author | Rich Burridge <rich.burridge@oracle.com> |
Fri, 31 Mar 2017 07:26:17 -0700 | |
changeset 7820 | a2b9a7de9e1a |
parent 6621 | 08009c15e349 |
permissions | -rw-r--r-- |
5698
40ccd2e5524c
23019839 pre-phase 3 changes to support the upcoming krb migration phase 3 push to on12
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
1 |
'\" te |
40ccd2e5524c
23019839 pre-phase 3 changes to support the upcoming krb migration phase 3 push to on12
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
2 |
.\" Copyright (c) 2006, 2013, Oracle and/or its affiliates. All rights reserved. |
7820
a2b9a7de9e1a
25795430 Adjust Userland man pages to "5.11" (from "5.12") where needed
Rich Burridge <rich.burridge@oracle.com>
parents:
6621
diff
changeset
|
3 |
.TH krb5_auth_rules 5 "5 Jun 2012" "SunOS 5.11" "Standards, Environments, and Macros" |
5698
40ccd2e5524c
23019839 pre-phase 3 changes to support the upcoming krb migration phase 3 push to on12
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
4 |
.SH NAME |
40ccd2e5524c
23019839 pre-phase 3 changes to support the upcoming krb migration phase 3 push to on12
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
5 |
krb5_auth_rules \- overview of Kerberos V5 authorization |
40ccd2e5524c
23019839 pre-phase 3 changes to support the upcoming krb migration phase 3 push to on12
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
6 |
.SH DESCRIPTION |
40ccd2e5524c
23019839 pre-phase 3 changes to support the upcoming krb migration phase 3 push to on12
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
7 |
.sp |
40ccd2e5524c
23019839 pre-phase 3 changes to support the upcoming krb migration phase 3 push to on12
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
8 |
.LP |
40ccd2e5524c
23019839 pre-phase 3 changes to support the upcoming krb migration phase 3 push to on12
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
9 |
When kerberized versions of the \fBftp\fR, \fBrcp\fR, \fBrlogin\fR, \fBrsh\fR, \fBssh\fR, \fBtelnet\fR, or \fBssh\fR clients are used to connect to a server, the identity of the originating user must be authenticated to the Kerberos V5 authentication system. Account access can then be authorized if appropriate entries exist in the \fB~/.k5login\fR file, the \fBgsscred\fR table, or if the default GSS/Kerberos authentication rules successfully map the Kerberos principal name to Unix login name. |
40ccd2e5524c
23019839 pre-phase 3 changes to support the upcoming krb migration phase 3 push to on12
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
10 |
.sp |
40ccd2e5524c
23019839 pre-phase 3 changes to support the upcoming krb migration phase 3 push to on12
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
11 |
.LP |
40ccd2e5524c
23019839 pre-phase 3 changes to support the upcoming krb migration phase 3 push to on12
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
12 |
To avoid security problems, the \fB~/.k5login\fR file must be owned by the remote user on the server the client is attempting to access. The file should contain a private authorization list comprised of Kerberos principal names of the form \fIprincipal/instance\fR@\fI realm\fR. The \fI/instance\fR variable is optional in Kerberos principal names. For example, different principal names such as \[email protected]\fR and \fBjdb/[email protected]\fR would each be legal, though not equivalent, Kerberos principals. The client is granted access if the \fB~/.k5login\fR file is located in the login directory of the remote user account and if the originating user can be authenticated to one of the principals named in the file. See \fBkadm5.acl\fR(4) for more information on Kerberos principal names. |
40ccd2e5524c
23019839 pre-phase 3 changes to support the upcoming krb migration phase 3 push to on12
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
13 |
.sp |
40ccd2e5524c
23019839 pre-phase 3 changes to support the upcoming krb migration phase 3 push to on12
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
14 |
.LP |
40ccd2e5524c
23019839 pre-phase 3 changes to support the upcoming krb migration phase 3 push to on12
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
15 |
When no \fB~/.k5login\fR file is found in the remote user's login account, the Kerberos V5 principal name associated with the originating user is checked against the \fBgsscred\fR table. If a \fBgsscred\fR table exists and the principal name is matched in the table, access is granted if the Unix user ID listed in the table corresponds to the user account the client is attempting to access. If the Unix user ID does not match, access is denied. See \fBgsscred\fR(1M). |
40ccd2e5524c
23019839 pre-phase 3 changes to support the upcoming krb migration phase 3 push to on12
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
16 |
.sp |
40ccd2e5524c
23019839 pre-phase 3 changes to support the upcoming krb migration phase 3 push to on12
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
17 |
.LP |
40ccd2e5524c
23019839 pre-phase 3 changes to support the upcoming krb migration phase 3 push to on12
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
18 |
For example, an originating user listed in the \fBgsscred\fR table with the principal name \[email protected]\fR and the \fBuid\fR \fB23154\fR is granted access to the \fBjdb-user\fR account if \fB23154\fR is also the \fBuid\fR of \fBjdb-user\fR listed in the user account database. See \fBpasswd\fR(4). |
