KCM(8) BSD System Manager's Manual KCM(8) NNAAMMEE kkccmm -- process-based credential cache for Kerberos tickets. SSYYNNOOPPSSIISS kkccmm [----ccaacchhee--nnaammee==_c_a_c_h_e_n_a_m_e] [--cc _f_i_l_e | ----ccoonnffiigg--ffiillee==_f_i_l_e] [--gg _g_r_o_u_p | ----ggrroouupp==_g_r_o_u_p] [----mmaaxx--rreeqquueesstt==_s_i_z_e] [----ddiissaallllooww--ggeettttiinngg--kkrrbbttggtt] [----ddeettaacchh] [--hh | ----hheellpp] [--kk _p_r_i_n_c_i_p_a_l | ----ssyysstteemm--pprriinncciippaall==_p_r_i_n_c_i_p_a_l] [--ll _t_i_m_e | ----lliiffeettiimmee==_t_i_m_e] [--mm _m_o_d_e | ----mmooddee==_m_o_d_e] [--nn | ----nnoo--nnaammee--ccoonnssttrraaiinnttss] [--rr _t_i_m_e | ----rreenneewwaabbllee--lliiffee==_t_i_m_e] [--ss _p_a_t_h | ----ssoocckkeett--ppaatthh==_p_a_t_h] [----ddoooorr--ppaatthh==_p_a_t_h] [--SS _p_r_i_n_c_i_p_a_l | ----sseerrvveerr==_p_r_i_n_c_i_p_a_l] [--tt _k_e_y_t_a_b | ----kkeeyyttaabb==_k_e_y_t_a_b] [--uu _u_s_e_r | ----uusseerr==_u_s_e_r] [--vv | ----vveerrssiioonn] DDEESSCCRRIIPPTTIIOONN kkccmm is a process based credential cache. To use it, set the KRB5CCNAME environment variable to `KCM:_u_i_d' or add the stanza [libdefaults] default_cc_name = KCM:%{uid} to the _/_e_t_c_/_k_r_b_5_._c_o_n_f configuration file and make sure kkccmm is started in the system startup files. The kkccmm daemon can hold the credentials for all users in the system. Access control is done with Unix-like permissions. The daemon checks the access on all operations based on the uid and gid of the user. The tick- ets are renewed as long as is permitted by the KDC's policy. The kkccmm daemon can also keep a SYSTEM credential that server processes can use to access services. One example of usage might be an nss_ldap module that quickly needs to get credentials and doesn't want to renew the ticket itself. Supported options: ----ccaacchhee--nnaammee==_c_a_c_h_e_n_a_m_e system cache name --cc _f_i_l_e, ----ccoonnffiigg--ffiillee==_f_i_l_e location of config file --gg _g_r_o_u_p, ----ggrroouupp==_g_r_o_u_p system cache group ----mmaaxx--rreeqquueesstt==_s_i_z_e max size for a kcm-request ----ddiissaallllooww--ggeettttiinngg--kkrrbbttggtt disallow extracting any krbtgt from the kkccmm daemon. ----ddeettaacchh detach from console --hh, ----hheellpp --kk _p_r_i_n_c_i_p_a_l, ----ssyysstteemm--pprriinncciippaall==_p_r_i_n_c_i_p_a_l system principal name --ll _t_i_m_e, ----lliiffeettiimmee==_t_i_m_e lifetime of system tickets --mm _m_o_d_e, ----mmooddee==_m_o_d_e octal mode of system cache --nn, ----nnoo--nnaammee--ccoonnssttrraaiinnttss disable credentials cache name constraints --rr _t_i_m_e, ----rreenneewwaabbllee--lliiffee==_t_i_m_e renewable lifetime of system tickets --ss _p_a_t_h, ----ssoocckkeett--ppaatthh==_p_a_t_h path to kcm domain socket ----ddoooorr--ppaatthh==_p_a_t_h path to kcm door socket --SS _p_r_i_n_c_i_p_a_l, ----sseerrvveerr==_p_r_i_n_c_i_p_a_l server to get system ticket for --tt _k_e_y_t_a_b, ----kkeeyyttaabb==_k_e_y_t_a_b system keytab name --uu _u_s_e_r, ----uusseerr==_u_s_e_r system cache owner --vv, ----vveerrssiioonn BSD May 29, 2005 BSD