Kerberos

krb5

Kerberos is a network authentication protocol designed to provide strong authentication for client/server applications by using secret-key cryptography.

Runs as klist, kinit, kdestroy|macOS, Linux|web.mit.edu

Open form in Otty otty.toml

Sync rules

What travels, what stays, what never leaves

Kerberos in your home directory Every rule on this page, by file

· ~/.k5identity Sync

· ~/.k5login Exclude

Only what the catalog names. A directory that syncs brings everything inside it except what is listed as excluded here.

apps/krb5/otty.tomlThe file this page is generated from

id = "krb5"

name = "Kerberos"

homepage = "https://web.mit.edu/kerberos/"

description = "Kerberos is a network authentication protocol designed to provide strong authentication for client/server applications by using secret-key cryptography."

# The Cerberus mark from MIT's own Kerberos page.

icon = "https://web.mit.edu/kerberos/images/dog-ring.jpg"

# klist, kinit and kdestroy are the user-facing commands of an MIT Kerberos or

# Heimdal install; the entry is named for the project, since the binaries carry

# no config of their own and the files below belong to the Kerberos client.

executables = ["klist", "kinit", "kdestroy"]

platforms = ["macos", "linux"]

[dotfiles]

# https://web.mit.edu/kerberos/krb5-latest/doc/user/user_config/k5identity.html —

# ".k5identity file, which resides in a user's home directory, contains a list

# of rules for selecting a client principals based on the server being

# accessed", used to choose a credential cache. The realm and KDC configuration

# is /etc/krb5.conf, which is system-wide and not listed here; the credential

# caches themselves are runtime state in /tmp or the OS keyring.

paths = ["~/.k5identity"]

# https://web.mit.edu/kerberos/krb5-latest/doc/user/user_config/k5login.html —

# .k5login lists the principals allowed to log in as this account: "Anyone with

# valid tickets for a principal in the file is allowed host access with the UID

# of the user in whose home directory the file resides." That is an access

# grant on one host, the Kerberos counterpart of ~/.ssh/authorized_keys, which

# this catalog also keeps out of a sync.

exclude = ["~/.k5login"]

# Nothing here is a credential: .k5identity holds principal names and host

# patterns, no keys. The keys live in the ticket cache and the keytab.

secret = []

# Read by the client library when it picks a cache; nothing holds it open.

side_effect = false

# No machine_lines: the rules map server realms and hostnames to the principal

# the user wants there, which is the same answer on every machine they work on.

[commands]

format = 1

label = "List Kerberos tickets"

description = "Show the tickets in a credential cache with klist. kinit and kdestroy are not covered."

quality = "ai-draft"

base = "fig:klist"

parser = { end_of_options = "--", interleave = "permute", long_equals = true, short_attached = true, short_bundles = false }

[[commands.source]]

id = "fig"

kind = "completion"

url = "https://github.com/withfig/autocomplete/blob/master/src/klist.ts"

license = "MIT"

[[commands.field]]

id = "cache"

label = "Credential cache"

type = "string"

option = ["-c"]

sources = ["fig"]

[[commands.field]]

id = "flags"

label = "Show ticket flags"

type = "boolean"

option = ["-f"]

sources = ["fig"]

[[commands.field]]

id = "verbose"

label = "Verbose"

type = "boolean"

option = ["-v", "--verbose"]

sources = ["fig"]

[[commands.field]]

id = "list_all"

label = "List all caches"

type = "boolean"

option = ["-l", "--list-all"]

sources = ["fig"]

[[commands.field]]

id = "json"

label = "JSON output"

type = "boolean"

option = ["--json"]

sources = ["fig"]

[[commands.field]]

id = "test"

label = "Test for a valid TGT"

description = "Print nothing; the exit status says whether a valid ticket-granting ticket exists."

type = "boolean"

option = ["-s"]

sources = ["fig"]

[[commands.task]]

id = "list"

label = "List tickets"

fields = ["cache", "flags", "verbose"]

[[commands.task]]

id = "check"

label = "Check for a valid TGT"

set = { test = [true] }

fields = ["test", "cache"]

[[commands.group]]

id = "basic"

label = "Basic"

fields = ["cache", "flags", "verbose", "list_all", "json", "test"]

Use it with your dotfile manager

Same data, in the shape your tool already reads

Opens Otty and adds this tool to what it syncs

Opens otty://sync/add/krb5. Otty ships with this catalog, so the link only has to name the tool — nothing is downloaded.

Every one of these is generated from the same rules as this page.