oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

Fixes from NetBSD via Thomas Klausner and Roland C. Dowdeswell

Browse Source
This commit is contained in:
Love Hornquist Astrand
2011-05-04 21:31:10 -07:00
parent 9a1a5e5da6
commit b1909b2daa
28 changed files with 337 additions and 782 deletions
Download Patch File Download Diff File Expand all files Collapse all files

86
admin/ktutil.8
View File

@@ -53,72 +53,43 @@
is a program for managing keytabs. is a program for managing keytabs.
Supported options: Supported options:
.Bl -tag -width Ds .Bl -tag -width Ds
.It Xo .It Fl v , Fl -verbose
.Fl v ,
.Fl -verbose
.Xc
Verbose output. Verbose output.
.El .El
.Pp .Pp
.Ar command .Ar command
can be one of the following: can be one of the following:
.Bl -tag -width srvconvert .Bl -tag -width srvconvert
.It add Xo .It add Oo Fl p Ar principal Oc Oo Fl -principal= Ns Ar principal Oc \
.Op Fl p Ar principal Oo Fl V Ar kvno Oc Oo Fl -kvno= Ns Ar kvno Oc Oo Fl e Ar enctype Oc \
.Op Fl -principal= Ns Ar principal Oo Fl -enctype= Ns Ar enctype Oc Oo Fl w Ar password Oc \
.Op Fl V Ar kvno Oo Fl -password= Ns Ar password Oc Oo Fl r Oc Oo Fl -random Oc \
.Op Fl -kvno= Ns Ar kvno Oo Fl s Oc Oo Fl -no-salt Oc Oo Fl H Oc Op Fl -hex
.Op Fl e Ar enctype
.Op Fl -enctype= Ns Ar enctype
.Op Fl w Ar password
.Op Fl -password= Ns Ar password
.Op Fl r
.Op Fl -random
.Op Fl s
.Op Fl -no-salt
.Op Fl H
.Op Fl -hex
.Xc
Adds a key to the keytab. Options that are not specified will be Adds a key to the keytab. Options that are not specified will be
prompted for. This requires that you know the password or the hex key of the prompted for. This requires that you know the password or the hex key of the
principal to add; if what you really want is to add a new principal to principal to add; if what you really want is to add a new principal to
the keytab, you should consider the the keytab, you should consider the
.Ar get .Ar get
command, which talks to the kadmin server. command, which talks to the kadmin server.
.It change Xo .It change Oo Fl r Ar realm Oc Oo Fl -realm= Ns Ar realm Oc \
.Op Fl r Ar realm Oo Fl -a Ar host Oc Oo Fl -admin-server= Ns Ar host Oc \
.Op Fl -realm= Ns Ar realm Oo Fl -s Ar port Oc Op Fl -server-port= Ns Ar port
.Op Fl -a Ar host
.Op Fl -admin-server= Ns Ar host
.Op Fl -s Ar port
.Op Fl -server-port= Ns Ar port
.Xc
Update one or several keys to new versions. By default, use the admin Update one or several keys to new versions. By default, use the admin
server for the realm of a keytab entry. Otherwise it will use the server for the realm of a keytab entry. Otherwise it will use the
values specified by the options. values specified by the options.
.Pp .Pp
If no principals are given, all the ones in the keytab are updated. If no principals are given, all the ones in the keytab are updated.
.It copy Xo .It copy Ar keytab-src Ar keytab-dest
.Ar keytab-src
.Ar keytab-dest
.Xc
Copies all the entries from Copies all the entries from
.Ar keytab-src .Ar keytab-src
to to
.Ar keytab-dest . .Ar keytab-dest .
.It get Xo .It get Oo Fl p Ar admin principal Oc \
.Op Fl p Ar admin principal Oo Fl -principal= Ns Ar admin principal Oc Oo Fl e Ar enctype Oc \
.Op Fl -principal= Ns Ar admin principal Oo Fl -enctypes= Ns Ar enctype Oc Oo Fl r Ar realm Oc \
.Op Fl e Ar enctype Oo Fl -realm= Ns Ar realm Oc Oo Fl a Ar admin server Oc \
.Op Fl -enctypes= Ns Ar enctype Oo Fl -admin-server= Ns Ar admin server Oc Oo Fl s Ar server port Oc \
.Op Fl r Ar realm Oo Fl -server-port= Ns Ar server port Oc Ar principal ...
.Op Fl -realm= Ns Ar realm
.Op Fl a Ar admin server
.Op Fl -admin-server= Ns Ar admin server
.Op Fl s Ar server port
.Op Fl -server-port= Ns Ar server port
.Ar principal ...
.Xc
For each For each
.Ar principal , .Ar principal ,
generate a new key for it (creating it if it doesn't already exist), generate a new key for it (creating it if it doesn't already exist),
@@ -128,35 +99,22 @@ If no
.Ar realm .Ar realm
is specified, the realm to operate on is taken from the first is specified, the realm to operate on is taken from the first
principal. principal.
.It list Xo .It list Oo Fl -keys Oc Op Fl -timestamp
.Op Fl -keys
.Op Fl -timestamp
.Xc
List the keys stored in the keytab. List the keys stored in the keytab.
.It remove Xo .It remove Oo Fl p Ar principal Oc Oo Fl -principal= Ns Ar principal Oc \
.Op Fl p Ar principal Oo Fl V kvno Oc Oo Fl -kvno= Ns Ar kvno Oc Oo Fl e enctype Oc \
.Op Fl -principal= Ns Ar principal Oo Fl -enctype= Ns Ar enctype Oc
.Op Fl V kvno
.Op Fl -kvno= Ns Ar kvno
.Op Fl e enctype
.Op Fl -enctype= Ns Ar enctype
.Xc
Removes the specified key or keys. Not specifying a Removes the specified key or keys. Not specifying a
.Ar kvno .Ar kvno
removes keys with any version number. Not specifying an removes keys with any version number. Not specifying an
.Ar enctype .Ar enctype
removes keys of any type. removes keys of any type.
.It rename Xo .It rename Ar from-principal Ar to-principal
.Ar from-principal
.Ar to-principal
.Xc
Renames all entries in the keytab that match the Renames all entries in the keytab that match the
.Ar from-principal .Ar from-principal
to to
.Ar to-principal . .Ar to-principal .
.It purge Xo .It purge Op Fl -age= Ns Ar age
.Op Fl -age= Ns Ar age
.Xc
Removes all old versions of a key for which there is a newer version Removes all old versions of a key for which there is a newer version
that is at least that is at least
.Ar age .Ar age

