Rkinit allows you to safely forward tickets to other kerberos hosts.
Obtained from: MIT
This commit is contained in:
Justin T. Gibbs
parent
b00d18e592
commit
43dcd8e508
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/vendor-crypto/eBones/dist/; revision=10766
11
eBones/usr.bin/rkinit/Makefile
Normal file
11
eBones/usr.bin/rkinit/Makefile
Normal file
@ -0,0 +1,11 @@
|
|||||||
|
# Makefile,v 1.2 1995/01/20 22:08:14 wollman Exp
|
||||||
|
|
||||||
|
PROG= rkinit
|
||||||
|
SRCS= ${RKINITOBJDIR}/rkinit_err.h rkinit.c
|
||||||
|
CFLAGS+= -I${KRBOBJDIR} -I${RKINITOBJDIR}
|
||||||
|
LDADD+= -L${RKINITOBJDIR} -lrkinit -L${KRBOBJDIR} -lkrb -L${DESOBJDIR} -ldes
|
||||||
|
LDADD+= -lss -lcom_err
|
||||||
|
|
||||||
|
MAN1= rkinit.1
|
||||||
|
|
||||||
|
.include <bsd.prog.mk>
|
||||||
206
eBones/usr.bin/rkinit/rkinit.1
Normal file
206
eBones/usr.bin/rkinit/rkinit.1
Normal file
@ -0,0 +1,206 @@
|
|||||||
|
.\"
|
||||||
|
.\" $Header: /local/cvsfiles/kerberos/src/appl/rkinit/man/rkinit.1,v 1.1 1991/12/03 23:21:25 eichin Exp $
|
||||||
|
.\" $Source: /local/cvsfiles/kerberos/src/appl/rkinit/man/rkinit.1,v $
|
||||||
|
.\" $Author: eichin $
|
||||||
|
.\"
|
||||||
|
.\"
|
||||||
|
.TH RKINIT 1 "November 12, 1989"
|
||||||
|
.UC 4
|
||||||
|
.SH NAME
|
||||||
|
rkinit \- establish kerberos tickets safely on a remote host
|
||||||
|
.SH SYNOPSIS
|
||||||
|
.B rkinit [ host ]
|
||||||
|
[ -p
|
||||||
|
.B principal
|
||||||
|
] [ -l
|
||||||
|
.B username
|
||||||
|
] [ -k
|
||||||
|
.B kerberos_realm
|
||||||
|
] [ -f
|
||||||
|
.B ticket_file
|
||||||
|
] [ -h
|
||||||
|
.B remote_host
|
||||||
|
] [ -t
|
||||||
|
.B ticket_lifetime
|
||||||
|
] [
|
||||||
|
.B \-notimeout
|
||||||
|
]
|
||||||
|
|
||||||
|
A host name must be specified either as the first command line
|
||||||
|
argument or following a \-h flag. If redundant command line
|
||||||
|
arguments are given, the last one to appear takes precedence.
|
||||||
|
|
||||||
|
.SH DESCRIPTION
|
||||||
|
.I rkinit
|
||||||
|
is a program that allows a user to establish kerberos tickets on
|
||||||
|
a remote host registered for
|
||||||
|
rlogin service. This can be done without the user's kerberos
|
||||||
|
password ever leaving the client machine.
|
||||||
|
|
||||||
|
In order to establish tickets remotely
|
||||||
|
without the use of something like
|
||||||
|
.I rkinit,
|
||||||
|
one would have to log in to the
|
||||||
|
remote host and run
|
||||||
|
.IR kinit (1).
|
||||||
|
.I rkinit
|
||||||
|
followed by
|
||||||
|
.I rlogin
|
||||||
|
can be thought of as a safe substitute for
|
||||||
|
.I rlogin
|
||||||
|
followed
|
||||||
|
.I kinit.
|
||||||
|
|
||||||
|
.I rkinit
|
||||||
|
uses the same access checking mechanism as
|
||||||
|
.I rlogin.
|
||||||
|
That means that
|
||||||
|
.I rkinit
|
||||||
|
can be used to create any tickets for user
|
||||||
|
.I A
|
||||||
|
on remote host
|
||||||
|
.I B
|
||||||
|
if and only if
|
||||||
|
.IR A 's
|
||||||
|
tickets would entitle a login to
|
||||||
|
.I B.
