[Kerberos] User Ticket Management

Kerberos客户端常用命令包括 kinit, klist, kdestroy, and kpasswd，用户使用这些命令管理自己的 ticket。

此外，每台运行Kerberos的机器应该都配置/etc/krb5.conf，At a minimum, it should define a default_realm setting in [libdefaults]. If you are not using DNS SRV records, it must also contain a [realms] section containing information for your realm’s KDCs.

Ticket 管理

Kerberos Ticket的若干属性：

forwardable 简单来讲，KDC可以基于该类型TGT发放新的TGT，即使 network address不同。这样不需要再次输入密码。
proxiable 类似于forwardable，但是不同的是只允许service继承client的认证
proxy
postdated
Renewable 用户不需要重新输入密码就可以获得新的 session key. 但是这种TGT有过期时间。
invalid
hardware authentication 申请使用硬件的Ticket认证
okay as delegate ticket指定的服务器可以用作delegate determined by the policy of that realm
anonymous ticket is one in which the named principal is a generic principal for that realm; it does not actually specify the individual that will be using the ticket. This ticket is meant only to securely distribute a session key.

用 kinit 获得Ticket

如果你的登录系统集成了Kerberos v5，那么登录时自动获得kerberos ticket. 否则，必须显示获取，比如用 kinit。类似，如果 ticket过期了，kinit可以申请新的ticket.

By default, kinit假设你想要默认realm里与自己名字相同的principal的ticket。

shell% kinit

Password for jennifer@ATHENA.MIT.EDU: <-- [Type jennifer's password here.]

shell%

如果想要申请 forwardable ticket，可以

shell% kinit -f

Password for jennifer@ATHENA.MIT.EDU: <-- [Type your password here.]

shell%

shell% kinit -f -l 3h david@EXAMPLE.COM

Password for david@EXAMPLE.COM: <-- [Type david's password here.]

shell%

用 klist 查看 ticket

当你第一次获得 ticket, 那么只能是TGT，看起来如下：

shell% klist

Ticket cache: /tmp/krb5cc_ttypa

Default principal: jennifer@ATHENA.MIT.EDU

Valid starting     Expires            Service principal

// ::  // ::  krbtgt/ATHENA.MIT.EDU@ATHENA.MIT.EDU

shell%

如果连接到其他机器上，比如：daffodil.mit.edu，但是在同一个realm，klist会得到

shell% klist

Ticket cache: /tmp/krb5cc_ttypa

Default principal: jennifer@ATHENA.MIT.EDU

Valid starting     Expires            Service principal

// ::  // ::  krbtgt/ATHENA.MIT.EDU@ATHENA.MIT.EDU

// ::  // ::  host/daffodil.mit.edu@ATHENA.MIT.EDU

shell%

当jennifer用ssh程序登陆主机daffodil.mit.edu，ssh程序将jennifer的TGT给KDC，并请求主机ticket，这样jennifer不用再输入密码。

klist有各种flag，具体可以通过 man klist 查看。

用 kdestory 销毁ticket.

由于ticket可能被偷走，这样离开机器的时候可以顺便销毁ticket.

shell% kdestroy

shell%

其他客户端命令

kdestroy: kdestroy utility destroys the user’s active Kerberos authorization tickets by overwriting and deleting the credentials cache that contains them
kinit: kinit obtains and caches an initial ticket-granting ticket(TGT) for principal
klist: klist lists the Kerberos principal and Kerberos tickets held in a credentials cache, or the keys held in a keytab file.
kpasswd: kpasswd command is used to change a Kerberos principal’s password
krb5-config
ksu
kswitch
kvno
sclient