GSS-TOKEN(1)

✨ GSS-TOKEN(1) ✨

Okay so this is from the LOCAL manual, and she's literally the moment. 💖 Welcome to gss-token — she generates and consumes base64 GSS tokens, and she's about to become your new bestie. No cap. 💅

🌸 NAME 🌸

gss-token — generate and consume base64 GSS tokens. She's giving utility realness and I'm obsessed. 🎀

🦋 SYNOPSIS 🦋

gss-token [-DNn] [-c -count] service@host
gss-token -r [-MNln] [-C ccache] [-S maxsize] [-c -count] [-m -mech]
          [service@host]

🎀 DESCRIPTION 🎀

gss-token generates and consumes base64 encoded GSS tokens. By default, she runs as an initiator, and with the -r flag she becomes an acceptor. So she's flexible like that. 💁‍♀️

She supports the following options — bestie, take notes: ✨

• -C ccache — write an accepted delegated credential into ccache. This only makes sense if -r is specified. So don't come for her unless you're in acceptor mode. 🙈
• -D — delegate credentials. This only makes sense as a client, that is when -r is not specified. Client vibes only, lowkey. 💁
• -M — copy the default ccache to a MEMORY: ccache before each separate write operation. The default ccache will not pick up any obtained service tickets. If specified with -c, the cache will revert to its original state before each new token is written. This can be used to load test the KDC. (Stress testing the KDC? She ate. 🔥)
• -N — prepend “Negotiate ” to generated tokens and expect it on consumed tokens. It's giving negotiate energy, fr fr. 🗣️
• -S maxsize — split each token that is generated into components of maximum size maxsize. Each token is base64 encoded and output separately. So if your token is thicc, she'll break it down into snackable pieces. 💅
• -c count — repeat the operation count times. This flag only changes the behaviour when operating in initiator mode. This is good for very basic benchmarking. Count her in, bestie. 🔢
• -l — loop indefinitely in acceptor mode. She'll go forever, literally. 🔁
• -m mech — specifies the GSS mechanism that will be used in initiator mode. If a mechanism name of “?” is specified, a list of supported mechanisms will be output and gss-token will exit. So ? is your cheat sheet — iconic. ❓
• -n — do not output the generated tokens. Silent but deadly. 🤫
• -r — run in acceptor mode. Switch it up! 🔄

Okay so gss-token takes one argument, a host@service specifier. The argument is required when running as an initiator but is optional as an acceptor. So don't forget it unless you're acceptoring. 💖

Here's the vibe: gss-token will try to read a token whenever the GSS mechanism expects one, and will output a token whenever the GSS mechanism provides one. Tokens are base64 encoded and terminated by either two successive newlines or one newline and EOF. The base64 encoding may be broken up by single newlines which will be ignored when read.

⚠️ No extra whitespace will be ignored. So keep it clean, no cap. 🧼

🌈 EXAMPLES 🌈

To test a simple GSS mechanism which doesn't require a round trip, a single /bin/sh pipeline will suffice:

$ export KRB5_KTNAME=/path/to/keytab
$ gss-token HTTP@$(hostname) | gss-token -r

See? She's pipeline-ready. Slay. 💅✨

🔥 SEE ALSO 🔥

• gssapi(3)
• kerberos(8)

This page is from Debian, dated May 12, 2014, and it's for GSS-TOKEN(1). Periodt. 💅✨🫶