|
||||||
|
This means that one can create remote tickets for himself or for
|
||||||
|
another user if he is in that user's .klogin file.
|
||||||
|
|
||||||
|
.I rkinit
|
||||||
|
understands the following command line options:
|
||||||
|
|
||||||
|
.TP 4
|
||||||
|
.B \-p \fIprincipal\fR
|
||||||
|
If
|
||||||
|
.I principal,
|
||||||
|
in the format
|
||||||
|
.I name[.inst][@realm]
|
||||||
|
is specified, the tickets created on the remote host will be the
|
||||||
|
tickets indicated by the
|
||||||
|
.I principal
|
||||||
|
field. If this option is not given, the following defaults are
|
||||||
|
used: If the user running
|
||||||
|
.I rkinit
|
||||||
|
does not have tickets on the client machine,
|
||||||
|
.I rkinit
|
||||||
|
will prompt for a password and behave effectively as if the user
|
||||||
|
had invoked
|
||||||
|
.I kinit
|
||||||
|
on the specified
|
||||||
|
remote host; i.e.,
|
||||||
|
the tickets established will be owned on the remote host
|
||||||
|
by the user who invoked
|
||||||
|
.I rkinit
|
||||||
|
and will be for the local realm of the
|
||||||
|
remote host.
|
||||||
|
If the user running
|
||||||
|
.I rkinit
|
||||||
|
already has tickets,
|
||||||
|
.I rkinit
|
||||||
|
will prompt for a password and create tickets whose principal
|
||||||
|
matches that of the
|
||||||
|
tickets that the user already has.
|
||||||
|
|
||||||
|
|
||||||
|
.TP
|
||||||
|
.B \-l \fIusername\fR
|
||||||
|
If
|
||||||
|
.I username
|
||||||
|
is specified, the ticket file on the remote host will be owned by the
|
||||||
|
user
|
||||||
|
.I username.
|
||||||
|
If it is not specified, the tickets will be owned by
|
||||||
|
the remote user whose login name matches that of the user invoking
|
||||||
|
.I rkinit.
|
||||||
|
|
||||||
|
.TP
|
||||||
|
.B \-r \fIrealm\fR
|
||||||
|
.I realm
|
||||||
|
is used to tell
|
||||||
|
.I rkinit
|
||||||
|
what realm the remote host is in. This
|
||||||
|
option should not usually have to be used since
|
||||||
|
.I rkinit
|
||||||
|
uses
|
||||||
|
.IR krb_realmofhost (3)
|
||||||
|
to determine the remote host's kerberos realm. Note that this
|
||||||
|
is distinct from realm as specified in
|
||||||
|
.I principal,
|
||||||
|
which refers to the realm of the remote tickets.
|
||||||
|
|
||||||
|
.TP
|
||||||
|
.B \-f \fIticket_file\fR
|
||||||
|
This option is used to specify the name of the ticket file that
|
||||||
|
should be used on the remote host. Note that if you
|
||||||
|
specify a location for the ticket file that is other
|
||||||
|
than the default, you will have to set the environment variable
|
||||||
|
KRBTKFILE to that filename once you get to the remote host in
|
||||||
|
order for you to use the tickets.
|
||||||
|
If a ticket file is not specified, the tickets will
|
||||||
|
be placed in the
|
||||||
|
default location as specified by
|
||||||
|
.IR tkt_file (3).
|
||||||
|
On a UNIX host, this is /tmp/tkt<uid>, where
|
||||||
|
<uid> is the user id of the person who owns the remote ticket file.
|
||||||
|
|
||||||
|
.TP
|
||||||
|
.B \-h \fIremote_host\fR
|
||||||
|
.I remote host
|
||||||
|
is the host on which remote tickets are being obtained. This
|
||||||
|
option can be used in place of specifying the host as the first
|
||||||
|
command line argument.