80
kadmin/kadmin.8
View File

@@ -40,34 +40,13 @@
.Sh SYNOPSIS .Sh SYNOPSIS
.Nm .Nm
.Bk -words .Bk -words
.Oo Fl p Ar string \*(Ba Xo .Op Fl p Ar string \*(Ba Fl -principal= Ns Ar string
.Fl -principal= Ns Ar string .Op Fl K Ar string \*(Ba Fl -keytab= Ns Ar string
.Xc .Op Fl c Ar file \*(Ba Fl -config-file= Ns Ar file
.Oc .Op Fl k Ar file \*(Ba Fl -key-file= Ns Ar file
.Oo Fl K Ar string \*(Ba Xo .Op Fl r Ar realm \*(Ba Fl -realm= Ns Ar realm
.Fl -keytab= Ns Ar string .Op Fl a Ar host \*(Ba Fl -admin-server= Ns Ar host
.Xc .Op Fl s Ar port number \*(Ba Fl -server-port= Ns Ar port number
.Oc
.Oo Fl c Ar file \*(Ba Xo
.Fl -config-file= Ns Ar file
.Xc
.Oc
.Oo Fl k Ar file \*(Ba Xo
.Fl -key-file= Ns Ar file
.Xc
.Oc
.Oo Fl r Ar realm \*(Ba Xo
.Fl -realm= Ns Ar realm
.Xc
.Oc
.Oo Fl a Ar host \*(Ba Xo
.Fl -admin-server= Ns Ar host
.Xc
.Oc
.Oo Fl s Ar port number \*(Ba Xo
.Fl -server-port= Ns Ar port number
.Xc
.Oc
.Op Fl l | Fl -local .Op Fl l | Fl -local
.Op Fl h | Fl -help .Op Fl h | Fl -help
.Op Fl v | Fl -version .Op Fl v | Fl -version
@@ -84,45 +63,21 @@ option).
.Pp .Pp
Supported options: Supported options:
.Bl -tag -width Ds .Bl -tag -width Ds
.It Xo .It Fl p Ar string , Fl -principal= Ns Ar string
.Fl p Ar string ,
.Fl -principal= Ns Ar string
.Xc
principal to authenticate as principal to authenticate as
.It Xo .It Fl K Ar string , Fl -keytab= Ns Ar string
.Fl K Ar string ,
.Fl -keytab= Ns Ar string
.Xc
keytab for authentication principal keytab for authentication principal
.It Xo .It Fl c Ar file , Fl -config-file= Ns Ar file
.Fl c Ar file ,
.Fl -config-file= Ns Ar file
.Xc
location of config file location of config file
.It Xo .It Fl k Ar file , Fl -key-file= Ns Ar file
.Fl k Ar file ,
.Fl -key-file= Ns Ar file
.Xc
location of master key file location of master key file
.It Xo .It Fl r Ar realm , Fl -realm= Ns Ar realm
.Fl r Ar realm ,
.Fl -realm= Ns Ar realm
.Xc
realm to use realm to use
.It Xo .It Fl a Ar host , Fl -admin-server= Ns Ar host
.Fl a Ar host ,
.Fl -admin-server= Ns Ar host
.Xc
server to contact server to contact
.It Xo .It Fl s Ar port number , Fl -server-port= Ns Ar port number
.Fl s Ar port number ,
.Fl -server-port= Ns Ar port number
.Xc
port to use port to use
.It Xo .It Fl l , Fl -local
.Fl l ,
.Fl -local
.Xc
local admin mode local admin mode
.El .El
.Pp .Pp
@@ -148,10 +103,7 @@ Commands include:
.Nm add .Nm add
.Op Fl r | Fl -random-key .Op Fl r | Fl -random-key
.Op Fl -random-password .Op Fl -random-password
.Oo Fl p Ar string \*(Ba Xo .Op Fl p Ar string \*(Ba Fl -password= Ns Ar string
.Fl -password= Ns Ar string
.Xc
.Oc
.Op Fl -key= Ns Ar string .Op Fl -key= Ns Ar string
.Op Fl -max-ticket-life= Ns Ar lifetime .Op Fl -max-ticket-life= Ns Ar lifetime
.Op Fl -max-renewable-life= Ns Ar lifetime .Op Fl -max-renewable-life= Ns Ar lifetime

29
kadmin/kadmind.8
View File

@@ -117,34 +117,17 @@ glob-style pattern.
.Pp .Pp
Supported options: Supported options:
.Bl -tag -width Ds .Bl -tag -width Ds
.It Xo .It Fl c Ar file , Fl -config-file= Ns Ar file
.Fl c Ar file ,
.Fl -config-file= Ns Ar file
.Xc
location of config file location of config file
.It Xo .It Fl k Ar file , Fl -key-file= Ns Ar file
.Fl k Ar file ,
.Fl -key-file= Ns Ar file
.Xc
location of master key file location of master key file
.It Xo .It Fl -keytab= Ns Ar keytab
.Fl -keytab= Ns Ar keytab
.Xc
what keytab to use what keytab to use
.It Xo .It Fl r Ar realm , Fl -realm= Ns Ar realm
.Fl r Ar realm ,
.Fl -realm= Ns Ar realm
.Xc
realm to use realm to use
.It Xo .It Fl d , Fl -debug
.Fl d ,
.Fl -debug
.Xc
enable debugging enable debugging
.It Xo .It Fl p Ar port , Fl -ports= Ns Ar port
.Fl p Ar port ,
.Fl -ports= Ns Ar port
.Xc
ports to listen to. By default, if run as a daemon, it listens to port ports to listen to. By default, if run as a daemon, it listens to port
749, but you can add any number of ports with this option. The port 749, but you can add any number of ports with this option. The port
string is a whitespace separated list of port specifications, with the string is a whitespace separated list of port specifications, with the

85
kcm/kcm.8
View File

@@ -127,91 +127,42 @@ the ticket itself.
.Pp .Pp
Supported options: Supported options:
.Bl -tag -width Ds .Bl -tag -width Ds
.It Xo .It Fl -cache-name= Ns Ar cachename
.Fl -cache-name= Ns Ar cachename
.Xc
system cache name system cache name
.It Xo .It Fl c Ar file , Fl -config-file= Ns Ar file
.Fl c Ar file ,
.Fl -config-file= Ns Ar file
.Xc
location of config file location of config file
.It Xo .It Fl g Ar group , Fl -group= Ns Ar group
.Fl g Ar group ,
.Fl -group= Ns Ar group
.Xc
system cache group system cache group
.It Xo .It Fl -max-request= Ns Ar size
.Fl -max-request= Ns Ar size
.Xc
max size for a kcm-request max size for a kcm-request
.It Xo .It Fl -disallow-getting-krbtgt
.Fl -disallow-getting-krbtgt
.Xc
disallow extracting any krbtgt from the disallow extracting any krbtgt from the
.Nm kcm .Nm kcm
daemon. daemon.
.It Xo .It Fl -detach
.Fl -detach
.Xc
detach from console detach from console
.It Xo .It Fl h , Fl -help
.Fl h , .It Fl k Ar principal , Fl -system-principal= Ns Ar principal
.Fl -help
.Xc
.It Xo
.Fl k Ar principal ,
.Fl -system-principal= Ns Ar principal
.Xc
system principal name system principal name
.It Xo .It Fl l Ar time , Fl -lifetime= Ns Ar time
.Fl l Ar time ,
.Fl -lifetime= Ns Ar time
.Xc
lifetime of system tickets lifetime of system tickets
.It Xo .It Fl m Ar mode , Fl -mode= Ns Ar mode
.Fl m Ar mode ,
.Fl -mode= Ns Ar mode
.Xc
octal mode of system cache octal mode of system cache
.It Xo .It Fl n , Fl -no-name-constraints
.Fl n ,
.Fl -no-name-constraints
.Xc
disable credentials cache name constraints disable credentials cache name constraints
.It Xo .It Fl r Ar time , Fl -renewable-life= Ns Ar time
.Fl r Ar time ,
.Fl -renewable-life= Ns Ar time
.Xc
renewable lifetime of system tickets renewable lifetime of system tickets
.It Xo .It Fl s Ar path , Fl -socket-path= Ns Ar path
.Fl s Ar path ,
.Fl -socket-path= Ns Ar path
.Xc
path to kcm domain socket path to kcm domain socket
.It Xo .It Fl -door-path= Ns Ar path
.Fl -door-path= Ns Ar path
.Xc
path to kcm door socket path to kcm door socket
.It Xo .It Fl S Ar principal , Fl -server= Ns Ar principal
.Fl S Ar principal ,
.Fl -server= Ns Ar principal
.Xc
server to get system ticket for server to get system ticket for
.It Xo .It Fl t Ar keytab , Fl -keytab= Ns Ar keytab
.Fl t Ar keytab ,
.Fl -keytab= Ns Ar keytab
.Xc
system keytab name system keytab name
.It Xo .It Fl u Ar user , Fl -user= Ns Ar user
.Fl u Ar user ,
.Fl -user= Ns Ar user
.Xc
system cache owner system cache owner
.It Xo .It Fl v , Fl -version
.Fl v ,
.Fl -version
.Xc
.El .El
.\".Sh ENVIRONMENT .\".Sh ENVIRONMENT
.\".Sh FILES .\".Sh FILES