40ccd2e5524c
23019839 pre-phase 3 changes to support the upcoming krb migration phase 3 push to on12
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
19 |
.sp |
40ccd2e5524c
23019839 pre-phase 3 changes to support the upcoming krb migration phase 3 push to on12
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
20 |
.LP |
40ccd2e5524c
23019839 pre-phase 3 changes to support the upcoming krb migration phase 3 push to on12
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
21 |
Finally, if there is no \fB~/.k5login\fR file and the Kerberos V5 identity of the originating user is not in the \fBgsscred\fR table, or if the \fBgsscred\fR table does not exist, the client is granted access to the account under the following conditions (default GSS/Kerberos auth rules): |
40ccd2e5524c
23019839 pre-phase 3 changes to support the upcoming krb migration phase 3 push to on12
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
22 |
.RS +4 |
40ccd2e5524c
23019839 pre-phase 3 changes to support the upcoming krb migration phase 3 push to on12
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
23 |
.TP |
40ccd2e5524c
23019839 pre-phase 3 changes to support the upcoming krb migration phase 3 push to on12
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
24 |
.ie t \(bu |
40ccd2e5524c
23019839 pre-phase 3 changes to support the upcoming krb migration phase 3 push to on12
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
25 |
.el o |
40ccd2e5524c
23019839 pre-phase 3 changes to support the upcoming krb migration phase 3 push to on12
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
26 |
The user part of the authenticated principal name is the same as the Unix account name specified by the client. |
40ccd2e5524c
23019839 pre-phase 3 changes to support the upcoming krb migration phase 3 push to on12
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
27 |
|
40ccd2e5524c
23019839 pre-phase 3 changes to support the upcoming krb migration phase 3 push to on12
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
28 |
.RE |
40ccd2e5524c
23019839 pre-phase 3 changes to support the upcoming krb migration phase 3 push to on12
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
29 |
.RS +4 |
40ccd2e5524c
23019839 pre-phase 3 changes to support the upcoming krb migration phase 3 push to on12
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
30 |
.TP |
40ccd2e5524c
23019839 pre-phase 3 changes to support the upcoming krb migration phase 3 push to on12
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
31 |
.ie t \(bu |
40ccd2e5524c
23019839 pre-phase 3 changes to support the upcoming krb migration phase 3 push to on12
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
32 |
.el o |
40ccd2e5524c
23019839 pre-phase 3 changes to support the upcoming krb migration phase 3 push to on12
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
33 |
The realm part of the client and server are the same, unless the \fBkrb5.conf\fR(4) \fIauth_to_local_realm\fR parameter is used to create equivalence. |
40ccd2e5524c
23019839 pre-phase 3 changes to support the upcoming krb migration phase 3 push to on12
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
34 |
|
40ccd2e5524c
23019839 pre-phase 3 changes to support the upcoming krb migration phase 3 push to on12
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
35 |
.RE |
40ccd2e5524c
23019839 pre-phase 3 changes to support the upcoming krb migration phase 3 push to on12
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
36 |
.RS +4 |
40ccd2e5524c
23019839 pre-phase 3 changes to support the upcoming krb migration phase 3 push to on12
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
37 |
.TP |
40ccd2e5524c
23019839 pre-phase 3 changes to support the upcoming krb migration phase 3 push to on12
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
38 |
.ie t \(bu |
40ccd2e5524c
23019839 pre-phase 3 changes to support the upcoming krb migration phase 3 push to on12
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
39 |
.el o |
40ccd2e5524c
23019839 pre-phase 3 changes to support the upcoming krb migration phase 3 push to on12
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
40 |
The Unix account name exists on the server. |
40ccd2e5524c
23019839 pre-phase 3 changes to support the upcoming krb migration phase 3 push to on12
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
41 |
|
40ccd2e5524c
23019839 pre-phase 3 changes to support the upcoming krb migration phase 3 push to on12
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
42 |
.RE |
40ccd2e5524c
23019839 pre-phase 3 changes to support the upcoming krb migration phase 3 push to on12
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
43 |
.sp |
40ccd2e5524c
23019839 pre-phase 3 changes to support the upcoming krb migration phase 3 push to on12
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
44 |
.LP |
40ccd2e5524c
23019839 pre-phase 3 changes to support the upcoming krb migration phase 3 push to on12
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
45 |
For example, if the originating user has the principal name \[email protected]\fR and if the server is in realm \fBSALES.ACME.COM\fR, the client would be denied access even if \fBjdb\fR is a valid account name on the server. This is because the realms \fBSALES.ACME.COM\fR and \fBENG.ACME.COM\fR differ. |
40ccd2e5524c
23019839 pre-phase 3 changes to support the upcoming krb migration phase 3 push to on12
