Red Hat ENTERPRISE LINUX 3 Reference Manual page 285

Chapter 18. Kerberos
GSS-API
The Generic Security Service Application Program Interface (defined in RFC-2743 published
by The Internet Engineering Task Force) is a set of functions which provide security services.
This API is used by clients and services to authenticate to each other without either program
having specific knowledge of the underlying mechanism. If a network service (such as IMAP)
uses GSS-API, it can authenticate using Kerberos.
hash
A number generated from text and used to ensure that transmitted data has not been tampered
with.
key
Data used when encrypting or decrypting other data. Encrypted data cannot be decrypted without
the proper key or extremely good guessing.
Key Distribution Center (KDC)
A service that issues Kerberos tickets, usually run on the same host as the Ticket-granting Server
(TGS).
key table or keytab
A file that includes an unencrypted list of principals and their keys. Servers retrieve the keys they
need from keytab files instead of using
The KDC administration server,
any other file (it uses
kinit
The command allows a principal who has already logged in to obtain and cache the initial
kinit
Ticket-granting Ticket (TGT). For more information about using the
its man page.
principal
The principal name or principal is the unique name of a user or service allowed to authenticate
using Kerberos. A principal name follows the form
user, the root is the same as their login ID. The
instance, it is separated from the root with a forward slash ("/"). An empty string ("") is considered
a valid instance (which differs from the default
All principals in a realm have their own key, which for users is derived from a password or is
randomly set for services.
realm
A network that uses Kerberos, composed of one or more servers called KDCs and a potentially
large number of clients.
service
A program accessed over the network.
ticket
A temporary set of electronic credentials that verify the identity of a client for a particular service.
Also called credentials.
kinit
/usr/kerberos/sbin/kadmind
/var/kerberos/krb5kdc/kadm5.keytab
. The default keytab file is
root[/instance]@REALM
is optional. If the principal has an
instance
instance), but using it can be confusing.
NULL
/etc/krb5.keytab
, is the only service that uses
).
command, refer to
kinit
. For a typical
267
.