|
||||||
|
|
||||||
|
.TP
|
||||||
|
.B \-t \fIticket_lifetime\fR
|
||||||
|
.I ticket lifetime
|
||||||
|
is the lifetime in minutes of the remote tickets. If it is not
|
||||||
|
specified, the default ticket life time (as defined in krb.h) is
|
||||||
|
used.
|
||||||
|
|
||||||
|
.TP
|
||||||
|
.B \-notimeout
|
||||||
|
prevents the client from timing out. This is mainly useful only
|
||||||
|
for debugging since the rkinit server also times out.
|
||||||
|
|
||||||
|
.SH EXAMPLES
|
||||||
|
|
||||||
|
In the following examples,
|
||||||
|
.B tabetha
|
||||||
|
and
|
||||||
|
.B soup
|
||||||
|
are machines in the
|
||||||
|
.B ATHENA.MIT.EDU
|
||||||
|
kerberos realm and
|
||||||
|
.B local
|
||||||
|
is a user who can log in
|
||||||
|
to
|
||||||
|
.B soup
|
||||||
|
and has
|
||||||
|
.B qjb.root@ATHENA.MIT.EDU
|
||||||
|
in his .klogin file.
|
||||||
|
|
||||||
|
|
||||||
|
% rkinit tabetha
|
||||||
|
.br
|
||||||
|
Kerberos initialization (tabetha)
|
||||||
|
.br
|
||||||
|
Password for qjb@ATHENA.MIT.EDU:
|
||||||
|
.br
|
||||||
|
%
|
||||||
|
.br
|
||||||
|
|
||||||
|
.br
|
||||||
|
% rkinit soup -p qjb.root -l local
|
||||||
|
.br
|
||||||
|
Kerberos initialization (soup): tickets will be owned by local
|
||||||
|
.br
|
||||||
|
Password for qjb.root@ATHENA.MIT.EDU:
|
||||||
|
.br
|
||||||
|
%
|
||||||
|
|
||||||
|
.SH SEE ALSO
|
||||||
|
rkinitd(8), kerberos(1), kerberos(3), kinit(1)
|
||||||
|
|
||||||
|
.SH AUTHOR
|
||||||
|
Emanuel Jay Berkenbilt (MIT-Project Athena)
|
||||||
216
eBones/usr.bin/rkinit/rkinit.c
Normal file
216
eBones/usr.bin/rkinit/rkinit.c
Normal file
@ -0,0 +1,216 @@
|
|||||||
|
/*
|
||||||
|
* $Id: rkinit.c,v 1.1 1993/12/10 18:41:00 dglo Exp gibbs $
|
||||||
|
* $Source: /usr/src/eBones/rkinit/RCS/rkinit.c,v $
|
||||||
|
* $Author: dglo $
|
||||||
|
*
|
||||||
|
* This is an rkinit client
|
||||||
|
*/
|
||||||
|
|
||||||
|
#if !defined(lint) && !defined(SABER) && !defined(LOCORE) && defined(RCS_HDRS)
|
||||||
|
static char *rcsid = "$Id: rkinit.c,v 1.1 1993/12/10 18:41:00 dglo Exp gibbs $";
|
||||||
|
#endif /* lint || SABER || LOCORE || RCS_HDRS */
|
||||||
|
|
||||||
|
#include <stdio.h>
|
||||||
|
#include <stdlib.h>
|
||||||
|
#include <string.h>
|
||||||
|
#include <unistd.h>
|
||||||
|
#include <sys/types.h>
|
||||||
|
#include <netdb.h>
|
||||||
|
#include <pwd.h>
|
||||||
|
#include <krb.h>
|
||||||
|
#include <des.h>
|
||||||
|
#include <com_err.h>
|
||||||
|
|
||||||
|
#include <rkinit.h>
|
||||||
|
#include <rkinit_err.h>
|
||||||
|
|
||||||
|
#ifndef TRUE
|
||||||
|
#define TRUE 1
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#ifndef FALSE
|
||||||
|
#define FALSE 0
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#ifdef __STDC__
|
||||||
|
static void usage(void)
|
||||||
|
#else
|
||||||
|
static void usage()
|
||||||
|
#endif /* __STDC__ */
|
||||||
|
{
|
||||||
|
fprintf(stderr,"Usage: rkinit [host] options\n");
|
||||||
|
fprintf(stderr,
|
||||||
|
"Options: [-l username] [-k krb_realm] [-p principal] [-f tktfile]\n");
