-a When run with either the -K flag or a command, always renew tickets each time k5start wakes up.
Without this option, k5start will only try to renew a ticket as often as necessary to prevent the
ticket from expiring. With this option, k5start will renew tickets according to the interval
specified with the -K flag.
This behavior probably should have been the default behavior of -K. The default was not changed to
avoid changes for existing users, but for new applications, consider always using -a with -K.
This option is important if another program is manipulating the ticket cache that k5start is using.
For example, if another program is automatically renewing a ticket more frequently than k5start, then
k5start will never see a ticket that is close to expiring and will therefore, by default, never try
to renew the ticket. This means that k5start will also never renew AFS tokens, even if the -t option
was given, since k5start only renews AFS tokens after it successfully renews a ticket. If this
option is specified in such a situation, k5start will renew its ticket every time it checks the
ticket, so AFS tokens will be renewed.
This argument is only valid in combination with either -K or a command to run.
-b After starting, detach from the controlling terminal and run in the background. This option only
makes sense in combination with -K or a command that k5start will be running and can only be used if
a keytab is specified with -f. k5start will not background itself until after it has tried
authenticating once, so that any initial errors will be reported, but it will then redirect output to
/dev/null and no subsequent errors will be reported.
If this flag is given, k5start will also change directories to "/". All paths (such as to a command
to run or a PID file) should therefore be given as absolute, not relative, paths.
If used in conjunction with a command to run, that command will also run in the background and will
also have its input and output redirected to /dev/null. It will have to report any errors via some
other mechanism for the errors to be seen.
Note that on Mac OS X, the default ticket cache type is per-session and using the -b flag will
disassociate k5start from the existing ticket cache. When using -b in conjunction with -K on Mac OS
X, you probably also want to use the -k flag to specify a ticket cache file and force the use of a
file cache.
When using this option, consider also using -L to report k5start errors to syslog.
-cchildpidfile
Save the process ID (PID) of the child process into childpidfile. childpidfile is created if it
doesn't exist and overwritten if it does exist. This option is only allowed when a command was given
on the command line and is most useful in conjunction with -b to allow management of the running
child process.
Note that, when used with -b, the PID file is written out after k5start is backgrounded and changes
its working directory to /, so relative paths for the PID file will be relative to / (probably not
what you want).
-F Do not get forwardable tickets even if the local configuration says to get forwardable tickets by
default. Without this flag, k5start does whatever the library default is.
-fkeytab
Authenticate using the keytab keytab rather than asking for a password. A key for the client
principal must be present in keytab.
-ggroup
After creating the ticket cache, change its group ownership to group, which may be either the name of
a group or a numeric group ID. Ticket caches are created with 0600 permissions by default, so this
will have no useful effect unless used with -m.
-Hminutes
Check for a happy ticket, defined as one that has a remaining lifetime of at least minutes minutes.
If such a ticket is found, do not attempt authentication. Instead, just run the command (if one was
specified) or exit immediately with status 0 (if none was). Otherwise, try to obtain a new ticket
and then run the command, if any.
If -H is used with -t, the external program will always be run even if a ticket with a sufficient
remaining lifetime was found.
If -H is used with -K, k5start will not exit immediately. Instead, the specified remaining lifetime
will replace the default value of two minutes, meaning that k5start will ensure, each time it wakes
up, that the ticket has a remaining lifetime of the minutes argument. This is an alternative to -a
to ensure that tickets always have a certain minimal amount of lifetime remaining.
-h Display a usage message and exit.
-Iserviceinstance
The instance portion of the service principal. The default is the default realm of the machine.
Note that unlike the client principal, a non-default service principal must be specified with -I and
-S; one cannot provide the instance portion as part of the argument to -S.
-iclientinstance
Specifies the instance portion of the principal. This option doesn't make sense except in
combination with -u. Note that the instance can be specified as part of username through the normal
convention of appending a slash and then the instance, so one never has to use this option.
-Kminutes
Run in daemon mode to keep a ticket alive indefinitely. The program reawakens after minutes minutes,
checks if the ticket will expire before or less than two minutes after the next scheduled check, and
gets a new ticket if needed. (In other words, it ensures that the ticket will always have a
remaining lifetime of at least two minutes.) If the -H flag is also given, the lifetime specified by
it replaces the two minute default.
If this option is not given but a command was given on the command line, the default interval is 60
minutes (1 hour).
If an error occurs in refreshing the ticket cache, the wake-up interval will be shortened to one
minute and the operation retried at that interval for as long as the error persists.