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
46 |
.sp |
40ccd2e5524c
23019839 pre-phase 3 changes to support the upcoming krb migration phase 3 push to on12
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
47 |
.LP |
40ccd2e5524c
23019839 pre-phase 3 changes to support the upcoming krb migration phase 3 push to on12
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
48 |
The \fBkrb5.conf\fR(4) \fIauth_to_local_realm\fR parameter also affects authorization. Non-default realms can be equated with the default realm for authenticated \fBname-to-local name\fR mapping. |
40ccd2e5524c
23019839 pre-phase 3 changes to support the upcoming krb migration phase 3 push to on12
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
49 |
.SH FILES |
40ccd2e5524c
23019839 pre-phase 3 changes to support the upcoming krb migration phase 3 push to on12
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
50 |
.sp |
40ccd2e5524c
23019839 pre-phase 3 changes to support the upcoming krb migration phase 3 push to on12
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
51 |
.ne 2 |
40ccd2e5524c
23019839 pre-phase 3 changes to support the upcoming krb migration phase 3 push to on12
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
52 |
.mk |
40ccd2e5524c
23019839 pre-phase 3 changes to support the upcoming krb migration phase 3 push to on12
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
53 |
.na |
40ccd2e5524c
23019839 pre-phase 3 changes to support the upcoming krb migration phase 3 push to on12
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
54 |
\fB\fB~/.k5login\fR\fR |
40ccd2e5524c
23019839 pre-phase 3 changes to support the upcoming krb migration phase 3 push to on12
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
55 |
.ad |
40ccd2e5524c
23019839 pre-phase 3 changes to support the upcoming krb migration phase 3 push to on12
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
56 |
.RS 15n |
40ccd2e5524c
23019839 pre-phase 3 changes to support the upcoming krb migration phase 3 push to on12
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
57 |
.rt |
40ccd2e5524c
23019839 pre-phase 3 changes to support the upcoming krb migration phase 3 push to on12
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
58 |
Per user-account authorization file. |
40ccd2e5524c
23019839 pre-phase 3 changes to support the upcoming krb migration phase 3 push to on12
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
59 |
.RE |
40ccd2e5524c
23019839 pre-phase 3 changes to support the upcoming krb migration phase 3 push to on12
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
60 |
|
40ccd2e5524c
23019839 pre-phase 3 changes to support the upcoming krb migration phase 3 push to on12
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
61 |
.sp |
40ccd2e5524c
23019839 pre-phase 3 changes to support the upcoming krb migration phase 3 push to on12
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
62 |
.ne 2 |
40ccd2e5524c
23019839 pre-phase 3 changes to support the upcoming krb migration phase 3 push to on12
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
63 |
.mk |
40ccd2e5524c
23019839 pre-phase 3 changes to support the upcoming krb migration phase 3 push to on12
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
64 |
.na |
40ccd2e5524c
23019839 pre-phase 3 changes to support the upcoming krb migration phase 3 push to on12
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
65 |
\fB\fB/etc/passwd\fR\fR |
40ccd2e5524c
23019839 pre-phase 3 changes to support the upcoming krb migration phase 3 push to on12
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
66 |
.ad |
40ccd2e5524c
23019839 pre-phase 3 changes to support the upcoming krb migration phase 3 push to on12
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
67 |
.RS 15n |
40ccd2e5524c
23019839 pre-phase 3 changes to support the upcoming krb migration phase 3 push to on12
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
68 |
.rt |
40ccd2e5524c
23019839 pre-phase 3 changes to support the upcoming krb migration phase 3 push to on12
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
69 |
System account file. This information may also be in a directory service. See \fBpasswd\fR(4). |
40ccd2e5524c
23019839 pre-phase 3 changes to support the upcoming krb migration phase 3 push to on12
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
70 |
.RE |
40ccd2e5524c
23019839 pre-phase 3 changes to support the upcoming krb migration phase 3 push to on12
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
71 |
|
40ccd2e5524c
23019839 pre-phase 3 changes to support the upcoming krb migration phase 3 push to on12
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
72 |
.SH SEE ALSO |
40ccd2e5524c
23019839 pre-phase 3 changes to support the upcoming krb migration phase 3 push to on12
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
73 |
.sp |
40ccd2e5524c
23019839 pre-phase 3 changes to support the upcoming krb migration phase 3 push to on12
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
74 |
.LP |
40ccd2e5524c
23019839 pre-phase 3 changes to support the upcoming krb migration phase 3 push to on12
Will Fiveash <will.fiveash@oracle.com>
parents:
diff
changeset
|
75 |
\fBftp\fR(1), \fBrcp\fR(1), \fBrsh\fR(1), \fBtelnet\fR(1), \fBgsscred\fR(1M), \fBkadm5.acl\fR(4), \fBkrb5.conf\fR(4), \fBpasswd\fR(4), \fBattributes\fR(5), \fBgss_auth_rules\fR(5) |