|
||||||
|
fprintf(stderr, " [-t lifetime] [-h host] [-notimeout]\n");
|
||||||
|
fprintf(stderr, "A host must be specified either with the -h option ");
|
||||||
|
fprintf(stderr, "or as the first argument.\n");
|
||||||
|
|
||||||
|
exit(1);
|
||||||
|
}
|
||||||
|
|
||||||
|
int
|
||||||
|
#ifdef __STDC__
|
||||||
|
main(int argc, char *argv[])
|
||||||
|
#else
|
||||||
|
main(argc, argv)
|
||||||
|
int argc;
|
||||||
|
char *argv[];
|
||||||
|
#endif /* __STDC__ */
|
||||||
|
{
|
||||||
|
char *whoami; /* Name of this program */
|
||||||
|
|
||||||
|
char principal[MAX_K_NAME_SZ]; /* Principal for which to get tickets */
|
||||||
|
char *host = NULL; /* Remote host */
|
||||||
|
char *username = 0; /* Username of owner of ticket */
|
||||||
|
char r_krealm[REALM_SZ]; /* Kerberos realm of remote host */
|
||||||
|
char aname[ANAME_SZ]; /* Aname of remote ticket file */
|
||||||
|
char inst[INST_SZ]; /* Instance of remote ticket file */
|
||||||
|
char realm[REALM_SZ]; /* Realm of remote ticket file */
|
||||||
|
char *tktfilename = NULL; /* Name of ticket file on remote host */
|
||||||
|
u_long lifetime = DEFAULT_TKT_LIFE; /* Lifetime of remote tickets */
|
||||||
|
int timeout = TRUE; /* Should we time out? */
|
||||||
|
rkinit_info info; /* Information needed by rkinit */
|
||||||
|
|
||||||
|
struct passwd *localid; /* To determine local id */
|
||||||
|
|
||||||
|
int status = 0; /* general error number */
|
||||||
|
|
||||||
|
int i;
|
||||||
|
|
||||||
|
bzero(r_krealm, sizeof(r_krealm));
|
||||||
|
bzero(principal, sizeof(principal));
|
||||||
|
bzero(aname, sizeof(aname));
|
||||||
|
bzero(inst, sizeof(inst));
|
||||||
|
bzero(realm, sizeof(realm));
|
||||||
|
|
||||||
|
/* Parse commandline arguements. */
|
||||||
|
if ((whoami = rindex(argv[0], '/')) == 0)
|
||||||
|
whoami = argv[0];
|
||||||
|
else
|
||||||
|
whoami++;
|
||||||
|
|
||||||
|
if (argc < 2) usage();
|
||||||
|
|
||||||
|
if (argv[1][0] != '-') {
|
||||||
|
host = argv[1];
|
||||||
|
i = 2;
|
||||||
|
}
|
||||||
|
else
|
||||||
|
i = 1;
|
||||||
|
|
||||||
|
for (/* i initialized above */; i < argc; i++) {
|
||||||
|
if (strcmp(argv[i], "-h") == NULL) {
|
||||||
|
if (++i >= argc)
|
||||||
|
usage();
|
||||||
|
else
|
||||||
|
host = argv[i];
|
||||||
|
}
|
||||||
|
else if (strcmp(argv[i], "-l") == NULL) {
|
||||||
|
if (++i >= argc)
|
||||||
|
usage();
|
||||||
|
else
|
||||||
|
username = argv[i];
|
||||||
|
}
|
||||||
|
else if (strcmp(argv[i], "-k") == NULL) {
|
||||||
|
if (++i >= argc)
|
||||||
|
usage();
|
||||||
|
else
|
||||||
|
strncpy(r_krealm, argv[i], sizeof(r_krealm) - 1);
|
||||||
|
}
|
||||||
|
else if (strcmp(argv[i], "-p") == NULL) {
|
||||||
|
if (++i >= argc)
|
||||||
|
usage();
|
||||||
|
else
|
||||||
|
strncpy(principal, argv[i], sizeof(principal) - 1);
|
||||||
|
}
|
||||||
|
else if (strcmp(argv[i], "-f") == NULL) {
|
||||||
|
if (++i >= argc)
|
||||||
|
usage();
|
||||||
|
else
|
||||||
|
tktfilename = argv[i];
|
||||||
|
}
|
||||||
|
