LOGIN(8C)

NAME
login.krb5 - kerberos enhanced login program

SYNOPSIS
login.krb5 [ -fF [username] ] [ --version

DESCRIPTION
login.krb5 is a modification of the BSD login program which is used for two functions. It is the sub-process used by krlogind and telnetd to initiate a user session and it is a replacement for the command-line login program which, when invoked with a password, acquires Kerberos tickets for the user.

login.krb5 will prompt for a username, or take one on the command line, as login.krb5 username and will then prompt for a password. This password will be used to acquire Kerberos Version 5 tickets and Kerberos Version 4 tickets (if possible.) It will also attempt to run aklog to get AFS tokens for the user. The version 5 tickets will be tested against a local v5srvtab if it is available, in order to verify the tickets, before letting the user in. However, if the password matches the entry in /etc/passwd the user will be unconditionally allowed (permitting use of the machine in case of network failure.)

OPTIONS

-r hostname
    pass hostname to rlogind.

-h hostname
    pass hostname to telnetd, etc.

-f name
    Perform pre-authenticated login, e.g., datakit, xterm, etc.; does not allow preauthenticated login as root.

-F name
    Perform pre-authenticated login, e.g.,for datakit, xterm, etc.; allows preauthenticated login as root.

-e name
    Perform pre-authenticated, encrypted login. Must do term negotiation.

--version
    Prints out the KerbNet release version of the binary and then exits.

CONFIGURATION
login.krb5 utilizes the forwardable, proxiable, renew_lifetime, and verify_ap_req_nofail flags in the [libdefaults] section of the krb5.conf file. (See krb5.conf(5) for an explanation of these flags.)

Additionally, the following flags may be configured via the login subsection of the [appdefaults] section of the krb5.conf file:

krb5_get_tickets
    Use password to get V5 tickets. Default value true.

krb4_get_tickets
    Use password to get V4 tickets. Default value true.

krb4_convert
    Use Kerberos conversion daemon to get V4 tickets. Default value true. If false, gets initial ticket directly, which does not currently work with non MIT-V4 salt types (such as the AFS3 salt type.)

krb_run_aklog
    Attempt to run aklog. Default value true.

aklog_path
    Where to find it [not yet implemented.] Default value $(prefix)/bin/aklog.

accept_passwd
    Don't accept plaintext passwords [not yet implemented]. Default value false.

DIAGNOSTICS
All diagnostic messages are returned on the connection or tty associated with stderr.

SEE ALSO
rlogind(8C), rlogin(1C), krb5.conf(5), telnetd(8c)

BUGS
Should use a config file to select use of V5, V4, and AFS, as well as policy for startup.