39
kdc/hprop.8
View File

@@ -89,19 +89,11 @@ specified on the command by opening a TCP connection to port 754
.Pp .Pp
Supported options: Supported options:
.Bl -tag -width Ds .Bl -tag -width Ds
.It Xo .It Fl m Ar file , Fl -master-key= Ns Pa file
.Fl m Ar file ,
.Fl -master-key= Ns Pa file
.Xc
Where to find the master key to encrypt or decrypt keys with. Where to find the master key to encrypt or decrypt keys with.
.It Xo .It Fl d Ar file , Fl -database= Ns Pa file
.Fl d Ar file ,
.Fl -database= Ns Pa file
.Xc
The database to be propagated. The database to be propagated.
.It Xo .It Fl -source= Ns Ar heimdal|mit-dump|krb4-dump|kaserver
.Fl -source= Ns Ar heimdal|mit-dump
.Xc
Specifies the type of the source database. Alternatives include: Specifies the type of the source database. Alternatives include:
.Pp .Pp
.Bl -tag -width mit-dump -compact -offset indent .Bl -tag -width mit-dump -compact -offset indent
@@ -110,36 +102,21 @@ a Heimdal database
.It mit-dump .It mit-dump
a MIT Kerberos 5 dump file a MIT Kerberos 5 dump file
.El .El
.It Xo +.It Fl k Ar keytab , Fl -keytab= Ns Ar keytab
.Fl k Ar keytab ,
.Fl -keytab= Ns Ar keytab
.Xc
The keytab to use for fetching the key to be used for authenticating The keytab to use for fetching the key to be used for authenticating
to the propagation daemon(s). The key to the propagation daemon(s). The key
.Pa hprop/hostname .Pa hprop/hostname
is used from this keytab. The default is to fetch the key from the is used from this keytab. The default is to fetch the key from the
KDC database. KDC database.
.It Xo .It Fl R Ar string , Fl -v5-realm= Ns Ar string
.Fl R Ar string ,
.Fl -v5-realm= Ns Ar string
.Xc
Local realm override. Local realm override.
.It Xo .It Fl D , Fl -decrypt
.Fl D ,
.Fl -decrypt
.Xc
The encryption keys in the database can either be in clear, or The encryption keys in the database can either be in clear, or
encrypted with a master key. This option transmits the database with encrypted with a master key. This option transmits the database with
unencrypted keys. unencrypted keys.
.It Xo .It Fl E , Fl -encrypt
.Fl E ,
.Fl -encrypt
.Xc
This option transmits the database with encrypted keys. This option transmits the database with encrypted keys.
.It Xo .It Fl n , Fl -stdout
.Fl n ,
.Fl -stdout
.Xc
Dump the database on stdout, in a format that can be fed to hpropd. Dump the database on stdout, in a format that can be fed to hpropd.
.El .El
.Sh EXAMPLES .Sh EXAMPLES

29
kdc/hpropd.8
View File

@@ -73,34 +73,17 @@ are accepted.
.Pp .Pp
Options supported: Options supported:
.Bl -tag -width Ds .Bl -tag -width Ds
.It Xo .It Fl d Ar file , Fl -database= Ns Ar file
.Fl d Ar file ,
.Fl -database= Ns Ar file
.Xc
database database
.It Xo .It Fl n , Fl -stdin
.Fl n ,
.Fl -stdin
.Xc
read from stdin read from stdin
.It Xo .It Fl -print
.Fl -print
.Xc
print dump to stdout print dump to stdout
.It Xo .It Fl i , Fl -no-inetd
.Fl i ,
.Fl -no-inetd
.Xc
not started from inetd not started from inetd
.It Xo .It Fl k Ar keytab , Fl -keytab= Ns Ar keytab
.Fl k Ar keytab ,
.Fl -keytab= Ns Ar keytab
.Xc
keytab to use for authentication keytab to use for authentication
.It Xo .It Fl 4 , Fl -v4dump
.Fl 4 ,
.Fl -v4dump
.Xc
create v4 type DB create v4 type DB
.El .El
.Sh SEE ALSO .Sh SEE ALSO

53
kdc/kdc.8
View File

@@ -72,17 +72,11 @@ or from a default compiled-in value.
.Pp .Pp
Options supported: Options supported:
.Bl -tag -width Ds .Bl -tag -width Ds
.It Xo .It Fl c Ar file , Fl -config-file= Ns Ar file
.Fl c Ar file ,
.Fl -config-file= Ns Ar file
.Xc
Specifies the location of the config file, the default is Specifies the location of the config file, the default is
.Pa /var/heimdal/kdc.conf . .Pa /var/heimdal/kdc.conf .
This is the only value that can't be specified in the config file. This is the only value that can't be specified in the config file.
.It Xo .It Fl p , Fl -no-require-preauth
.Fl p ,
.Fl -no-require-preauth
.Xc
Turn off the requirement for pre-autentication in the initial AS-REQ Turn off the requirement for pre-autentication in the initial AS-REQ
for all principals. for all principals.
The use of pre-authentication makes it more difficult to do offline The use of pre-authentication makes it more difficult to do offline
@@ -95,34 +89,20 @@ pre-athentication.
The default is to require pre-authentication. The default is to require pre-authentication.
Adding the require-preauth per principal is a more flexible way of Adding the require-preauth per principal is a more flexible way of
handling this. handling this.
.It Xo .It Fl -max-request= Ns Ar size
.Fl -max-request= Ns Ar size
.Xc
Gives an upper limit on the size of the requests that the kdc is Gives an upper limit on the size of the requests that the kdc is
willing to handle. willing to handle.
.It Xo .It Fl H , Fl -enable-http
.Fl H ,
.Fl -enable-http
.Xc
Makes the kdc listen on port 80 and handle requests encapsulated in HTTP. Makes the kdc listen on port 80 and handle requests encapsulated in HTTP.
.It Xo .It Fl -no-524
.Fl -no-524
.Xc
don't respond to 524 requests don't respond to 524 requests
.It Xo .It Fl -kerberos4
.Fl -kerberos4
.Xc
respond to Kerberos 4 requests respond to Kerberos 4 requests
.It Xo .It Fl -kerberos4-cross-realm
.Fl -kerberos4-cross-realm
.Xc
respond to Kerberos 4 requests from foreign realms. respond to Kerberos 4 requests from foreign realms.
This is a known security hole and should not be enabled unless you This is a known security hole and should not be enabled unless you
understand the consequences and are willing to live with them. understand the consequences and are willing to live with them.
.It Xo .It Fl r Ar string , Fl -v4-realm= Ns Ar string
.Fl r Ar string ,
.Fl -v4-realm= Ns Ar string
.Xc
What realm this server should act as when dealing with version 4 What realm this server should act as when dealing with version 4
requests. requests.
The database can contain any number of realms, but since the version 4 The database can contain any number of realms, but since the version 4
@@ -132,15 +112,9 @@ The default is whatever is returned by
.Fn krb_get_lrealm . .Fn krb_get_lrealm .
This option is only available if the KDC has been compiled with version This option is only available if the KDC has been compiled with version
4 support. 4 support.
.It Xo .It Fl K , Fl -kaserver
.Fl K ,
.Fl -kaserver
.Xc
Enable kaserver emulation (in case it's compiled in). Enable kaserver emulation (in case it's compiled in).
.It Xo .It Fl P Ar portspec , Fl -ports= Ns Ar portspec
.Fl P Ar portspec ,
.Fl -ports= Ns Ar portspec
.Xc
Specifies the set of ports the KDC should listen on. Specifies the set of ports the KDC should listen on.
It is given as a It is given as a
white-space separated list of services or port numbers. white-space separated list of services or port numbers.
@@ -198,11 +172,8 @@ Permit anonymous tickets with no addresses.
.It Li max-kdc-datagram-reply-length = Va number .It Li max-kdc-datagram-reply-length = Va number
Maximum packet size the UDP rely that the KDC will transmit, instead Maximum packet size the UDP rely that the KDC will transmit, instead
the KDC sends back a reply telling the client to use TCP instead. the KDC sends back a reply telling the client to use TCP instead.
.It Li transited-policy = Xo .It Li transited-policy = Li always-check \*(Ba \
.Li always-check \*(Ba Li allow-per-principal | Li always-honour-request
.Li allow-per-principal |
.Li always-honour-request
.Xc
This controls how KDC requests with the This controls how KDC requests with the
.Li disable-transited-check .Li disable-transited-check
flag are handled. It can be one of: flag are handled. It can be one of:

22
kdc/kstash.8
View File

@@ -62,28 +62,16 @@ used by the KDC.
.Pp .Pp
Supported options: Supported options:
.Bl -tag -width Ds .Bl -tag -width Ds
.It Xo .It Fl e Ar string , Fl -enctype= Ns Ar string
.Fl e Ar string ,
.Fl -enctype= Ns Ar string
.Xc
the encryption type to use, defaults to DES3-CBC-SHA1. the encryption type to use, defaults to DES3-CBC-SHA1.
.It Xo .It Fl k Ar file , Fl -key-file= Ns Ar file
.Fl k Ar file ,
.Fl -key-file= Ns Ar file
.Xc
the name of the master key file. the name of the master key file.
.It Xo .It Fl -convert-file
.Fl -convert-file
.Xc
don't ask for a new master key, just read an old master key file, and don't ask for a new master key, just read an old master key file, and
write it back in the new keyfile format. write it back in the new keyfile format.
.It Xo .It Fl -random-key
.Fl -random-key
.Xc
generate a random master key. generate a random master key.
.It Xo .It Fl -master-key-fd= Ns Ar fd
.Fl -master-key-fd= Ns Ar fd
.Xc
filedescriptor to read passphrase from, if not specified the filedescriptor to read passphrase from, if not specified the
passphrase will be read from the terminal. passphrase will be read from the terminal.
.El .El

