123 lines
4.0 KiB
Groff
123 lines
4.0 KiB
Groff
|
.\" from: klogind.8,v 4.1 89/01/23 11:39:30 jtkohl Exp $
|
||
|
|
.\" $Id: klogind.8,v 1.2 1994/07/19 19:27:39 g89r4222 Exp $
|
||
|
|
.\"
|
||
|
|
.\" Copyright (c) 1983 The Regents of the University of California.
|
||
|
|
.\" All rights reserved.
|
||
|
|
.\"
|
||
|
|
.\" Redistribution and use in source and binary forms are permitted
|
||
|
|
.\" provided that the above copyright notice and this paragraph are
|
||
|
|
.\" duplicated in all such forms and that any documentation,
|
||
|
|
.\" advertising materials, and other materials related to such
|
||
|
|
.\" distribution and use acknowledge that the software was developed
|
||
|
|
.\" by the University of California, Berkeley. The name of the
|
||
|
|
.\" University may not be used to endorse or promote products derived
|
||
|
|
.\" from this software without specific prior written permission.
|
||
|
|
.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR
|
||
|
|
.\" IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
|
||
|
|
.\" WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
|
||
|
|
.\"
|
||
|
|
.\" @(#)rlogind.8 6.4 (Berkeley) 9/19/88
|
||
|
|
.\"
|
||
|
|
.TH KLOGIND 8 "Kerberos Version 4.0" "MIT Project Athena"
|
||
|
|
.UC 5
|
||
|
|
.SH NAME
|
||
|
|
klogind \- remote login server
|
||
|
|
.SH SYNOPSIS
|
||
|
|
.B /usr/etc/klogind
|
||
|
|
.br
|
||
|
|
.B /usr/etc/Klogind
|
||
|
|
.br
|
||
|
|
.B /usr/etc/eklogind
|
||
|
|
.SH DESCRIPTION
|
||
|
|
.I Klogind
|
||
|
|
is the server for the Kerberos version of the
|
||
|
|
.IR rlogin (1)
|
||
|
|
program. The server provides a remote login facility
|
||
|
|
with authentication provided by Kerberos.
|
||
|
|
.PP
|
||
|
|
.I Klogind
|
||
|
|
listens for service requests at the port indicated in
|
||
|
|
the ``klogin'' or ``eklogin'' service specification; see
|
||
|
|
.IR services (5).
|
||
|
|
.PP
|
||
|
|
Invocation as Klogind is intended for secure
|
||
|
|
hosts to which no password access will be granted; invocation as klogind
|
||
|
|
is intended for normal hosts to which password access may be granted if
|
||
|
|
Kerberos authorization fails; invocation as eklogind provides an
|
||
|
|
encrypted communications channel. A host can run either Klogind or
|
||
|
|
klogind but not both (they use the same port, ``klogin''). Eklogind may
|
||
|
|
be run independently.
|
||
|
|
.PP
|
||
|
|
When a service request is received, the server checks the client's
|
||
|
|
source address and requests the corresponding host name (see
|
||
|
|
.IR gethostbyaddr (3N),
|
||
|
|
.IR hosts (5)
|
||
|
|
and
|
||
|
|
.IR named (8)).
|
||
|
|
If the hostname cannot be determined,
|
||
|
|
the dot-notation representation of the host address is used.
|
||
|
|
.PP
|
||
|
|
Once the source address has been checked,
|
||
|
|
.I klogind
|
||
|
|
allocates a pseudo terminal (see
|
||
|
|
.IR pty (4)),
|
||
|
|
and manipulates file descriptors so that the slave
|
||
|
|
half of the pseudo terminal becomes the
|
||
|
|
.B stdin ,
|
||
|
|
.B stdout ,
|
||
|
|
and
|
||
|
|
.B stderr
|
||
|
|
for a login process.
|
||
|
|
The login process is an instance of the
|
||
|
|
.IR login (1)
|
||
|
|
program, invoked with the
|
||
|
|
.B \-k,
|
||
|
|
.B \-K,
|
||
|
|
or
|
||
|
|
.B \-e
|
||
|
|
option, depending on whether the klogind was started as klogind, Klogind
|
||
|
|
or eklogind, respectively.
|
||
|
|
The login process then proceeds with the
|
||
|
|
authentication process as described in
|
||
|
|
.IR kshd (8),
|
||
|
|
but if automatic authentication fails, it reprompts the user
|
||
|
|
to login as one finds on a standard terminal line.
|
||
|
|
.PP
|
||
|
|
The parent of the login process manipulates the master side of
|
||
|
|
the pseudo terminal, operating as an intermediary
|
||
|
|
between the login process and the client instance of the
|
||
|
|
.I rlogin
|
||
|
|
program. If klogind is invoked as eklogind, all data passed over
|
||
|
|
the network are encrypted.
|
||
|
|
In normal operation, the packet protocol described
|
||
|
|
in
|
||
|
|
.IR pty (4)
|
||
|
|
is invoked to provide ^S/^Q type facilities and propagate
|
||
|
|
interrupt signals to the remote programs. The login process
|
||
|
|
propagates the client terminal's baud rate and terminal type,
|
||
|
|
as found in the environment variable, ``TERM''; see
|
||
|
|
.IR environ (7).
|
||
|
|
The screen or window size of the terminal is requested from the client,
|
||
|
|
and window size changes from the client are propagated to the pseudo terminal.
|
||
|
|
.SH DIAGNOSTICS
|
||
|
|
All diagnostic messages are returned on the connection
|
||
|
|
associated with the
|
||
|
|
.BR stderr ,
|
||
|
|
after which any network connections are closed.
|
||
|
|
An error is indicated by a leading byte with a value of 1.
|
||
|
|
.PP
|
||
|
|
.B ``Try again.''
|
||
|
|
.br
|
||
|
|
A
|
||
|
|
.I fork
|
||
|
|
by the server failed.
|
||
|
|
.PP
|
||
|
|
.B ``/bin/sh: ...''
|
||
|
|
.br
|
||
|
|
The user's login shell could not be started.
|
||
|
|
.SH SEE ALSO
|
||
|
|
kerberos(3)
|
||
|
|
.SH BUGS
|
||
|
|
.PP
|
||
|
|
A more extensible protocol should be used.
|