What is Kinit Command in Kerberos, and What Does it do?
The Kinit in Linux is a command often used for renewing or caching/renewing a Kerberos ticket authentication and granting features. This tool is used for the same purpose that MIT and SEAM References use Kinit in other Kerberos implementations. Notably, you can only use the Kinit command once you register as a principal with the KDC or Key Distribution Center.
Ideally, the KDC alternatives, often identified by {realms} and {kdcdefault} features contained in the kdc.conf (which is the KBR5 configuration file), come in handy if you do not indicate any ticket flags in the command line.
This article describes what a Kinix Linux command is. It also provides a step-by-step guide on using the Kinit tool to renew, obtain, or cache your ticket-granting tickets. Finally, we will highlight Kinit syntax or flags, environment variables, and files.
How to Authenticate With Kinit
One of the measures you should always take after installing Kerberos on your system is to check if all the packages exist. Again, you will have to test it from the server and user machines. Once done successfully, you can proceed and authenticate with Kinit using the following steps.
Step 1: Confirm if the Kinit Tool Exists
Initially, we confirm if Kerberos installation was successful in the system by executing the following commands on the console.
Step 2: Configure the krb5.conf File
After confirming Kerberos exists in the system, the next step is to configure krb5.conf in the /KenHint/krb5.conf file. If the file does not exist, the user can create one and confirm if the port name and host address are similar. The file should look like this.
Step 3: Validate the Initialization of the Kerberos Server
The next procedure is to validate if the Kerberos server is running, then try getting a ticket for any users in the serve. For this demonstration, we will fetch a ticket for user KenHint. Our password for the user will be LinHint.
Of course, it is also possible to obtain tickets using the Klist Linux tool, but this is not for this write-up.
Kinit Command- Description and Flags/ Flags
Using Kinit on Linux effectively begins with understanding what it is. And as you will find out, the Kinit command efficiently reinitializes the credentials cache if you are not renewing any existing files. Thus, the result will be a new ticket-granting ticket from the KDC.
Also, failure to specify the Principal in your command line but specify the –s flag, the action will prompt the system to obtain the Principal name from the credentials cache. Besides, the new credentials cache will become your default cache unless you use the –c flag to state the cache name.
The Kinit syntax or flags feature the following denotations;
These initials stand for the following;
- -V to display the verbose output
- -l lifetime requests tickets with the lifetime “lifetime” and will always come before time delimiters such as s (seconds), m (minutes), h (hours), and d (days).
- -s start_time requests postcard tickets that are valid at the start_time
- -r renewable_life effectively requests renewable tickets
- -p fetches proxiable tickets
- -P cannot request proxiable tickets
- -f for forwardable tickets
- -F does not request forwardable tickets
- -a fetches tickets with local addresses
- -A fetches tickets without addresses
- -C provides canonization of the principal name
- -E changes your principal name into an enterprise name
- -v helps to validate ticket-granting tickets through the KDC.
- -R renews ticket-granting tickets
- -k [-t keytab_file fetches tickets from the host key tab file
- -c cache_name –n helps with anonymous processing
- -S service_name specifies alternate service names for getting initial tickets
- -T armor_ccache identifies the name of the cache that already has a ticket
- [-X attribute[=value]] specifies a pre-authorization value and attribute for pre-authorization plugins
The ticket period value for –s, -l and are –l flags are denoted as ndnhnmns where n associate a number, d- represent the number of days, -h denotes hours, m denotes the number of minutes, and –s expresses the seconds. Besides, the n preceding each denotation stands for a number, i.e., 90h will be 90 hours.
The codes below create a renewable ticket named KenHint. This ticket has a lifetime of 10 hours and is renewable in 5 days.
Kinit Environment Variable and Files
Kinit is among the Kerberos commands operational within the KRB5CCNAME environment variable. The environment has the following major Kinit files;
Files
- /usr/krb5/bin/knit is the initial file that is the container or workspace
- /var/krb5/security/creds/krb5cc_ [KenHint] file is the initial default cache and KenHint is the user
- /etc/krb5/krb5.keytab is a file for the initial location of the local hosting key tab file
- /var/krb5/krb5kdc/kdc.conf file is the Kerberos key distribution center configuration folder.
Kinit Command Examples
Common Kinit command examples include;
- The below Kinit command comes in handy in requesting valid credentials valid for authentication from the host.
- Initial ticket request
- Renew a ticket:
Conclusion
The Kinit command in Kerberos Linux consists of an array of flags. It comes in handy in a variety of applications. It is ideal for requesting valid credentials, proxiable credentials, forwarded credentials, and renewing tickets. You will also find it helpful to display the Kinit help menu whenever you experience a problem.