43
kdc/string2key.8
View File

@@ -65,46 +65,21 @@ performs the string-to-key function.
This is useful when you want to handle the raw key instead of the password. This is useful when you want to handle the raw key instead of the password.
Supported options: Supported options:
.Bl -tag -width Ds .Bl -tag -width Ds
.It Xo .It Fl 5 , Fl -version5
.Fl 5 ,
.Fl -version5
.Xc
Output Kerberos v5 string-to-key Output Kerberos v5 string-to-key
.It Xo .It Fl 4 , Fl -version4
.Fl 4 ,
.Fl -version4
.Xc
Output Kerberos v4 string-to-key Output Kerberos v4 string-to-key
.It Xo .It Fl a , Fl -afs
.Fl a ,
.Fl -afs
.Xc
Output AFS string-to-key Output AFS string-to-key
.It Xo .It Fl c Ar cell , Fl -cell= Ns Ar cell
.Fl c Ar cell ,
.Fl -cell= Ns Ar cell
.Xc
AFS cell to use AFS cell to use
.It Xo .It Fl w Ar password , Fl -password= Ns Ar password
.Fl w Ar password ,
.Fl -password= Ns Ar password
.Xc
Password to use Password to use
.It Xo .It Fl p Ar principal , Fl -principal= Ns Ar principal
.Fl p Ar principal ,
.Fl -principal= Ns Ar principal
.Xc
Kerberos v5 principal to use Kerberos v5 principal to use
.It Xo .It Fl k Ar string , Fl -keytype= Ns Ar string
.Fl k Ar string ,
.Fl -keytype= Ns Ar string
.Xc
Keytype Keytype
.It Xo .It Fl -version
.Fl -version
.Xc
print version print version
.It Xo .It Fl -help
.Fl -help
.Xc
.El .El

27
kpasswd/kpasswdd.8
View File

@@ -64,20 +64,14 @@ the database directly and should thus only run on the master KDC.
.Pp .Pp
Supported options: Supported options:
.Bl -tag -width Ds .Bl -tag -width Ds
.It Xo .It Fl -addresses= Ns Ar address
.Fl -addresses= Ns Ar address
.Xc
For each till the argument is given, add the address to what kpasswdd For each till the argument is given, add the address to what kpasswdd
should listen too. should listen too.
.It Xo .It Fl -check-library= Ns Ar library
.Fl -check-library= Ns Ar library
.Xc
If your system has support for dynamic loading of shared libraries, If your system has support for dynamic loading of shared libraries,
you can use an external function to check password quality. This you can use an external function to check password quality. This
option specifies which library to load. option specifies which library to load.
.It Xo .It Fl -check-function= Ns Ar function
.Fl -check-function= Ns Ar function
.Xc
This is the function to call in the loaded library. The function This is the function to call in the loaded library. The function
should look like this: should look like this:
.Pp .Pp
@@ -92,20 +86,11 @@ is the one who tries to change passwords, and
is the new password. Note that the password (in is the new password. Note that the password (in
.Fa password->data ) .Fa password->data )
is not zero terminated. is not zero terminated.
.It Xo .It Fl k Ar kspec , Fl -keytab= Ns Ar kspec
.Fl k Ar kspec ,
.Fl -keytab= Ns Ar kspec
.Xc
Keytab to get authentication key from. Keytab to get authentication key from.
.It Xo .It Fl r Ar realm , Fl -realm= Ns Ar realm
.Fl r Ar realm ,
.Fl -realm= Ns Ar realm
.Xc
Default realm. Default realm.
.It Xo .It Fl p Ar string , Fl -port= Ns Ar string
.Fl p Ar string ,
.Fl -port= Ns Ar string
.Xc
Port to listen on (default service kpasswd - 464). Port to listen on (default service kpasswd - 464).
.El .El
.Sh DIAGNOSTICS .Sh DIAGNOSTICS

2
kuser/kdestroy.1
View File

@@ -36,7 +36,7 @@
.Os HEIMDAL .Os HEIMDAL
.Sh NAME .Sh NAME
.Nm kdestroy .Nm kdestroy
.Nd remove one credental or destroy the current ticket file .Nd remove one credential or destroy the current ticket file
.Sh SYNOPSIS .Sh SYNOPSIS
.Nm .Nm
.Bk -words .Bk -words

28
kuser/kgetcred.1
View File

@@ -61,30 +61,16 @@ ticket or of a special type.
.Pp .Pp
Supported options: Supported options:
.Bl -tag -width Ds .Bl -tag -width Ds
.It Xo .It Fl -canonicalize
.Fl -canonicalize
.Xc
requests that the KDC canonicalize the principal. requests that the KDC canonicalize the principal.
.It Xo .It Fl c Ar cache , Fl -cache= Ns Ar cache
.Fl c Ar cache ,
.Fl -cache= Ns Ar cache
.Xc
the credential cache to use. the credential cache to use.
.It Xo .It Fl e Ar enctype , Fl -enctype= Ns Ar enctype
.Fl e Ar enctype ,
.Fl -enctype= Ns Ar enctype
.Xc
encryption type to use. encryption type to use.
.It Xo .It Fl -no-transit-check
.Fl -no-transit-check requests that the KDC doesn't do transit checking.
.Xc .It Fl -version
requests that the KDC doesn't do trasnit checking. .It Fl -help
.It Xo
.Fl -version
.Xc
.It Xo
.Fl -help
.Xc
.El .El
.Sh SEE ALSO .Sh SEE ALSO
.Xr kinit 1 , .Xr kinit 1 ,

84
kuser/kimpersonate.8
View File

@@ -40,28 +40,14 @@
impersonate a user when there exist a srvtab, keyfile or KeyFile impersonate a user when there exist a srvtab, keyfile or KeyFile
.Sh SYNOPSIS .Sh SYNOPSIS
.Nm .Nm
.Oo Fl s Ar string \*(Ba Xo .Op Fl s Ar string \*(Ba Fl -server= Ns Ar string
.Fl -server= Ns Ar string Oc .Op Fl c Ar string \*(Ba Fl -client= Ns Ar string
.Xc .Op Fl k Ar string \*(Ba Fl -keytab= Ns Ar string
.Oo Fl c Ar string \*(Ba Xo
.Fl -client= Ns Ar string Oc
.Xc
.Oo Fl k Ar string \*(Ba Xo
.Fl -keytab= Ns Ar string Oc
.Xc
.Op Fl 5 | Fl -krb5 .Op Fl 5 | Fl -krb5
.Oo Fl e Ar integer \*(Ba Xo .Op Fl e Ar integer \*(Ba Fl -expire-time= Ns Ar integer
.Fl -expire-time= Ns Ar integer Oc .Op Fl a Ar string \*(Ba Fl -client-address= Ns Ar string
.Xc .Op Fl t Ar string \*(Ba Fl -enc-type= Ns Ar string
.Oo Fl a Ar string \*(Ba Xo .Op Fl f Ar string \*(Ba Fl -ticket-flags= Ns Ar string
.Fl -client-address= Ns Ar string Oc
.Xc
.Oo Fl t Ar string \*(Ba Xo
.Fl -enc-type= Ns Ar string Oc
.Xc
.Oo Fl f Ar string \*(Ba Xo
.Fl -ticket-flags= Ns Ar string Oc
.Xc
.Op Fl -verbose .Op Fl -verbose
.Op Fl -version .Op Fl -version
.Op Fl -help .Op Fl -help
@@ -73,57 +59,27 @@ The service key can be read from a Kerberos 5 keytab, AFS KeyFile or
(if compiled with support for Kerberos 4) a Kerberos 4 srvtab. (if compiled with support for Kerberos 4) a Kerberos 4 srvtab.
Supported options: Supported options:
.Bl -tag -width Ds .Bl -tag -width Ds
.It Xo .It Fl s Ar string Ns , Fl -server= Ns Ar string
.Fl s Ar string Ns ,
.Fl -server= Ns Ar string
.Xc
name of server principal name of server principal
.It Xo .It Fl c Ar string Ns , Fl -client= Ns Ar string
.Fl c Ar string Ns ,
.Fl -client= Ns Ar string
.Xc
name of client principal name of client principal
.It Xo .It Fl k Ar string Ns , Fl -keytab= Ns Ar string
.Fl k Ar string Ns ,
.Fl -keytab= Ns Ar string
.Xc
name of keytab file name of keytab file
.It Xo .It Fl 5 Ns , Fl -krb5
.Fl 5 Ns ,
.Fl -krb5
.Xc
create a Kerberos 5 ticket create a Kerberos 5 ticket
.It Xo .It Fl e Ar integer Ns , Fl -expire-time= Ns Ar integer
.Fl e Ar integer Ns ,
.Fl -expire-time= Ns Ar integer
.Xc
lifetime of ticket in seconds lifetime of ticket in seconds
.It Xo .It Fl a Ar string Ns , Fl -client-address= Ns Ar string
.Fl a Ar string Ns ,
.Fl -client-address= Ns Ar string
.Xc
address of client address of client
.It Xo .It Fl t Ar string Ns , Fl -enc-type= Ns Ar string
.Fl t Ar string Ns ,
.Fl -enc-type= Ns Ar string
.Xc
encryption type encryption type
.It Xo .It Fl f Ar string Ns , Fl -ticket-flags= Ns Ar string
.Fl f Ar string Ns ,
.Fl -ticket-flags= Ns Ar string
.Xc
ticket flags for krb5 ticket ticket flags for krb5 ticket
.It Xo .It Fl -verbose
.Fl -verbose
.Xc
Verbose output Verbose output
.It Xo .It Fl -version
.Fl -version
.Xc
Print version Print version
.It Xo .It Fl -help
.Fl -help
.Xc
.El .El
.Sh FILES .Sh FILES
Uses Uses
@@ -131,9 +87,9 @@ Uses
.Pa /etc/srvtab .Pa /etc/srvtab
and and
.Pa /usr/afs/etc/KeyFile .Pa /usr/afs/etc/KeyFile
when avalible and the the when available and the
.Fl k .Fl k
is used with appropriate prefix. option is used with an appropriate prefix.
.Sh EXAMPLES .Sh EXAMPLES
.Nm .Nm
can be used in can be used in

