the + local realm exclusively, you can set the _r_e_a_l_m argument to + NULL. + + The _v_e_r_s_i_o_n argument allows the client program to pass an + application-specific version string that the server pro- + gram can then match against its own version string. The + _v_e_r_s_i_o_n string can be up to KSEND_VNO_LEN (see _<_k_r_b_._h_>) + characters in length. + + The _c_h_e_c_k_s_u_m argument can be used to pass checksum infor- + mation to the server program. The client program is + responsible for specifying this information. This check- + sum information is difficult to corrupt because + _k_r_b___s_e_n_d_a_u_t_h passes it over the network in encrypted form. + The _c_h_e_c_k_s_u_m argument is passed as the checksum argument + to _k_r_b___m_k___r_e_q. + + You can set _k_r_b___s_e_n_d_a_u_t_h_'_s other arguments to NULL unless + you want the client and server programs to mutually + authenticate themselves. In the case of mutual authenti- + cation, the client authenticates itself to the server pro- + gram, and demands that the server in turn authenticate + itself to the client. + + +KKRRBB__SSEENNDDAAUUTTHH AANNDD MMUUTTUUAALL AAUUTTHHEENNTTIICCAATTIIOONN + If you want mutual authentication, make sure that you read + all pending data from the local socket before calling + _k_r_b___s_e_n_d_a_u_t_h_. Set _k_r_b___s_e_n_d_a_u_t_h_'_s _o_p_t_i_o_n_s argument to + KKOOPPTT__DDOO__MMUUTTUUAALL (this macro is defined in the _k_r_b_._h file); + make sure that the _l_a_d_d_r argument points to the address of + the local socket, and that _f_a_d_d_r points to the foreign + socket's network address. + + + +MIT Project Athena Kerberos Version 4.0 2 + + + + + + + + +KRB_SENDAUTH(3) BSD Programmer's Manual KRB_SENDAUTH(3) + + + _K_r_b___s_e_n_d_a_u_t_h fills in the other arguments-- _m_s_g___d_a_t_a, + _c_r_e_d, and _s_c_h_e_d_u_l_e--before sending the ticket to the + server program. You must, however, allocate space for + these arguments before calling the function. + + _K_r_b___s_e_n_d_a_u_t_h supports two other options: KKOOPPTT__DDOONNTT__MMKK__RREEQQ,, + and KKOOPPTT__DDOONNTT__CCAANNOONN.. If called with _o_p_t_i_o_n_s set as + KOPT_DONT_MK_REQ, _k_r_b___s_e_n_d_a_u_t_h will not use the _k_r_b___m_k___r_e_q + function to retrieve the ticket from the Kerberos server. + The _k_t_e_x_t argument must point to an existing ticket and + authenticator (such as would be created by _k_r_b___m_k___r_e_q), + and the _s_e_r_v_i_c_e_, _i_n_s_t_, and _r_e_a_l_m arguments can be set to + NULL. + + If called with _o_p_t_i_o_n_s set as KOPT_DONT_CANON, + _k_r_b___s_e_n_d_a_u_t_h will not convert the service's instance to + canonical form using _k_r_b___g_e_t___p_h_o_s_t(3). + + If you want to call _k_r_b___s_e_n_d_a_u_t_h with a multiple _o_p_t_i_o_n_s + specification, construct _o_p_t_i_o_n_s as a bitwise-OR of the + options you want to specify. + + +KKRRBB__RREECCVVAAUUTTHH + The _k_r_b___r_e_c_v_a_u_t_h function reads a ticket/authenticator + pair from the socket pointed to by the _f_d argument. Set + the _o_p_t_i_o_n_s argument as a bitwise-OR of the options + desired. Currently only KOPT_DO_MUTUAL is useful to the + receiver. + + The _k_t_e_x_t argument should point to an allocated KTEXT_ST + structure. _K_r_b___r_e_c_v_a_u_t_h fills _k_t_e_x_t with the + ticket/authenticator pair read from _f_d, then passes it to + _k_r_b___r_d___r_e_q. + + The _s_e_r_v_i_c_e and _i_n_s_t arguments specify the expected ser- + vice and instance for which the ticket was generated. + They are also passed to _k_r_b___r_d___r_e_q_. The _i_n_s_t argument may + be set to "*" if the caller wishes _k_r_b___m_k___r_e_q to fill in + the instance used (note that there must be space in the + _i_n_s_t argument to hold a full instance name, see + _k_r_b___m_k___r_e_q(3)). + + The _f_a_d_d_r argument should point to the address of the peer + which is presenting the ticket. It is also passed to + _k_r_b___r_d___r_e_q. + + If the client and server plan to mutually