## KINIT Command

(from UNIX man page)

    User Commands                                            KINIT(1)

    NAME
         kinit - obtain and cache Kerberos ticket-granting ticket

    SYNOPSIS
         kinit
              [-5] [-4] [-V] [-l lifetime] [-s start_time] [-r
              renewable_life] [-p | -P] [-f | -F] [-A] [-v] [-R] [-k
              [-t keytab_file]] [-c cache_name] [-S service_name]
              [principal]

    DESCRIPTION
         kinit obtains and caches an initial  ticket-granting  ticket
         for  principal.Thetypicaldefaultbehavior Kerberos 5 tickets.
         However, if kinit was built with both Kerberos 4 support and
         with  the  default behavior of acquiring both types of tick-
         ets, it will try to acquire both Kerberos 5 and  Kerberos  4
         by default.  Any documentation particular to Kerberos 4 does
         not apply if Kerberos 4 support was not built into kinit.

    OPTIONS
         -5   get Kerberos 5 tickets.  This  overrides  whatever  the
              default  built-in  behavior may be.  This option may be
              used with -4

         -4   get Kerberos 4 tickets.  This  overrides  whatever  the
              default  built-in behavior may be.  This option is only
              available if kinit was built with Kerberos  4  compati-
              bility.  This option may be used with -5

         -V   display verbose output.

         -l lifetime
              requests a ticket  with  the  lifetime  lifetime.   The
              value  for lifetime must be followed immediately by one
              of the following delimiters:

                 s  seconds
                 m  minutes
                 h  hours
                 d  days

              as in "kinit -l 90m".  You cannot mix units; a value of
              `3h30m' will result in an error.

              If the -l option is not specified, the  default  ticket
              lifetime (configured by each site) is used.  Specifying
              a ticket lifetime longer than the maximum ticket  life-
              time (configured by each site) results in a ticket with
              the maximum lifetime.

         -s start_time
              requests  a  postdated  ticket,   valid   starting   at
              start_time.   Postdated  tickets  are  issued  with the
              invalid flag set, and need to be fed back  to  the  kdc
              before use.  (Not applicaple to Kerberos 4.)

         -r renewable_life
              requests renewable tickets, with a  total  lifetime  of
              renewable_life.   The duration is in the same format as
              the -l option, with the same delimiters.  (Not applica-
              ple to Kerberos 4.)

         -f   request forwardable tickets.  (Not applicaple  to  Ker-
              beros 4.)

         -F   do not request forwardable tickets.  (Not applicaple to
              Kerberos 4.)

         -p   request proxiable tickets.  (Not applicaple to Kerberos
              4.)

         -P   do not request proxiable tickets.  (Not  applicaple  to
              Kerberos 4.)

         -A   request address-less tickets.  (Not applicaple to  Ker-
              beros 4.)

         -v   requests that the ticket granting ticket in  the  cache
              (with  the  invalid  flag set) be passed to the kdc for
              validation.  If the ticket is within its requested time
              range, the cache is replaced with the validated ticket.
              (Not applicaple to Kerberos 4.)

         -R   requests renewal of the ticket-granting  ticket.   Note
              that  an  expired ticket cannot be renewed, even if the
              ticket is still within its renewable life.  When  using
              this  option with Kerberos 4, the kdc must support Ker-
              beros 5 to Kerberos 4 ticket conversion.

         -k [-t keytab_file]
              requests a host ticket, obtained  from  a  key  in  the
              local host's keytab file.  The name and location of the
              keytab file may be specified with  the  -t  keytab_file
              option; otherwise the default name and location will be
              used.  When using this option with Kerberos 4, the  kdc
              must  support  Kerberos  5 to Kerberos 4 ticket conver-
              sion.

         -c cache_name
              use cache_name as the Kerberos 5  credentials  (ticket)
              cache  name  and  location; if this option is not used,
              the default cache name and location are used.

              The default credentials cache may vary between systems.

              If  the  KRB5CCNAME  environment  variable  is set, its
              value is used to name the default  ticket  cache.   Any
              existing  contents of the cache are destroyed by kinit.
              (Note: The default name for Kerberos 4 comes  from  the
              KRBTKFILE  environment  variable.  This option does not
              apply to Kerberos 4.)

         -S service_name
              specify an alternate service name to use  when  getting
              initial tickets.  (Applicable to Kerberos 5 or if using
              both Kerberos 5 and Kerberos 4 with a kdc that supports
              Kerberos 5 to Kerberos 4 ticket conversion.)

    ENVIRONMENT
         Kinit uses the following environment variables:

         KRB5CCNAME      Location  of  the  Kerberos  5   credentials
                         (ticket) cache.

         KRBTKFILE      Filename  of  the  Kerberos   4   credentials
                        (ticket) cache.

    FILES
         /tmp/krb5cc_[uid]  default location of  Kerberos  5  creden-
                            tials  cache ([uid] is the decimal UID of
                            the user).

         /tmp/tkt[uid]  default location of  Kerberos  4  credentials
                        cache ([uid] is the decimal UID of the user).

         /etc/krb5.keytab
                        default location for the local host's  keytab
                        file.

    SEE ALSO
         klist(1), kdestroy(1), krb5(3)