86
kuser/kinit.1
View File

@@ -96,41 +96,23 @@ can later be used to obtain tickets for other services.
.Pp .Pp
Supported options: Supported options:
.Bl -tag -width Ds .Bl -tag -width Ds
.It Xo .It Fl c Ar cachename Fl -cache= Ns Ar cachename
.Fl c Ar cachename
.Fl -cache= Ns Ar cachename
.Xc
The credentials cache to put the acquired ticket in, if other than The credentials cache to put the acquired ticket in, if other than
default. default.
.It Xo .It Fl f Fl -no-forwardable
.Fl f
.Fl -no-forwardable
.Xc
Get ticket that can be forwarded to another host, or if the negative Get ticket that can be forwarded to another host, or if the negative
flags use, don't get a forwardable flag. flags use, don't get a forwardable flag.
.It Xo .It Fl t Ar keytabname , Fl -keytab= Ns Ar keytabname
.Fl t Ar keytabname ,
.Fl -keytab= Ns Ar keytabname
.Xc
Don't ask for a password, but instead get the key from the specified Don't ask for a password, but instead get the key from the specified
keytab. keytab.
.It Xo .It Fl l Ar time , Fl -lifetime= Ns Ar time
.Fl l Ar time ,
.Fl -lifetime= Ns Ar time
.Xc
Specifies the lifetime of the ticket. Specifies the lifetime of the ticket.
The argument can either be in seconds, or a more human readable string The argument can either be in seconds, or a more human readable string
like like
.Sq 1h . .Sq 1h .
.It Xo .It Fl p , Fl -proxiable
.Fl p ,
.Fl -proxiable
.Xc
Request tickets with the proxiable flag set. Request tickets with the proxiable flag set.
.It Xo .It Fl R , Fl -renew
.Fl R ,
.Fl -renew
.Xc
Try to renew ticket. Try to renew ticket.
The ticket must have the The ticket must have the
.Sq renewable .Sq renewable
@@ -139,46 +121,26 @@ flag set, and must not be expired.
The same as The same as
.Fl -renewable-life , .Fl -renewable-life ,
with an infinite time. with an infinite time.
.It Xo .It Fl r Ar time , Fl -renewable-life= Ns Ar time
.Fl r Ar time ,
.Fl -renewable-life= Ns Ar time
.Xc
The max renewable ticket life. The max renewable ticket life.
.It Xo .It Fl S Ar principal , Fl -server= Ns Ar principal
.Fl S Ar principal ,
.Fl -server= Ns Ar principal
.Xc
Get a ticket for a service other than krbtgt/LOCAL.REALM. Get a ticket for a service other than krbtgt/LOCAL.REALM.
.It Xo .It Fl s Ar time , Fl -start-time= Ns Ar time
.Fl s Ar time ,
.Fl -start-time= Ns Ar time
.Xc
Obtain a ticket that starts to be valid Obtain a ticket that starts to be valid
.Ar time .Ar time
(which can really be a generic time specification, like (which can really be a generic time specification, like
.Sq 1h ) .Sq 1h )
seconds into the future. seconds into the future.
.It Xo .It Fl k , Fl -use-keytab
.Fl k ,
.Fl -use-keytab
.Xc
The same as The same as
.Fl -keytab , .Fl -keytab ,
but with the default keytab name (normally but with the default keytab name (normally
.Ar FILE:/etc/krb5.keytab ) . .Ar FILE:/etc/krb5.keytab ) .
.It Xo .It Fl v , Fl -validate
.Fl v ,
.Fl -validate
.Xc
Try to validate an invalid ticket. Try to validate an invalid ticket.
.It Xo .It Fl e , Fl -enctypes= Ns Ar enctypes
.Fl e ,
.Fl -enctypes= Ns Ar enctypes
.Xc
Request tickets with this particular enctype. Request tickets with this particular enctype.
.It Xo .It Fl -password-file= Ns Ar filename
.Fl -password-file= Ns Ar filename
.Xc
read the password from the first line of read the password from the first line of
.Ar filename . .Ar filename .
If the If the
@@ -186,15 +148,10 @@ If the
is is
.Ar STDIN , .Ar STDIN ,
the password will be read from the standard input. the password will be read from the standard input.
.It Xo .It Fl -fcache-version= Ns Ar version-number
.Fl -fcache-version= Ns Ar version-number
.Xc
Create a credentials cache of version Create a credentials cache of version
.Ar version-number . .Ar version-number .
.It Xo .It Fl a , Fl -extra-addresses= Ns Ar enctypes
.Fl a ,
.Fl -extra-addresses= Ns Ar enctypes
.Xc
Adds a set of addresses that will, in addition to the systems local Adds a set of addresses that will, in addition to the systems local
addresses, be put in the ticket. addresses, be put in the ticket.
This can be useful if all addresses a client can use can't be This can be useful if all addresses a client can use can't be
@@ -204,20 +161,13 @@ Also settable via
.Li libdefaults/extra_addresses .Li libdefaults/extra_addresses
in in
.Xr krb5.conf 5 . .Xr krb5.conf 5 .
.It Xo .It Fl A , Fl -no-addresses
.Fl A ,
.Fl -no-addresses
.Xc
Request a ticket with no addresses. Request a ticket with no addresses.
.It Xo .It Fl -anonymous
.Fl -anonymous
.Xc
Request an anonymous ticket (which means that the ticket will be Request an anonymous ticket (which means that the ticket will be
issued to an anonymous principal, typically issued to an anonymous principal, typically
.Dq anonymous@REALM ) . .Dq anonymous@REALM ) .
.It Xo .It Fl -enterprise
.Fl -enterprise
.Xc
Parse principal as a enterprise (KRB5-NT-ENTERPRISE) name. Enterprise Parse principal as a enterprise (KRB5-NT-ENTERPRISE) name. Enterprise
names are email like principals that are stored in the name part of names are email like principals that are stored in the name part of
the principal, and since there are two @ characters the parser needs the principal, and since there are two @ characters the parser needs

