RKINIT(1)

NAME
rkinit - establish kerberos tickets safely on a remote host

SYNOPSIS
rkinit [ host ] [ -p principal ] [ -l username ] [ -k kerberos_realm ] [ -f ticket_file ] [ -h remote_host ] [ -t ticket_lifetime ] [ -notimeout ] A host name must be specified either as the first command line argument or following a -h flag. If redundant command line arguments are given, the last one to appear takes precedence.

DESCRIPTION
rkinit is a program that allows a user to establish kerberos tickets on a remote host registered for rlogin service. This can be done without the user's kerberos password ever leaving the client machine. In order to establish tickets remotely without the use of something like rkinit, one would have to log in to the remote host and run kinit(1). rkinit followed by rlogin can be thought of as a safe substitute for rlogin followed kinit. rkinit uses the same access checking mechanism as rlogin. That means that rkinit can be used to create any tickets for user A on remote host B if and only if A's tickets would entitle a login to B. This means that one can create remote tickets for himself or for another user if he is in that user's .klogin file. rkinit understands the following command line options:

-p principal
    If principal, in the format name[.inst][@realm] is specified, the tickets created on the remote host will be the tickets indicated by the principal field. If this option is not given, the following defaults are used: If the user running rkinit does not have tickets on the client machine, rkinit will prompt for a password and behave effectively as if the user had invoked kinit on the specified remote host; i.e., the tickets established will be owned on the remote host by the user who invoked rkinit and will be for the local realm of the remote host. If the user running rkinit already has tickets, rkinit will prompt for a password and create tickets whose principal matches that of the tickets that the user already has.

-l username
    If username is specified, the ticket file on the remote host will be owned by the user username. If it is not specified, the tickets will be owned by the remote user whose login name matches that of the user invoking rkinit.

-r realm
    realm is used to tell rkinit what realm the remote host is in. This option should not usually have to be used since rkinit uses krb_realmofhost(3) to determine the remote host's kerberos realm. Note that this is distinct from realm as specified in principal, which refers to the realm of the remote tickets.

-f ticket_file
    This option is used to specify the name of the ticket file that should be used on the remote host. Note that if you specify a location for the ticket file that is other than the default, you will have to set the environment variable KRBTKFILE to that filename once you get to the remote host in order for you to use the tickets. If a ticket file is not specified, the tickets will be placed in the default location as specified by tkt_file(3). On a UNIX host, this is /tmp/tkt<uid>, where <uid> is the user id of the person who owns the remote ticket file.

-h remote_host
    remote host is the host on which remote tickets are being obtained. This option can be used in place of specifying the host as the first command line argument.

-t ticket_lifetime
    ticket lifetime is the lifetime in minutes of the remote tickets. If it is not specified, the default ticket life time (as defined in krb.h) is used.

-notimeout
    prevents the client from timing out. This is mainly useful only for debugging since the rkinit server also times out.

EXAMPLES
In the following examples, tabetha and soup are machines in the ATHENA.MIT.EDU kerberos realm and local is a user who can log in to soup and has qjb.root@ATHENA.MIT.EDU in his .klogin file. % rkinit tabetha
Kerberos initialization (tabetha)
Password for qjb@ATHENA.MIT.EDU:
%
% rkinit soup -p qjb.root -l local
Kerberos initialization (soup): tickets will be owned by local
Password for qjb.root@ATHENA.MIT.EDU:
%

SEE ALSO
rkinitd(8), kerberos(1), kerberos(3), kinit(1)

AUTHOR
Emanuel Jay Berkenbilt (MIT-Project Athena)