else if (strcmp(argv[i], "-t") == NULL) {
|
||||||
|
if (++i >= argc)
|
||||||
|
usage();
|
||||||
|
else {
|
||||||
|
lifetime = atoi(argv[i])/5;
|
||||||
|
if (lifetime == 0)
|
||||||
|
lifetime = 1;
|
||||||
|
else if (lifetime > 255)
|
||||||
|
lifetime = 255;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
else if (strcmp(argv[i], "-notimeout") == NULL)
|
||||||
|
timeout = FALSE;
|
||||||
|
else
|
||||||
|
usage();
|
||||||
|
}
|
||||||
|
|
||||||
|
if (host == NULL)
|
||||||
|
usage();
|
||||||
|
|
||||||
|
/* Initialize the realm of the remote host if necessary */
|
||||||
|
if (r_krealm[0] == 0) {
|
||||||
|
/*
|
||||||
|
* Try to figure out the realm of the remote host. If the
|
||||||
|
* remote host is unknown, don't worry about it; the library
|
||||||
|
* will handle the error better and print a good error message.
|
||||||
|
*/
|
||||||
|
struct hostent *hp;
|
||||||
|
if ((hp = gethostbyname(host)))
|
||||||
|
strcpy(r_krealm, krb_realmofhost(hp->h_name));
|
||||||
|
}
|
||||||
|
|
||||||
|
/* If no username was specified, use local id on client host */
|
||||||
|
if (username == 0) {
|
||||||
|
if ((localid = getpwuid(getuid())) == 0) {
|
||||||
|
fprintf(stderr, "You can not be found in the password file.\n");
|
||||||
|
exit(1);
|
||||||
|
}
|
||||||
|
username = localid->pw_name;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* Find out who will go in the ticket file */
|
||||||
|
if (! principal[0]) {
|
||||||
|
if ((status = krb_get_tf_fullname(TKT_FILE, aname, inst, realm))
|
||||||
|
!= KSUCCESS) {
|
||||||
|
/*
|
||||||
|
* If user has no ticket file and principal was not specified,
|
||||||
|
* we will try to get tickets for username@remote_realm
|
||||||
|
*/
|
||||||
|
strcpy(aname, username);
|
||||||
|
strcpy(realm, r_krealm);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
else {
|
||||||
|
if ((status = kname_parse(aname, inst, realm, principal))
|
||||||
|
!= KSUCCESS) {
|
||||||
|
fprintf(stderr, "%s\n", krb_err_txt[status]);
|
||||||
|
exit(1);
|
||||||
|
}
|
||||||
|
if (strlen(realm) == 0) {
|
||||||
|
if (krb_get_lrealm(realm, 1) != KSUCCESS)
|
||||||
|
strcpy(realm, KRB_REALM);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
bzero((char *)&info, sizeof(info));
|
||||||
|
|
||||||
|
strcpy(info.aname, aname);
|
||||||
|
strcpy(info.inst, inst);
|
||||||
|
strcpy(info.realm, realm);
|
||||||
|
strcpy(info.sname, "krbtgt");
|
||||||
|
strcpy(info.sinst, realm);
|
||||||
|
strncpy(info.username, username, sizeof(info.username) - 1);
|
||||||
|
if (tktfilename)
|
||||||
|
strncpy(info.tktfilename, tktfilename, sizeof(info.tktfilename) - 1);
|
||||||
|
info.lifetime = lifetime;
|
||||||
|
|
||||||
|
if ((status = rkinit(host, r_krealm, &info, timeout))) {
|
||||||
|
com_err(whoami, status, "while obtaining remote tickets:");
|
||||||
|
fprintf(stderr, "%s\n", rkinit_errmsg(0));
|
||||||
|
exit(1);
|
||||||
|
}
|
||||||
|
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
Loading…
Reference in New Issue
Block a user