31
kuser/klist.1
View File

@@ -60,27 +60,14 @@ known as the ticket file).
.Pp .Pp
Options supported: Options supported:
.Bl -tag -width Ds .Bl -tag -width Ds
.It Xo .It Fl c Ar cache , Fl -cache= Ns Ar cache
.Fl c Ar cache ,
.Fl -cache= Ns Ar cache
.Xc
credential cache to list credential cache to list
.It Xo .It Fl s , Fl t , Fl -test
.Fl s ,
.Fl t ,
.Fl -test
.Xc
Test for there being an active and valid TGT for the local realm of Test for there being an active and valid TGT for the local realm of
the user in the credential cache. the user in the credential cache.
.It Xo .It Fl T , Fl -tokens
.Fl T ,
.Fl -tokens
.Xc
display AFS tokens display AFS tokens
.It Xo .It Fl 5 , Fl -v5
.Fl 5 ,
.Fl -v5
.Xc
display v5 cred cache (this is the default) display v5 cred cache (this is the default)
.It Fl f .It Fl f
Include ticket flags in short form, each character stands for a Include ticket flags in short form, each character stands for a
@@ -113,10 +100,7 @@ hardware authenticated
This information is also output with the This information is also output with the
.Fl -verbose .Fl -verbose
option, but in a more verbose way. option, but in a more verbose way.
.It Xo .It Fl v , Fl -verbose
.Fl v ,
.Fl -verbose
.Xc
Verbose output. Include all possible information: Verbose output. Include all possible information:
.Bl -tag -width XXXX -offset indent .Bl -tag -width XXXX -offset indent
.It Server .It Server
@@ -141,10 +125,7 @@ the flags set on the ticket
.It Addresses .It Addresses
the set of addresses from which this ticket is valid the set of addresses from which this ticket is valid
.El .El
.It Xo .It Fl l , Fl -list-caches
.Fl l ,
.Fl -list-caches
.Xc
List the credential caches for the current users, not all cache types List the credential caches for the current users, not all cache types
supports listing multiple caches. supports listing multiple caches.
.Pp .Pp

22
kuser/klist.c
View File

@@ -39,21 +39,29 @@
#include "kcc-commands.h" #include "kcc-commands.h"
static char* static char*
printable_time(time_t t) printable_time_internal(time_t t, int x)
{ {
static char s[128]; static char s[128];
strlcpy(s, ctime(&t)+ 4, sizeof(s)); char *p;
s[15] = 0;
if ((p = ctime(&t)) == NULL)
strlcpy(s, "?", sizeof(s));
else
strlcpy(s, p + 4, sizeof(s));
s[x] = 0;
return s; return s;
} }
static char*
printable_time(time_t t)
{
return printable_time_internal(t, 20);
}
static char* static char*
printable_time_long(time_t t) printable_time_long(time_t t)
{ {
static char s[128]; return printable_time_internal(t, 20);
strlcpy(s, ctime(&t)+ 4, sizeof(s));
s[20] = 0;
return s;
} }
#define COL_ISSUED NP_(" Issued","") #define COL_ISSUED NP_(" Issued","")

97
lib/gssapi/gssapi.3
View File

@@ -53,57 +53,52 @@ These functions constitute the gssapi library,
.Em libgssapi . .Em libgssapi .
Declarations for these functions may be obtained from the include file Declarations for these functions may be obtained from the include file
.Pa gssapi.h . .Pa gssapi.h .
.sp 2 .Bl -column -compact
.nf .It Sy Name/Page
.ta \w'gss_inquire_names_for_mech'u+2n +\w'Description goes here'u .It Xr gss_accept_sec_context 3
\fIName/Page\fP \fIDescription\fP .It Xr gss_acquire_cred 3
.ta \w'gss_inquire_names_for_mech'u+2n +\w'Description goes here'u+6nC .It Xr gss_add_cred 3
.sp 5p .It Xr gss_add_oid_set_member 3
gss_accept_sec_context.3 .It Xr gss_canonicalize_name 3
gss_acquire_cred.3 .It Xr gss_compare_name 3
gss_add_cred.3 .It Xr gss_context_time 3
gss_add_oid_set_member.3 .It Xr gss_create_empty_oid_set 3
gss_canonicalize_name.3 .It Xr gss_delete_sec_context 3
gss_compare_name.3 .It Xr gss_display_name 3
gss_context_time.3 .It Xr gss_display_status 3
gss_create_empty_oid_set.3 .It Xr gss_duplicate_name 3
gss_delete_sec_context.3 .It Xr gss_export_name 3
gss_display_name.3 .It Xr gss_export_sec_context 3
gss_display_status.3 .It Xr gss_get_mic 3
gss_duplicate_name.3 .It Xr gss_import_name 3
gss_export_name.3 .It Xr gss_import_sec_context 3
gss_export_sec_context.3 .It Xr gss_indicate_mechs 3
gss_get_mic.3 .It Xr gss_init_sec_context 3
gss_import_name.3 .It Xr gss_inquire_context 3
gss_import_sec_context.3 .It Xr gss_inquire_cred 3
gss_indicate_mechs.3 .It Xr gss_inquire_cred_by_mech 3
gss_init_sec_context.3 .It Xr gss_inquire_mechs_for_name 3
gss_inquire_context.3 .It Xr gss_inquire_names_for_mech 3
gss_inquire_cred.3 .It Xr gss_krb5_ccache_name 3
gss_inquire_cred_by_mech.3 .It Xr gss_krb5_compat_des3_mic 3
gss_inquire_mechs_for_name.3 .It Xr gss_krb5_copy_ccache 3
gss_inquire_names_for_mech.3 .It Xr gss_krb5_extract_authz_data_from_sec_context 3
gss_krb5_ccache_name.3 .It Xr gss_krb5_import_ccache 3
gss_krb5_compat_des3_mic.3 .It Xr gss_process_context_token 3
gss_krb5_copy_ccache.3 .It Xr gss_release_buffer 3
gss_krb5_extract_authz_data_from_sec_context.3 .It Xr gss_release_cred 3
gss_krb5_import_ccache.3 .It Xr gss_release_name 3
gss_process_context_token.3 .It Xr gss_release_oid_set 3
gss_release_buffer.3 .It Xr gss_seal 3
gss_release_cred.3 .It Xr gss_sign 3
gss_release_name.3 .It Xr gss_test_oid_set_member 3
gss_release_oid_set.3 .It Xr gss_unseal 3
gss_seal.3 .It Xr gss_unwrap 3
gss_sign.3 .It Xr gss_verify 3
gss_test_oid_set_member.3 .It Xr gss_verify_mic 3
gss_unseal.3 .It Xr gss_wrap 3
gss_unwrap.3 .It Xr gss_wrap_size_limit 3
gss_verify.3 .El
gss_verify_mic.3
gss_wrap.3
gss_wrap_size_limit.3
.ta
.Fi
.Sh COMPATIBILITY .Sh COMPATIBILITY
The The
.Nm Heimdal .Nm Heimdal

9
lib/hx509/revoke.c
View File

@@ -1054,8 +1054,13 @@ static char *
printable_time(time_t t) printable_time(time_t t)
{ {
static char s[128]; static char s[128];
strlcpy(s, ctime(&t)+ 4, sizeof(s)); char *p;
s[20] = 0; if ((p = ctime(&t)) == NULL)
strlcpy(s, "?", sizeof(s));
else {
strlcpy(s, p + 4, sizeof(s));
s[20] = 0;
}
return s; return s;
} }