authenticate one + another, the _l_a_d_d_r argument should point to the local + address of the file descriptor. Otherwise you can set + this argument to NULL. + + + +MIT Project Athena Kerberos Version 4.0 3 + + + + + + + + +KRB_SENDAUTH(3) BSD Programmer's Manual KRB_SENDAUTH(3) + + + The _a_u_t_h___d_a_t_a argument should point to an allocated + AUTH_DAT area. It is passed to and filled in by + _k_r_b___r_d___r_e_q. The checksum passed to the corresponding + _k_r_b___s_e_n_d_a_u_t_h is available as part of the filled-in + AUTH_DAT area. + + The _f_i_l_e_n_a_m_e argument specifies the filename which the + service program should use to obtain its service key. + _K_r_b___r_e_c_v_a_u_t_h passes _f_i_l_e_n_a_m_e to the _k_r_b___r_d___r_e_q function. + If you set this argument to "", _k_r_b___r_d___r_e_q looks for the + service key in the file _/_e_t_c_/_k_e_r_b_e_r_o_s_I_V_/_s_r_v_t_a_b_. + + If the client and server are performing mutual authentica- + tion, the _s_c_h_e_d_u_l_e argument should point to an allocated + Key_schedule. Otherwise it is ignored and may be NULL. + + The _v_e_r_s_i_o_n argument should point to a character array of + at least KSEND_VNO_LEN characters. It is filled in with + the version string passed by the client to _k_r_b___s_e_n_d_a_u_t_h_. + + +KKRRBB__NNEETT__WWRRIITTEE AANNDD KKRRBB__NNEETT__RREEAADD + The _k_r_b___n_e_t___w_r_i_t_e function emulates the write(2) system + call, but guarantees that all data specified is written to + _f_d before returning, unless an error condition occurs. + + The _k_r_b___n_e_t___r_e_a_d function emulates the read(2) system + call, but guarantees that the requested amount of data is + read from _f_d before returning, unless an error condition + occurs. + + +BBUUGGSS + _k_r_b___s_e_n_d_a_u_t_h_, _k_r_b___r_e_c_v_a_u_t_h_, _k_r_b___n_e_t___w_r_i_t_e_, and + _k_r_b___n_e_t___r_e_a_d will not work properly on sockets set to non- + blocking I/O mode. + + +SSEEEE AALLSSOO + krb_mk_req(3), krb_rd_req(3), krb_get_phost(3) + + +AAUUTTHHOORR + John T. Kohl, MIT Project Athena + +RREESSTTRRIICCTTIIOONNSS + Copyright 1988, Massachusetts Instititute of Technology. + For copying and distribution information, please see the + file . + + + + + +MIT Project Athena Kerberos Version 4.0 4 + + + + + diff --git a/usr/share/man/cat3/kuserok.0 b/usr/share/man/cat3/kuserok.0 new file mode 100644 index 0000000000..805d9c2193 --- /dev/null +++ b/usr/share/man/cat3/kuserok.0 @@ -0,0 +1,66 @@ + + + +KUSEROK(3) BSD Programmer's Manual KUSEROK(3) + + +NNAAMMEE + kuserok - Kerberos version of ruserok + +SSYYNNOOPPSSIISS + ##iinncclluuddee <> + + kkuusseerrookk((kkddaattaa,, llooccaalluusseerr)) + AAUUTTHH__DDAATT **aauutthh__ddaattaa;; + cchhaarr **llooccaalluusseerr;; + +DDEESSCCRRIIPPTTIIOONN + _k_u_s_e_r_o_k determines whether a Kerberos principal described + by the structure _a_u_t_h___d_a_t_a is authorized to login as user + _l_o_c_a_l_u_s_e_r according to the authorization file + ("~_l_o_c_a_l_u_s_e_r/.klogin" by default). It returns 0 (zero) if + authorized, 1 (one) if not authorized. + + If there is no account for _l_o_c_a_l_u_s_e_r on the local machine, + authorization is not granted. If there is no authoriza- + tion file, and the Kerberos principal described by + _a_u_t_h___d_a_t_a translates to _l_o_c_a_l_u_s_e_r (using _k_r_b___k_n_t_o_l_n(3)), + authorization is granted. If the authorization file can't + be accessed, or the file is not owned by _l_o_c_a_l_u_s_e_r_, autho- + rization is denied. Otherwise, the file is searched for a + matching principal name, instance, and realm. If a match + is found, authorization is granted, else authorization is + denied. + + The file entries are in the format: + name.instance@realm + with one entry per line. + +SSEEEE AALLSSOO + kerberos(3), ruserok(3), krb_kntoln(3) + +FFIILLEESS + ~_l_o_c_a_l_u_s_e_r/.klogin authorization list + + + + + + + + + + + + + + + + + +MIT Project Athena Kerberos Version 4.0 1 + + + + + diff --git a/usr/share/man/cat3/realm.0 b/usr/share/man/cat3/realm.0 new file mode 100644 index 0000000000..901419e5e6 --- /dev/null +++ b/usr/share/man/cat3/realm.0 @@ -0,0 +1,198 @@ + + + +KRB_REALMOFHOST(3) BSD Programmer's Manual KRB_REALMOFHOST(3) + + +NNAAMMEE + krb_realmofhost, krb_get_phost, krb_get_krbhst, + krb_get_admhst, krb_get_lrealm - additional Kerberos util- + ity routines + +SSYYNNOOPPSSIISS + ##iinncclluuddee <> + ##iinncclluuddee <> + ##iinncclluuddee <> + + cchhaarr **kkrrbb__rreeaallmmooffhhoosstt((hhoosstt)) + cchhaarr **hhoosstt;; + + cchhaarr **kkrrbb__ggeett__pphhoosstt((aalliiaass)) + cchhaarr **aalliiaass;; + + kkrrbb__ggeett__kkrrbbhhsstt((hhoosstt,,rreeaallmm,,nn)) + cchhaarr **hhoosstt;; + cchhaarr **rreeaallmm;; + iinntt nn;; + + kkrrbb__ggeett__aaddmmhhsstt((hhoosstt,,rreeaallmm,,nn)) + cchhaarr **hhoosstt;; + cchhaarr **rreeaallmm;; + iinntt nn;; + + kkrrbb__ggeett__llrreeaallmm((rreeaallmm,,nn)) + cchhaarr **rreeaallmm;; + iinntt nn;; + +DDEESSCCRRIIPPTTIIOONN + _k_r_b___r_e_a_l_m_o_f_h_o_s_t returns the Kerberos realm of the host + _h_o_s_t, as determined by the translation table + _/_e_t_c_/_k_e_r_b_e_r_o_s_I_V_/_k_r_b_._r_e_a_l_m_s. _h_o_s_t should be the fully- + qualified domain-style primary host name of the host in + question. In order to prevent certain security attacks, + this routine must either have _a _p_r_i_o_r_i knowledge of a + host's realm, or obtain such information securely. + + The format of the translation file is described by + _k_r_b_._r_e_a_l_m_s(5). If _h_o_s_t exactly matches a host_name line, + the corresponding realm is returned. Otherwise, if the + domain portion of _h_o_s_t matches a domain_name line, the + corresponding realm is returned. If _h_o_s_t contains a + domain, but no translation is found, _h_o_s_t's domain is con- + verted to upper-case and returned. If _h_o_s_t contains no + discernible domain, or an error occurs, the local realm + name, as supplied by _k_r_b___g_e_t___l_r_e_a_l_m(3), is returned. + + _k_r_b___g_e_t___p_h_o_s_t converts the hostname _a_l_i_a_s (which can be + either an official name or an alias) into the instance + + + +MIT Project Athena Kerberos Version 4.0 1 + + + + + + + + +KRB_REALMOFHOST(3) BSD Programmer's Manual KRB_REALMOFHOST(3) + + + name to be used in obtaining Kerberos tickets for most + services, including the Berkeley rcmd suite (rlogin, rcp, + rsh). + The current convention is to return the first segment of + the official domain-style name after conversion to lower + case. + + _k_r_b___g_e_t___k_r_b_h_s_t fills in _h_o_s_t with the hostname of the _nth + host running a Kerberos key distribution center (KDC) for + realm _r_e_a_l_m, as specified in the configuration file + (_/_e_t_c_/_k_e_r_b_e_r_o_s_I_V_/_k_r_b_._c_o_n_f). The configuration file is + described by _k_r_b_._c_o_n_f(5). If the host is successfully + filled in, the routine returns KSUCCESS. If the file can- + not be opened, and _n equals 1, then the value of KRB_HOST + as defined in _<_k_r_b_._h_> is filled in, and KSUCCESS is + returned. If there are fewer than _n hosts running a Ker- + beros KDC for the requested realm, or the configuration + file is malformed, the routine returns KFAILURE. + + _k_r_b___g_e_t___a_d_m_h_s_t fills in _h_o_s_t with the hostname of the _nth + host running a Kerberos KDC database administration server + for realm _r_e_a_l_m, as specified in the configuration file + (_/_e_t_c_/_k_e_r_b_e_r_o_s_I_V_/_k_r_b_._c_o_n_f). If the file cannot be opened + or is malformed, or there are fewer than _n hosts running a + Kerberos KDC database administration server, the routine + returns KFAILURE. + + The character arrays used as return values for + _k_r_b___g_e_t___k_r_b_h_s_t, _k_r_b___g_e_t___a_d_m_h_s_t, should be large enough to + hold any hostname (MAXHOSTNAMELEN from ). + + _k_r_b___g_e_t___l_r_e_a_l_m fills in _r_e_a_l_m with the _nth realm of the + local host, as specified in the configuration file. _r_e_a_l_m + should be at least REALM_SZ (from _<_k_r_b_._h_>_)characters_l_o_n_g_. + + +SSEEEE AALLSSOO + kerberos(3), krb.conf(5), krb.realms(5) + +FFIILLEESS + /etc/kerberosIV/krb.realms + translation file for host-to-realm + mapping. + + /etc/kerberosIV/krb.conf + local realm-name and realm/server con- + figuration file. + +BBUUGGSS + The current convention for instance names is too limited; + the full domain name should be used. + + + +MIT Project Athena Kerberos Version 4.0 2 + + + + + + + + +KRB_REALMOFHOST(3) BSD Programmer's Manual KRB_REALMOFHOST(3) + + + _k_r_b___g_e_t___l_r_e_a_l_m currently only supports _n = 1. It should + really consult the user's ticket cache to determine the + user's current realm, rather than consulting a file on the + host. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +MIT Project Athena Kerberos Version 4.0 3 + + + + + diff --git a/usr/share/man/cat3/tf_util.0 b/usr/share/man/cat3/tf_util.0 new file mode 100644 index 0000000000..05addc81e3 --- /dev/null +++ b/usr/share/man/cat3/tf_util.0 @@ -0,0 +1,198 @@ + + + +TF_UTIL(3) BSD Programmer's Manual TF_UTIL(3) + + +NNAAMMEE + tf_init, tf_get_pname, tf_get_pinst, tf_get_cred, tf_close + - routines for manipulating a Kerberos ticket file + +SSYYNNOOPPSSIISS + ##iinncclluuddee <> + + eexxtteerrnn cchhaarr **kkrrbb__eerrrr__ttxxtt[[]];; + + ttff__iinniitt((ttff__nnaammee,, rrww)) + cchhaarr **ttff__nnaammee;; + iinntt rrww;; + + ttff__ggeett__ppnnaammee((ppnnaammee)) + cchhaarr **ppnnaammee;; + + ttff__ggeett__ppiinnsstt((ppiinnsstt)) + cchhaarr **ppiinnsstt;; + + ttff__ggeett__ccrreedd((cc)) + CCRREEDDEENNTTIIAALLSS **cc;; + + ttff__cclloossee(()) + + +DDEESSCCRRIIPPTTIIOONN + This group of routines are provided to manipulate the Ker- + beros tickets file. A ticket file has the following for- + mat: + + principal's name (null-terminated string) + principal's instance (null-terminated string) + CREDENTIAL_1 + CREDENTIAL_2 + ... + CREDENTIAL_n + EOF + + + Where "CREDENTIAL_x" consists of the following fixed-length + fields from the CREDENTIALS structure (defined in ): + + char service[ANAME_SZ] + char instance[INST_SZ] + char realm[REALM_SZ] + des_cblock session + int lifetime + int kvno + KTEXT_ST ticket_st + long issue_date + + + + +MIT Project Athena Kerberos Version 4.0 1 + + + + + + + + +TF_UTIL(3) BSD Programmer's Manual TF_UTIL(3) + + + _t_f___i_n_i_t must be called before the other ticket file rou- + tines. It takes the name of the ticket file to use, and a + read/write flag as arguments. It tries to open the ticket + file, checks the mode and if everything is okay, locks the + file. If it's opened for reading, the lock is shared. If + it's opened for writing, the lock is exclusive. KSUCCESS + is returned if all went well, otherwise one of the follow- + ing: + + NO_TKT_FIL - file wasn't there + TKT_FIL_ACC - file was in wrong mode, etc. + TKT_FIL_LCK - couldn't lock the file, even after a retry + + + The _t_f___g_e_t___p_n_a_m_e reads the principal's name from a ticket + file. It should only be called after tf_init has been + called. The principal's name is filled into the _p_n_a_m_e + parameter. If all goes well, KSUCCESS is returned. If + tf_init wasn't called, TKT_FIL_INI is returned. If the + principal's name was null, or EOF was encountered, or the + name was longer than ANAME_SZ, TKT_FIL_FMT is returned. + + The _t_f___g_e_t___p_i_n_s_t reads the principal's instance from a + ticket file. It should only be called after tf_init and + tf_get_pname have been called. The principal's instance + is filled into the _p_i_n_s_t parameter. If all goes well, + KSUCCESS is returned. If tf_init wasn't called, + TKT_FIL_INI is returned. If EOF was encountered, or the + name was longer than INST_SZ, TKT_FIL_FMT is returned. + Note that, unlike the principal name, the instance name + may be null. + + The _t_f___g_e_t___c_r_e_d routine reads a CREDENTIALS record from a + ticket file and fills in the given structure. It should + only