= Kerberos FAQ =
[[PageOutline]]

This page is a collection of various issues regarding the setup and use of Kerberos for OS/2 (and eComStation).
----
== About ==

=== What is Kerberos, anyway? ===

Kerberos is an authentication mechanism. What makes Kerberos so special is that not only is it extremely secure using secret-key cryptography, but its use is widespread (it's been around since the 1980's), it is well-documented, and it is the de facto standard for connecting to various directory services, including Microsoft's Active Directory.

=== What are the principles behind Kerberos? ===

Kerberos mainly works from the premise that a password should never cross the network to the server. Instead, you know your password, and the Ticket Granting Server knows your password. You request a ticket from the Ticket Granting Server by sending your username in plain text. Upon verifying that your username exists in its database, the Server responds with an encrypted ticket, signed with your private key. If you have the password (you should), then you will be able to decrypt the ticket. The ticket grants you access to the resources to which you are allowed. In addition, once you have been able to decrypt your ticket, communications between you and the server are encrypted, securing the entire communications channel.

== Installation and configuration ==

=== Unpacking the distribution ===

=== Path considerations ===

=== Configuring the krb5.conf ===

== Usage ==

=== How do I request a ticket? ===

Requesting a ticket is done via the kinit command. Assuming the krb5.conf has been configured with your desired KDC information, all that should be required is to issue:

{{{
kinit <username>
}}}

at the command line. You should then be prompted to enter your password. Note that this password is not sent to the server. It is only used to decrypt the ticket when received from the server. If the password is incorrect, the ticket cannot be decrypted, and the authentication fails (no ticket=no authentication).

=== How do I view my tickets? ===

The klist utility is used to list your tickets, both valid and expired. For MIT Kerberos, the command is simply:

{{{
klist
}}}

whereas for Heimdal, the syntax is:

{{{
klist list
}}}

This should return a listing of what tickets you currently hold, and their status.

=== How do I log out (destroy my ticket)? ===

The kdestroy utility can be used to destroy a specific ticket or all of the tickets you hold before its/their expiration:

{{{
kdestroy -A
}}}

will destroy all tickets (to select an individual ticket, use the -c command line option and specify the ticket cache).