48
lib/kadm5/iprop-log.8
View File

@@ -83,28 +83,17 @@ maintain the iprop log file
.Sh DESCRIPTION .Sh DESCRIPTION
Supported options: Supported options:
.Bl -tag -width Ds .Bl -tag -width Ds
.It Xo .It Fl -version
.Fl -version .It Fl h , Fl -help
.Xc
.It Xo
.Fl h ,
.Fl -help
.Xc
.El .El
.Pp .Pp
command can be one of the following: command can be one of the following:
.Bl -tag -width truncate .Bl -tag -width truncate
.It truncate .It truncate
.Bl -tag -width Ds .Bl -tag -width Ds
.It Xo .It Fl c Ar file , Fl -config-file= Ns Ar file
.Fl c Ar file ,
.Fl -config-file= Ns Ar file
.Xc
configuration file configuration file
.It Xo .It Fl r Ar string , Fl -realm= Ns Ar string
.Fl r Ar string ,
.Fl -realm= Ns Ar string
.Xc
realm realm
.El .El
.Pp .Pp
@@ -113,10 +102,7 @@ last entry of the old log. If the log is truncted by emptying the
file, the log will start over at the first version (0). file, the log will start over at the first version (0).
.It dump .It dump
.Bl -tag -width Ds .Bl -tag -width Ds
.It Xo .It Fl c Ar file , Fl -config-file= Ns Ar file
.Fl c Ar file ,
.Fl -config-file= Ns Ar file
.Xc
configuration file configuration file
.It Xo .It Xo
.Fl r Ar string , .Fl r Ar string ,
@@ -128,23 +114,15 @@ realm
Print out all entries in the log to standard output. Print out all entries in the log to standard output.
.It replay .It replay
.Bl -tag -width Ds .Bl -tag -width Ds
.It Xo .It Fl -start-version= Ns Ar version-number
.Fl -start-version= Ns Ar version-number
.Xc
start replay with this version start replay with this version
.It Xo .It Xo
.Fl -end-version= Ns Ar version-number .Fl -end-version= Ns Ar version-number
.Xc .Xc
end replay with this version end replay with this version
.It Xo .It Fl c Ar file , Fl -config-file= Ns Ar file
.Fl c Ar file ,
.Fl -config-file= Ns Ar file
.Xc
configuration file configuration file
.It Xo .It Fl r Ar string , Fl -realm= Ns Ar string
.Fl r Ar string ,
.Fl -realm= Ns Ar string
.Xc
realm realm
.El .El
.Pp .Pp
@@ -152,15 +130,9 @@ Replay the changes from specified entries (or all if none is
specified) in the transaction log to the database. specified) in the transaction log to the database.
.It last-version .It last-version
.Bl -tag -width Ds .Bl -tag -width Ds
.It Xo .It Fl c Ar file , Fl -config-file= Ns Ar file
.Fl c Ar file ,
.Fl -config-file= Ns Ar file
.Xc
configuration file configuration file
.It Xo .It Fl r Ar string , Fl -realm= Ns Ar string
.Fl r Ar string ,
.Fl -realm= Ns Ar string
.Xc
realm realm
.El .El
.Pp .Pp

140
lib/kadm5/iprop.8
View File

@@ -38,51 +38,49 @@
.Nm iprop , .Nm iprop ,
.Nm ipropd-master , .Nm ipropd-master ,
.Nm ipropd-slave .Nm ipropd-slave
.Nd .Nd propagate changes to a Heimdal Kerberos master KDC to slave KDCs
propagate changes to a Heimdal Kerberos master KDC to slave KDCs
.Sh SYNOPSIS .Sh SYNOPSIS
.Nm ipropd-master .Nm ipropd-master
.Oo Fl c Ar string \*(Ba Xo .Oo Fl c Ar string \*(Ba Xo
.Fl -config-file= Ns Ar string .Fl Fl config-file= Ns Ar string
.Xc .Xc
.Oc .Oc
.Oo Fl r Ar string \*(Ba Xo .Oo Fl r Ar string \*(Ba Xo
.Fl -realm= Ns Ar string .Fl Fl realm= Ns Ar string
.Xc .Xc
.Oc .Oc
.Oo Fl k Ar kspec \*(Ba Xo .Oo Fl k Ar kspec \*(Ba Xo
.Fl -keytab= Ns Ar kspec .Fl Fl keytab= Ns Ar kspec
.Xc .Xc
.Oc .Oc
.Oo Fl d Ar file \*(Ba Xo .Oo Fl d Ar file \*(Ba Xo
.Fl -database= Ns Ar file .Fl Fl database= Ns Ar file
.Xc .Xc
.Oc .Oc
.Op Fl -slave-stats-file= Ns Ar file .Op Fl Fl slave-stats-file= Ns Ar file
.Op Fl -time-missing= Ns Ar time .Op Fl Fl time-missing= Ns Ar time
.Op Fl -time-gone= Ns Ar time .Op Fl Fl time-gone= Ns Ar time
.Op Fl -detach .Op Fl Fl detach
.Op Fl -version .Op Fl Fl version
.Op Fl -help .Op Fl Fl help
.Nm ipropd-slave .Nm ipropd-slave
.Oo Fl c Ar string \*(Ba Xo .Oo Fl c Ar string \*(Ba Xo
.Fl -config-file= Ns Ar string .Fl Fl config-file= Ns Ar string
.Xc .Xc
.Oc .Oc
.Oo Fl r Ar string \*(Ba Xo .Oo Fl r Ar string \*(Ba Xo
.Fl -realm= Ns Ar string .Fl Fl realm= Ns Ar string
.Xc .Xc
.Oc .Oc
.Oo Fl k Ar kspec \*(Ba Xo .Oo Fl k Ar kspec \*(Ba Xo
.Fl -keytab= Ns Ar kspec .Fl Fl keytab= Ns Ar kspec
.Xc .Xc
.Oc .Oc
.Op Fl -time-lost= Ns Ar time .Op Fl Fl time-lost= Ns Ar time
.Op Fl -detach .Op Fl Fl detach
.Op Fl -version .Op Fl Fl version
.Op Fl -help .Op Fl Fl help
.Ar master .Ar master
.Pp
.Sh DESCRIPTION .Sh DESCRIPTION
.Nm ipropd-master .Nm ipropd-master
is used to propagate changes to a Heimdal Kerberos database from the is used to propagate changes to a Heimdal Kerberos database from the
@@ -96,9 +94,9 @@ file in the KDC's database directory, e.g.\&
.Pa /var/heimdal/slaves . .Pa /var/heimdal/slaves .
This has principals one per-line of the form This has principals one per-line of the form
.Dl iprop/ Ns Ar slave Ns @ Ns Ar REALM .Dl iprop/ Ns Ar slave Ns @ Ns Ar REALM
where where
.Ar slave .Ar slave
is the hostname of the slave server in the given is the hostname of the slave server in the given
.Ar REALM , .Ar REALM ,
e.g.\& e.g.\&
.Dl iprop/kerberos-1.example.com@EXAMPLE.COM .Dl iprop/kerberos-1.example.com@EXAMPLE.COM
@@ -110,20 +108,23 @@ In contrast to
.Xr hprop 8 , .Xr hprop 8 ,
which sends the whole database to the slaves regularly, which sends the whole database to the slaves regularly,
.Nm .Nm
normally sends only the changes as they happen on the master. The normally sends only the changes as they happen on the master.
master keeps track of all the changes by assigning a version number to The master keeps track of all the changes by assigning a version
every change to the database. The slaves know which was the latest number to every change to the database.
version they saw, and in this way it can be determined if they are in The slaves know which was the latest version they saw, and in this
sync or not. A log of all the changes is kept on the master. When a way it can be determined if they are in sync or not.
slave is at an older version than the oldest one in the log, the whole A log of all the changes is kept on the master.
database has to be sent. When a slave is at an older version than the oldest one in the log,
the whole database has to be sent.
.Pp .Pp
The changes are propagated over a secure channel (on port 2121 by The changes are propagated over a secure channel (on port 2121 by
default). This should normally be defined as default).
This should normally be defined as
.Dq iprop/tcp .Dq iprop/tcp
in in
.Pa /etc/services .Pa /etc/services
or another source of the services database. The master and slaves or another source of the services database.
The master and slaves
must each have access to a keytab with keys for the must each have access to a keytab with keys for the
.Nm iprop .Nm iprop
service principal on the local host. service principal on the local host.
@@ -136,78 +137,37 @@ file (e.g.\&
Supported options for Supported options for
.Nm ipropd-master : .Nm ipropd-master :
.Bl -tag -width Ds .Bl -tag -width Ds
.It Xo .It Fl c Ar string , Fl Fl config-file= Ns Ar string
.Fl c Ar string , .It Fl r Ar string , Fl Fl realm= Ns Ar string
.Fl -config-file= Ns Ar string .It Fl k Ar kspec , Fl Fl keytab= Ns Ar kspec
.Xc
.It Xo
.Fl r Ar string ,
.Fl -realm= Ns Ar string
.Xc
.It Xo
.Fl k Ar kspec ,
.Fl -keytab= Ns Ar kspec
.Xc
keytab to get authentication from keytab to get authentication from
.It Xo .It Fl d Ar file , Fl Fl database= Ns Ar file
.Fl d Ar file ,
.Fl -database= Ns Ar file
.Xc
Database (default per KDC) Database (default per KDC)
.It Xo .It Fl Fl slave-stats-file= Ns Ar file
.Fl -slave-stats-file= Ns Ar file
.Xc
file for slave status information file for slave status information
.It Xo .It Fl Fl time-missing= Ns Ar time
.Fl -time-missing= Ns Ar time
.Xc
time before slave is polled for presence (default 2 min) time before slave is polled for presence (default 2 min)
.It Xo .It Fl Fl time-gone= Ns Ar time
.Fl -time-gone= Ns Ar time
.Xc
time of inactivity after which a slave is considered gone (default 5 min) time of inactivity after which a slave is considered gone (default 5 min)
.It Xo .It Fl Fl detach
.Fl -detach
.Xc
detach from console detach from console
.It Xo .It Fl Fl version
.Fl -version .It Fl Fl help
.Xc
.It Xo
.Fl -help
.Xc
.El .El
.Pp .Pp
Supported options for Supported options for
.Nm ipropd-slave : .Nm ipropd-slave :
.Bl -tag -width Ds .Bl -tag -width Ds
.It Xo .It Fl c Ar string , Fl Fl config-file= Ns Ar string
.Fl c Ar string , .It Fl r Ar string , Fl Fl realm= Ns Ar string
.Fl -config-file= Ns Ar string .It Fl k Ar kspec , Fl Fl keytab= Ns Ar kspec
.Xc
.It Xo
.Fl r Ar string ,
.Fl -realm= Ns Ar string
.Xc
.It Xo
.Fl k Ar kspec ,
.Fl -keytab= Ns Ar kspec
.Xc
keytab to get authentication from keytab to get authentication from
.It Xo .It Fl Fl time-lost= Ns Ar time
.Fl -time-lost= Ns Ar time
.Xc
time before server is considered lost (default 5 min) time before server is considered lost (default 5 min)
.It Xo .It Fl Fl detach
.Fl -detach
.Xc
detach from console detach from console
.It Xo .It Fl Fl version
.Fl -version .It Fl Fl help
.Xc
.It Xo
.Fl -help
.Xc
.El .El
Time arguments for the relevant options above may be specified in forms Time arguments for the relevant options above may be specified in forms
like 5 min, 300 s, or simply a number of seconds. like 5 min, 300 s, or simply a number of seconds.