be called after tf_init, tf_get_pname, and + tf_get_pinst have been called. If all goes well, KSUCCESS + is returned. Possible error codes are: + + TKT_FIL_INI - tf_init wasn't called first + TKT_FIL_FMT - bad format + EOF - end of file encountered + + + _t_f___c_l_o_s_e closes the ticket file and releases the lock on + it. + +SSEEEE AALLSSOO + krb(3) + +DDIIAAGGNNOOSSTTIICCSS + + + + +MIT Project Athena Kerberos Version 4.0 2 + + + + + + + + +TF_UTIL(3) BSD Programmer's Manual TF_UTIL(3) + + +BBUUGGSS + The ticket file routines have to be called in a certain + order. + +AAUUTTHHOORRSS + Jennifer Steiner, MIT Project Athena + Bill Bryant, MIT Project Athena + +RREESSTTRRIICCTTIIOONNSS + Copyright 1987 Massachusetts Institute of Technology + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +MIT Project Athena Kerberos Version 4.0 3 + + + + + diff --git a/usr/share/man/cat5/krb.conf.0 b/usr/share/man/cat5/krb.conf.0 new file mode 100644 index 0000000000..1903aebe80 --- /dev/null +++ b/usr/share/man/cat5/krb.conf.0 @@ -0,0 +1,66 @@ + + + +KRB.CONF(5) BSD Programmer's Manual KRB.CONF(5) + + +NNAAMMEE + /etc/kerberosIV/krb.conf - Kerberos configuration file + +DDEESSCCRRIIPPTTIIOONN + _k_r_b_._c_o_n_f contains configuration information describing the + Kerberos realm and the Kerberos key distribution center + (KDC) servers for known realms. + + _k_r_b_._c_o_n_f contains the name of the local realm in the first + line, followed by lines indicating realm/host entries. + The first token is a realm name, and the second is the + hostname of a host running a KDC for that realm. The + words "admin server" following the hostname indicate that + the host also provides an administrative database server. + For example: + ATHENA.MIT.EDU + ATHENA.MIT.EDU kerberos-1.mit.edu admin server + ATHENA.MIT.EDU kerberos-2.mit.edu + LCS.MIT.EDU kerberos.lcs.mit.edu admin server + +SSEEEE AALLSSOO + krb.realms(5), krb_get_krbhst(3), krb_get_lrealm(3) + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +MIT Project Athena Kerberos Version 4.0 1 + + + + + diff --git a/usr/share/man/cat5/krb.realms.0 b/usr/share/man/cat5/krb.realms.0 new file mode 100644 index 0000000000..520e83ffa5 --- /dev/null +++ b/usr/share/man/cat5/krb.realms.0 @@ -0,0 +1,66 @@ + + + +KRB.REALMS(5) BSD Programmer's Manual KRB.REALMS(5) + + +NNAAMMEE + /etc/kerberosIV/krb.realms - host to Kerberos realm trans- + lation file + +DDEESSCCRRIIPPTTIIOONN + _k_r_b_._r_e_a_l_m_s provides a translation from a hostname to the + Kerberos realm name for the services provided by that + host. + + Each line of the translation file is in one of the follow- + ing forms (domain_name should be of the form .XXX.YYY, + e.g. .LCS.MIT.EDU): + host_name kerberos_realm + domain_name kerberos_realm + If a hostname exactly matches the _h_o_s_t___n_a_m_e field in a + line of the first form, the corresponding realm is the + realm of the host. If a hostname does not match any + _h_o_s_t___n_a_m_e in the file, but its domain exactly matches the + _d_o_m_a_i_n___n_a_m_e field in a line of the second form, the corre- + sponding realm is the realm of the host. + + If no translation entry applies, the host's realm is con- + sidered to be the hostname's domain portion converted to + upper case. + +SSEEEE AALLSSOO + krb_realmofhost(3) + + + + + + + + + + + + + + + + + + + + + + + + + + + +MIT Project Athena Kerberos Version 4.0 1 + + + + + diff --git a/usr/share/man/cat8/ext_srvtab.0 b/usr/share/man/cat8/ext_srvtab.0 new file mode 100644 index 0000000000..44f5f1f6cc --- /dev/null +++ b/usr/share/man/cat8/ext_srvtab.0 @@ -0,0 +1,66 @@ + + + +EXT_SRVTAB(8) BSD System Manager's Manual EXT_SRVTAB(8) + + +NNAAMMEE + ext_srvtab - extract service key files from Kerberos key + distribution center database + +SSYYNNOOPPSSIISS + ext_srvtab [ --nn ] [ --rr rreeaallmm ] [ hhoossttnnaammee ...... ] + +DDEESSCCRRIIPPTTIIOONN + _e_x_t___s_r_v_t_a_b extracts service key files from the Kerberos + key distribution