Contents

The following Help Topics are available:

Using Kerb*Net for Windows

Kerberos Tickets

Kerberos Principals

Troubleshooting Kerb*Net for Windows

For Help on Help, Press F1


Using Kerb*Net for Windows

To obtain Kerberos tickets using Kerb*Net for Windows, type your Kerberos primary or Kerberos primary/instance

(separated by a slash) in the "Name" box, your Kerberos realm (must be all upper-case) in the "Realm" box, and your password in the "Password" box, and then click the "Login" button.

To delete your Kerberos tickets, click the "Delete" button.  Also, attempting to obtain new tickets will automatically delete any existing tickets.

To change your password, click the "Change Password" button.  This will bring up a dialog box.  Enter your primary or primary/instance in the "Name" box, and your Kerberos realm in the "Realm" box. Type your old password in the "Old" box, and your new password twice, once in each "New" box.  When all of the boxes are properly filled in, click the "OK" button.

You can also specify the following options, by selecting "File," and then "Options":

•	the location of the Kerberos configuration file

•	the location of the credential cache (ticket file)

•	whether or not Kerb*Net should alert you by popping its window up and/or beeping when your tickets expire

•	whether your tickets should be forwardable


Kerberos Tickets

When you authenticate yourself, Kerberos gives you an initial Kerberos ticket.  (A Kerberos ticket is an encrypted protocol message that provides authentication.)  Kerberos uses this ticket for network utilities.  The ticket transactions are done transparently, so you don't have to worry about their management.  However, you may notice that you get an additional ticket for each service.

Note that tickets expire.  Privileged tickets, such as root instance tickets, usually expire in a few minutes, while tickets that carry more ordinary privileges may be good for several hours or a day, depending on the installation's policy.  If your login session extends beyond the time limit, you will have to reauthenticate yourself to Kerberos.


Kerberos Terms
Kerberos Principals

A Kerberos principal is an entity (such as a user or host) that can receive a Kerberos ticket.  The Kerberos principal usually contains three parts.  The first is the primary, which is the name of the user or service.  The second is the instance, which in the case of a user is usually nonexistent (null).  Some users may have additional principals with instances such as root or admin.  Those users would use these principals only when doing work that requires the permissions that are assigned to these principals.  The principal joeuser@BLEEP.COM is completely separate from the principal joeuser/root@BLEEP.COM.

In the case of a service, the primary describes the type of service (such as "host" or "pop").  The

instance is the name of the machine on which it runs; i.e., the "host" service running on the machine trillium.bleep.com would have the instance "trillium.bleep.com," whereas the "host" service running on the machine daffodil.fubar.org would have the instance "daffodil.bleep.org.".

The third part of a Kerberos name is the realm.  The realm describes which Kerberos installation provided authentication for the principal.  The realm is usually the domain name in UPPER CASE letters; the machine trillium.bleep.com would be in the realm BLEEP.COM.

When writing a Kerberos principal, the primary is separated from the instance by a slash (if the instance is not null), and the realm follows, preceded by an @ sign.  (If the realm is the same as the default realm, it may be omitted.)  By convention, the realm is specified in UPPER CASE.  The following are examples of valid Kerberos principals:

foo

bar/admin

baz@BLEEP.COM

quux/root@BLEEP.COM


Troubleshooting Kerb*Net for Windows

The file libkrb5.dll must be somewhere in your path.

Your Kerberos Config file must be in the location specified in your "Options" (under the "File" menu).

The directory that you specify for Kerb*Net to put your "Credential" (ticket file) in must exist.

If the Key Distribution Center (KDC)  is unreachable (perhaps because of network problems), you will be unable to get tickets.  If the admin server is unreachable, you will be unable to change your password.


Kerberos ticket

A Kerberos ticket is an encrypted protocol message that provides authentication.  Your Kerberos tickets are stored in a credentials cache, which may be a file, or may exist only in memory.


Kerberos primary

The Kerberos primary is the first part of a Kerberos principal.  The primary is usually either a user name or a service name.


Kerberos Instance

The instance is the second part of a Kerberos principal.  The instance further qualifies the primary.  Most user principals have nonexistent (null) instances, but the instance "root" or "admin" may be used to denote a principal with special privileges.  In the case of a host, the instance is the fully-qualified hostname.


Kerberos Realm

A Kerberos realm is an administrative domain.  In most cases, the realm name is the same as the internet domain, in UPPER CASE letters.  The last part of a Kerberos principal (the part after the "@" sign) is the realm.


Kerberos Configuration File

This file contains information that will help your computer find the correct server for the particular Kerberos realm in which you are trying to obtain tickets.  Because the information is particular to your Kerb*Net installation, you will need to get a copy of this file from your system administrator.


Forwardable Tickets

If you have forwardable tickets, you can forward a copy of them to a remote host.  This enables you to use your credentials on the remote host without having to type your password.


Key Distribution Center (KDC)

A Key Distribution Center (KDC) is a host that issues Kerberos tickets.