2
lib/krb5/auth_context.c
View File

@@ -262,6 +262,7 @@ krb5_auth_con_getaddrs(krb5_context context,
return 0; return 0;
} }
/* coverity[+alloc : arg-*2] */
static krb5_error_code static krb5_error_code
copy_key(krb5_context context, copy_key(krb5_context context,
krb5_keyblock *in, krb5_keyblock *in,
@@ -289,6 +290,7 @@ krb5_auth_con_getlocalsubkey(krb5_context context,
return copy_key(context, auth_context->local_subkey, keyblock); return copy_key(context, auth_context->local_subkey, keyblock);
} }
/* coverity[+alloc : arg-*2] */
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_auth_con_getremotesubkey(krb5_context context, krb5_auth_con_getremotesubkey(krb5_context context,
krb5_auth_context auth_context, krb5_auth_context auth_context,

2
lib/krb5/krb5_get_in_cred.3
View File

@@ -169,7 +169,7 @@ but are more specialized.
.Nm krb5_get_in_tkt_with_password .Nm krb5_get_in_tkt_with_password
uses the clients password to authenticate. uses the clients password to authenticate.
If the password argument is If the password argument is
.DV NULL .Dv NULL
the user user queried with the default password query function. the user user queried with the default password query function.
.Pp .Pp
.Nm krb5_get_in_tkt_with_keytab .Nm krb5_get_in_tkt_with_keytab

2
lib/krb5/krb5_init_context.3
View File

@@ -219,7 +219,7 @@ error-code handler
to the specified to the specified
.Fa context . .Fa context .
The error handler must generated by the the re-rentrant version of the The error handler must generated by the the re-rentrant version of the
.Xr compile_et 3 .Xr compile_et 1
program. program.
.Fn krb5_add_extra_addresses .Fn krb5_add_extra_addresses
add a list of addresses that should be added when requesting tickets. add a list of addresses that should be added when requesting tickets.

1
lib/krb5/salt.c
View File

@@ -33,6 +33,7 @@
#include "krb5_locl.h" #include "krb5_locl.h"
/* coverity[+alloc : arg-*3] */
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_salttype_to_string (krb5_context context, krb5_salttype_to_string (krb5_context context,
krb5_enctype etype, krb5_enctype etype,

63
lib/roken/get_window_size.c
View File

@@ -58,32 +58,46 @@
#include "roken.h" #include "roken.h"
ROKEN_LIB_FUNCTION int ROKEN_LIB_CALL ROKEN_LIB_FUNCTION int ROKEN_LIB_CALL
get_window_size(int fd, struct winsize *wp) get_window_size(int fd, int *lines, int *columns)
{ {
int ret = -1; int ret;
char *s;
memset(wp, 0, sizeof(*wp));
#if defined(TIOCGWINSZ) #if defined(TIOCGWINSZ)
ret = ioctl(fd, TIOCGWINSZ, wp); {
struct winsize ws;
ret = ioctl(fd, TIOCGWINSZ, &ws);
if (ret != -1) {
if (lines)
*lines = ws.ws_row;
if (columns)
*columns = ws.ws_col;
return 0;
}
}
#elif defined(TIOCGSIZE) #elif defined(TIOCGSIZE)
{ {
struct ttysize ts; struct ttysize ts;
ret = ioctl(fd, TIOCGSIZE, &ts); ret = ioctl(fd, TIOCGSIZE, &ts);
if(ret == 0) { if (ret != -1) {
wp->ws_row = ts.ts_lines; if (lines)
wp->ws_col = ts.ts_cols; *lines = ts.ws_lines;
} if (columns)
*columns = ts.ts_cols;
return 0;
}
} }
#elif defined(HAVE__SCRSIZE) #elif defined(HAVE__SCRSIZE)
{ {
int dst[2]; int dst[2];
_scrsize(dst); _scrsize(dst);
wp->ws_row = dst[1]; if (lines)
wp->ws_col = dst[0]; *lines = dst[1];
ret = 0; if (columns)
*columns = dst[0];
return 0;
} }
#elif defined(_WIN32) #elif defined(_WIN32)
{ {
@@ -100,14 +114,17 @@ get_window_size(int fd, struct winsize *wp)
} }
} }
#endif #endif
if (ret != 0) { if (columns) {
char *s; if ((s = getenv("COLUMNS")))
if((s = getenv("COLUMNS"))) *columns = atoi(s);
wp->ws_col = atoi(s); else
if((s = getenv("LINES"))) return -1;
wp->ws_row = atoi(s);
if(wp->ws_col > 0 && wp->ws_row > 0)
ret = 0;
} }
return ret; if (lines) {
if ((s = getenv("LINES")))
*lines = atoi(s);
else
return -1;
}
return 0;
} }

5
lib/roken/getarg.c
View File

@@ -228,7 +228,6 @@ arg_printusage_i18n (struct getargs *args,
size_t i, max_len = 0; size_t i, max_len = 0;
char buf[128]; char buf[128];
int col = 0, columns; int col = 0, columns;
struct winsize ws;
if (progname == NULL) if (progname == NULL)
progname = getprogname(); progname = getprogname();
@@ -240,9 +239,7 @@ arg_printusage_i18n (struct getargs *args,
mandoc_template(args, num_args, progname, extra_string, i18n); mandoc_template(args, num_args, progname, extra_string, i18n);
return; return;
} }
if(get_window_size(2, &ws) == 0) if(get_window_size(2, NULL, &columns) == -1)
columns = ws.ws_col;
else
columns = 80; columns = 80;
col = 0; col = 0;
col += fprintf (stderr, "%s: %s", usage, progname); col += fprintf (stderr, "%s: %s", usage, progname);

2
lib/roken/roken.h.in
View File

@@ -759,7 +759,7 @@ struct winsize {
}; };
#endif #endif
ROKEN_LIB_FUNCTION int ROKEN_LIB_CALL get_window_size(int fd, struct winsize *); ROKEN_LIB_FUNCTION int ROKEN_LIB_CALL get_window_size(int fd, int *, int *);
#ifndef HAVE_VSYSLOG #ifndef HAVE_VSYSLOG
#define vsyslog rk_vsyslog #define vsyslog rk_vsyslog

2
lib/vers/print_version.c
View File

@@ -52,5 +52,7 @@ print_version(const char *progname)
package_list = "no version information"; package_list = "no version information";
fprintf(stderr, "%s (%s)\n", progname, package_list); fprintf(stderr, "%s (%s)\n", progname, package_list);
fprintf(stderr, "Copyright 1995-2011 Kungliga Tekniska Högskolan\n"); fprintf(stderr, "Copyright 1995-2011 Kungliga Tekniska Högskolan\n");
#ifdef PACKAGE_BUGREPORT
fprintf(stderr, "Send bug-reports to %s\n", PACKAGE_BUGREPORT); fprintf(stderr, "Send bug-reports to %s\n", PACKAGE_BUGREPORT);
#endif
} }