Kerberos

krb5

Kerberos is a network authentication protocol designed to provide strong authentication for client/server applications by using secret-key cryptography.

Detected by klist, kinit, kdestroy | macOS, Linux |web.mit.edu

Sync it krb5.toml

Sync rules

What travels, what stays, what never leaves

Kerberos in your home directory Every rule on this page, by file

· ~/.k5identity Sync

· ~/.k5login Exclude

Only what the catalog names. A directory that syncs brings everything inside it except what is listed as excluded here.

apps/krb5.tomlThe file this page is generated from

id = "krb5"

name = "Kerberos"

homepage = "https://web.mit.edu/kerberos/"

description = "Kerberos is a network authentication protocol designed to provide strong authentication for client/server applications by using secret-key cryptography."

# The Cerberus mark from MIT's own Kerberos page.

icon = "https://web.mit.edu/kerberos/images/dog-ring.jpg"

# klist, kinit and kdestroy are the user-facing commands of an MIT Kerberos or

# Heimdal install; the entry is named for the project, since the binaries carry

# no config of their own and the files below belong to the Kerberos client.

detect = ["klist", "kinit", "kdestroy"]

platforms = ["macos", "linux"]

# https://web.mit.edu/kerberos/krb5-latest/doc/user/user_config/k5identity.html —

# ".k5identity file, which resides in a user's home directory, contains a list

# of rules for selecting a client principals based on the server being

# accessed", used to choose a credential cache. The realm and KDC configuration

# is /etc/krb5.conf, which is system-wide and not listed here; the credential

# caches themselves are runtime state in /tmp or the OS keyring.

paths = ["~/.k5identity"]

# https://web.mit.edu/kerberos/krb5-latest/doc/user/user_config/k5login.html —

# .k5login lists the principals allowed to log in as this account: "Anyone with

# valid tickets for a principal in the file is allowed host access with the UID

# of the user in whose home directory the file resides." That is an access

# grant on one host, the Kerberos counterpart of ~/.ssh/authorized_keys, which

# this catalog also keeps out of a sync.

exclude = ["~/.k5login"]

# Nothing here is a credential: .k5identity holds principal names and host

# patterns, no keys. The keys live in the ticket cache and the keytab.

secret = []

# Read by the client library when it picks a cache; nothing holds it open.

side_effect = false

# No machine_lines: the rules map server realms and hostnames to the principal

# the user wants there, which is the same answer on every machine they work on.

Use it with your dotfile manager

Same data, in the shape your tool already reads

Opens Otty and adds this tool to what it syncs

Opens otty://sync/add/krb5. Otty ships with this catalog, so the link only has to name the tool — nothing is downloaded.

Every one of these is generated from the same rules as this page.