center (KDC) database. + + Upon execution, it prompts the user to enter the master + key string for the database. If the --nn option is speci- + fied, the master key is instead fetched from the master + key cache file. + + For each _h_o_s_t_n_a_m_e specified on the command line, + _e_x_t___s_r_v_t_a_b creates the service key file _h_o_s_t_n_a_m_e-new- + srvtab, containing all the entries in the database with an + instance field of _h_o_s_t_n_a_m_e_. This new file contains all + the keys registered for Kerberos-mediated service provid- + ing programs which use the _k_r_b___g_e_t___p_h_o_s_t(3) principal and + instance conventions to run on the host _h_o_s_t_n_a_m_e. If the + --rr option is specified, the realm fields in the extracted + file will match the given realm rather than the local + realm. + +DDIIAAGGNNOOSSTTIICCSS + "verify_master_key: Invalid master key, does not match + database." + The master key string entered was + incorrect. + +FFIILLEESS + _h_o_s_t_n_a_m_e-new-srvtab Service key file generated for _h_o_s_t_- + _n_a_m_e + + /etc/kerberosIV/principal.pag, + /etc/kerberosIV/principal.dir + DBM files containing database + + /etc/kerberosIV/master_key + Master key cache file. + +SSEEEE AALLSSOO + read_service_key(3), krb_get_phost(3) + + + + + + + + +MIT Project Athena Kerberos Version 4.0 1 + + + + + diff --git a/usr/share/man/cat8/kdb_destroy.0 b/usr/share/man/cat8/kdb_destroy.0 new file mode 100644 index 0000000000..feeeb02817 --- /dev/null +++ b/usr/share/man/cat8/kdb_destroy.0 @@ -0,0 +1,66 @@ + + + +KDB_DESTROY(8) BSD System Manager's Manual KDB_DESTROY(8) + + +NNAAMMEE + kdb_destroy - destroy Kerberos key distribution center + database + +SSYYNNOOPPSSIISS + kdb_destroy + +DDEESSCCRRIIPPTTIIOONN + _k_d_b___d_e_s_t_r_o_y deletes a Kerberos key distribution center + database. + + The user is prompted to verify that the database should be + destroyed. A response beginning with `y' or `Y' confirms + deletion. Any other response aborts deletion. + +DDIIAAGGNNOOSSTTIICCSS + "Database cannot be deleted at /etc/kerberosIV/principal" + The attempt to delete the database + failed (probably due to a system or + access permission error). + + "Database not deleted." + The user aborted the deletion. + +FFIILLEESS + /etc/kerberosIV/principal.pag, + /etc/kerberosIV/principal.dir + DBM files containing database + +SSEEEE AALLSSOO + kdb_init(8) + + + + + + + + + + + + + + + + + + + + + + + +MIT Project Athena Kerberos Version 4.0 1 + + + + + diff --git a/usr/share/man/cat8/kdb_edit.0 b/usr/share/man/cat8/kdb_edit.0 new file mode 100644 index 0000000000..4c9a9a2606 --- /dev/null +++ b/usr/share/man/cat8/kdb_edit.0 @@ -0,0 +1,66 @@ + + + +KDB_EDIT(8) BSD System Manager's Manual KDB_EDIT(8) + + +NNAAMMEE + kdb_edit - Kerberos key distribution center database + editing utility + +SSYYNNOOPPSSIISS + kdb_edit [ --nn ] + +DDEESSCCRRIIPPTTIIOONN + _k_d_b___e_d_i_t is used to create or change principals stored in + the Kerberos key distribution center (KDC) database. + + When executed, _k_d_b___e_d_i_t prompts for the master key string + and verifies that it matches the master key stored in the + database. If the --nn option is specified, the master key + is instead fetched from the master key cache file. + + Once the master key has been verified, _k_d_b___e_d_i_t begins a + prompt loop. The user is prompted for the principal and + instance to be modified. If the entry is not found the + user may create it. Once an entry is found or created, + the user may set the password, expiration date, maximum + ticket lifetime, and attributes. Default expiration + dates, maximum ticket lifetimes, and attributes are pre- + sented in brackets; if the user presses return the default + is selected. There is no default password. The password + RANDOM is interpreted specially, and if entered the user + may have the program select a random DES key for the prin- + cipal. + + Upon successfully creating or changing the entry, ``Edit + O.K.'' is printed. + +DDIIAAGGNNOOSSTTIICCSS + "verify_master_key: Invalid master key, does not match + database." + The master key string entered was + incorrect. + +FFIILLEESS + /etc/kerberosIV/principal.pag, + /etc/kerberosIV/principal.dir + DBM files containing database + + /etc/kerberosIV/master_key + Master key cache file. + + + + + + + + + +MIT Project Athena Kerberos Version 4.0 1 + + + + + diff --git a/usr/share/man/cat8/kdb_init.0 b/usr/share/man/cat8/kdb_init.0 new file mode 100644 index 0000000000..92da199153 --- /dev/null +++ b/usr/share/man/cat8/kdb_init.0 @@ -0,0 +1,66 @@ + + + +KDB_INIT(8) BSD System Manager's Manual KDB_INIT(8) + + +NNAAMMEE + kdb_init - initialize Kerberos key distribution center + database + +SSYYNNOOPPSSIISS + kdb_init [ rreeaallmm ] + +DDEESSCCRRIIPPTTIIOONN + _k_d_b___i_n_i_t initializes a Kerberos key distribution center + database, creating the necessary principals. + + If the optional _r_e_a_l_m argument is not present, _k_d_b___i_n_i_t + prompts for a realm name (defaulting to the definition in + /usr/include/krb.h). After determining the realm to be + created, it prompts for a master key password. The master + key password is used to encrypt every encryption key + stored in the database. + +DDIIAAGGNNOOSSTTIICCSS + "/etc/kerberosIV/principal: File exists" + An attempt was made to create a + database on a machine which already + had an existing database. + +FFIILLEESS + /etc/kerberosIV/principal.pag, + /etc/kerberosIV/principal.dir + DBM files containing database + + /usr/include/kerberosIV/krb.h + Include file defining default realm + +SSEEEE AALLSSOO + kdb_destroy(8) + + + + + + + + + + + + + + + + + + + + +MIT Project Athena Kerberos Version 4.0 1 + + + + + diff --git a/usr/share/man/cat8/kdb_util.0 b/usr/share/man/cat8/kdb_util.0 new file mode 100644 index 0000000000..5215eabe68 --- /dev/null +++ b/usr/share/man/cat8/kdb_util.0 @@ -0,0 +1,132 @@ + + + +KDB_UTIL(8) BSD System Manager's Manual KDB_UTIL(8) + + +NNAAMMEE + kdb_util - Kerberos key distribution center database + utility + +SSYYNNOOPPSSIISS + kdb_util ooppeerraattiioonn ffiilleennaammee + +DDEESSCCRRIIPPTTIIOONN + _k_d_b___u_t_i_l allows the Kerberos key distribution center (KDC) + database administrator to perform utility functions on the + database. + + _O_p_e_r_a_t_i_o_n must be one of the following: + + _l_o_a_d initializes the KDC database with the records + described by the text contained in the file + _f_i_l_e_n_a_m_e. Any existing database is overwritten. + + _d_u_m_p dumps the KDC database into a text representa- + tion in the file _f_i_l_e_n_a_m_e. + + _s_l_a_v_e___d_u_m_p + performs a database dump like the _d_u_m_p opera- + tion, and additionally creates a semaphore file + signaling the propagation software that an + update is available for distribution to slave + KDC databases. + + _n_e_w___m_a_s_t_e_r___k_e_y + prompts for the old and new master key strings, + and then dumps the KDC database into a text rep- + resentation in the file _f_i_l_e_n_a_m_e. The keys in + the text representation are encrypted in the new + master key. + + _c_o_n_v_e_r_t___o_l_d___d_b + prompts for the master key string, and then + dumps the KDC database into a text representa- + tion in the file _f_i_l_e_n_a_m_e. The existing + database is assumed to be encrypted using the + old format (encrypted by the key schedule of the + master key); the dumped database is encrypted + using the new format (encrypted directly with + master key). + + +DDIIAAGGNNOOSSTTIICCSS + "verify_master_key: Invalid master key, does not match + database." + The master key string entered was + incorrect. + + + +MIT Project Athena Kerberos Version 4.0 1 + + + + + + + + +KDB_UTIL(8) BSD System Manager's Manual KDB_UTIL(8) + + +FFIILLEESS + /etc/kerberosIV/principal.pag, + /etc/kerberosIV/principal.dir + DBM files containing database + + _f_i_l_e_n_a_m_e.ok semaphore file created by _s_l_a_v_e___d_u_m_p_. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +MIT Project Athena Kerberos Version 4.0 2 + + + + + diff --git a/usr/share/man/cat8/kstash.0 b/usr/share/man/cat8/kstash.0 new file mode 100644 index 0000000000..a562467b7c --- /dev/null +++ b/usr/share/man/cat8/kstash.0 @@ -0,0 +1,66 @@ + + + +KSTASH(8) BSD System Manager's Manual KSTASH(8) + + +NNAAMMEE + kstash - stash Kerberos key distribution center database + master key + +SSYYNNOOPPSSIISS + kstash + +DDEESSCCRRIIPPTTIIOONN + _k_s_t_a_s_h saves the Kerberos key distribution center (KDC) + database master key in the master key cache file. + + The user is prompted to enter the key, to verify the + authenticity of the key and the authorization to store the + key in the file. + +DDIIAAGGNNOOSSTTIICCSS + "verify_master_key: Invalid master key, does not match + database." + The master key string entered was + incorrect. + + "kstash: Unable to open master key file" + The attempt to open the cache file for + writing failed (probably due to a sys- + tem or access permission error). + + "kstash: Write I/O error on master key file" + The wwrriittee(2) system call returned an + error while _k_s_t_a_s_h was attempting to + write the key to the file. + +FFIILLEESS + /etc/kerberosIV/principal.pag, + /etc/kerberosIV/principal.dir + DBM files containing database + + /etc/kerberosIV/master_key + Master key cache file. + + + + + + + + + + + + + + + + +MIT Project Athena Kerberos Version 4.0 1 + + + + + diff --git a/usr/share/man/cat8/make_keypair.0 b/usr/share/man/cat8/make_keypair.0 new file mode 100644 index 0000000000..e1919261a4 --- /dev/null +++ b/usr/share/man/cat8/make_keypair.0 @@ -0,0 +1,31 @@ +MAKE_KEYPAIR(8) BSD System Manager's Manual MAKE_KEYPAIR(8) + +NNAAMMEE + mmaakkee__kkeeyyppaaiirr - generate Kerberos host key pair + +SSYYNNOOPPSSIISS + mmaakkee__kkeeyyppaaiirr _h_o_s_t_n_a_m_e [_h_o_s_t_n_a_m_e _._._.] + +DDEESSCCRRIIPPTTIIOONN + The mmaakkee__kkeeyyppaaiirr command is used to create pairs of DES keys for each + _h_o_s_t_n_a_m_e. The keys are used by privileged programs such as register(1) to + make remote updates to the Kerberos database without having to have first + acquired a Kerberos ticket granting ticket (TGT). The keys created by + mmaakkee__kkeeyyppaaiirr are placed (by hand) in the filesystems of the kerberos + server in _/_e_t_c_/_k_e_r_b_e_r_o_s_I_V_/_r_e_g_i_s_t_e_r___k_e_y_s, and in the root directory of the + clients. For example, the file _/_._u_p_d_a_t_e_._k_e_y_1_2_8_._3_2_._1_3_0_._3 would contain a + copy of the key of the client with IP address 128.32.130.3. These keys + provide a shared secret which may be used to establish a secure channel + between the client hosts and the Kerberos server. + +FFIILLEESS + /.update.keyxx.xx.xx.xx shared DES key with server + /etc/kerberosIV/register_keys server's key storage directory + +SSEEEE AALLSSOO + register(1), registerd(8), kerberos(1) + +HHIISSTTOORRYY + The mmaakkee__kkeeyyppaaiirr utility first appeared in 4.4BSD. + +4.4BSD December 11, 1993 1 diff --git a/usr/share/man/cat8/registerd.0 b/usr/share/man/cat8/registerd.0 new file mode 100644 index 0000000000..8ca0b0fb76 --- /dev/null +++ b/usr/share/man/cat8/registerd.0 @@ -0,0 +1,31 @@ +REGISTERD(8) BSD System Manager's Manual REGISTERD(8) + +NNAAMMEE + rreeggiisstteerrdd - Kerberos registration daemon + +SSYYNNOOPPSSIISS + rreeggiisstteerrdd + +DDEESSCCRRIIPPTTIIOONN + Act as a registration agent for a Kerberos domain. + +FFIILLEESS + /.update.keyxx.xx.xx.xx shared DES key with server + /etc/kerberosIV/principal* Kerberos database + /etc/kerberosIV/register_keys directory containing keys for trusted + hosts + +SSEEEE AALLSSOO + registerd(8), kerberos(1) + +DDIIAAGGNNOOSSTTIICCSS + ``Already exists'', if the user already exists in the Kerberos database. + + ``Permission Denied'', if the host on which register is being run is un- + trusted. + +HHIISSTTOORRYY + The rreeggiisstteerrdd utility first appeared in 4.4BSD. + + +4.4BSD December 11, 1993 1 -- 2.20.1