-kticketcache
Use ticketcache as the ticket cache rather than the contents of the environment variable KRB5CCNAME
or the library default. ticketcache may be any ticket cache identifier recognized by the underlying
Kerberos libraries. This generally supports a path to a file, with or without a leading "FILE:"
string, but may also support other ticket cache types.
If any of -o, -g, or -m are given, ticketcache must be either a simple path to a file or start with
"FILE:" or "WRFILE:".
-L Report messages to syslog as well as to standard output or standard error. All messages will be
logged with facility LOG_DAEMON. Regular messages that are displayed on standard output are logged
with level LOG_NOTICE. Errors that don't cause k5start to terminate are logged with level
LOG_WARNING. Fatal errors are logged with level LOG_ERR.
This is useful when debugging problems in combination with -b.
-ltimestring
Set the ticket lifetime. timestring should be in a format recognized by the Kerberos libraries for
specifying times, such as "10h" (ten hours) or "10m" (ten minutes). Known units are "s", "m", "h",
and "d". For more information, see kinit(1).
-mmode
After creating the ticket cache, change its file permissions to mode, which must be a file mode in
octal (640 or 444, for example).
Setting a mode that does not allow k5start to read or write to the ticket cache will cause k5start to
fail and exit when using the -K option or running a command.
-n Ignored, present for option compatibility with the now-obsolete k4start.
-oowner
After creating the ticket cache, change its ownership to owner, which may be either the name of a
user or a numeric user ID. If owner is the name of a user and -g was not also given, also change the
group ownership of the ticket cache to the default group for that user.
-P Do not get proxiable tickets even if the local configuration says to get proxiable tickets by
default. Without this flag, k5start does whatever the library default is.
-ppidfile
Save the process ID (PID) of the running k5start process into pidfile. pidfile is created if it
doesn't exist and overwritten if it does exist. This option is most useful in conjunction with -b to
allow management of the running k5start daemon.
Note that, when used with -b the PID file is written out after k5start is backgrounded and changes
its working directory to /, so relative paths for the PID file will be relative to / (probably not
what you want).
-q Quiet. Suppresses the printing of the initial banner message saying what Kerberos principal tickets
are being obtained for, and also suppresses the password prompt when the -s option is given.
-rservicerealm
The realm for the service principal. This defaults to the default local realm.
-Sservicename
Specifies the principal for which k5start is getting a service ticket. The default value is
"krbtgt", to obtain a ticket-granting ticket. This option (along with -I) may be used if one only
needs access to a single service. Note that unlike the client principal, a non-default service
principal must be specified with both -S and -I; one cannot provide the instance portion as part of
the argument to -S.
-s Read the password from standard input. This bypasses the normal password prompt, which means echo
isn't suppressed and input isn't forced to be from the controlling terminal. Most uses of this
option are a security risk. You normally want to use a keytab and the -f option instead.
-t Run an external program after getting a ticket. The intended use of this is to run aklog to get a
token. If the environment variable AKLOG (or KINIT_PROG for backward compatibility) is set, it
overrides the compiled-in default.
If a command was given on the command line, k5start will attempt to isolate the AFS credentials for
that command from the invoking process. There are two possible ways in which this is done.
First, if k5start has been built with AFS setpag() support and AFS is available, k5start will create
a new PAG before running the external program.
Otherwise, if either k5start was not built with AFS setpag() support or AFS is not available, but the
Linux kafs module is available and k5start was built with libkeyutils support, it will create a new
session keyring and link it to the current user keyring before running the external program.
If neither of these conditions are true, k5start will run the external program without doing any
credential isolation, which may also affect the credentials of the invoking process.
-U Rather than requiring the authentication principal be given on the command line, read it from the
keytab specified with -f. The principal will be taken from the first entry in the keytab. -f must
be specified if this option is used.
When -U is given, k5start will not expect a principal name to be given on the command line, and any
arguments after the options will be taken as a command to run.
-uclientprincipal
This specifies the principal to obtain credentials as. The entire principal may be specified here,
or alternatively just the first portion may be specified with this flag and the instance specified
with -i.
Note that there's normally no reason to use this flag rather than simply giving the principal on the
command line as the first regular argument.
-v Be verbose. This will print out a bit of additional information about what is being attempted and
what the results are.
-x Exit immediately on any error. Normally, when running a command or when run with the -K option,
k5start keeps running even if it fails to refresh the ticket cache and will try again at the next
check interval. With this option, k5start will instead exit.
Install Now
Emojis
PNG Icons
SVG Icons