KINIT(1)

💖 KINIT(1) 💖

okay bestie, so this is kinit from the General Commands Manual section 1 (that's the "you can literally just type this in your shell" section, iykyk) ✨

---

🌸 NAME 🌸

kinit — acquire initial tickets. that's it. that's the whole job. she gets you tickets 💅

---

✨ SYNOPSIS ✨

kinit [--afslog] [-c cachename | --cache=cachename] [-f | --forwardable]
      [-F | --no-forwardable] [-t keytabname | --keytab=keytabname] [-l
      time | --lifetime=time] [-p | --proxiable] [-R | --renew]
      [--renewable] [-r time | --renewable-life=time] [-S principal |
      --server=principal] [-s time | --start-time=time]
      [-k | --use-keytab] [-v | --validate] [-e enctypes |
      --enctypes=enctypes] [-a addresses | --extra-addresses=addresses]
      [--password-file=filename] [--fcache-version=version-number]
      [-A | --no-addresses] [-n | --anonymous] [--enterprise]
      [--version] [--help] [principal [command]]

like. she has a lot of options. she's high maintenance but she delivers 🎀

---

🦋 DESCRIPTION 🦋

So kinit is the girl who goes and authenticates you to the Kerberos server as principal — or, if you didn't give her a principal, as a system-generated default (usually your login name at the default realm, bestie) — and then she comes back with a ticket granting ticket</> that you can later use to snag tickets for other services. main character energy, honestly 👑

Supported options:

• -c cachename, --cache=cachename — the credentials cache to put the acquired ticket in, if you want something other than the default. a lil home for your ticket 🏠
• -f, --forwardable — obtain a ticket that can be forwarded to another host. she's traveling ✈️
• -F, --no-forwardable — do not obtain a forwardable ticket. stay home. no trips. periodt.
• -t keytabname, --keytab=keytabname — don't ask for a password, just pull the key from the specified keytab instead. no password popup, we love that for us 🙈
• -l time, --lifetime=time — specifies the lifetime of the ticket. the argument can be in seconds, or a cuter, more human-readable string like ‘1h’ ⏰
• -p, --proxiable — request tickets with the proxiable flag set. yes queen, set the flag 🚩
• -R, --renew — try to renew the ticket. the ticket has to have the ‘renewable’ flag set, and it must not be expired (if it's expired she literally cannot help you, sorry bestie 😭).
• --renewable — the same as --renewable-life, but with an infinite time ✨
• -r time, --renewable-life=time — the max renewable ticket life. the ceiling. the limit. the boundary-setting 🌈
• -S principal, --server=principal — get a ticket for a service other than krbtgt/LOCAL.REALM. going somewhere other than the usual spot 💫
• -s time, --start-time=time — obtain a ticket that starts being valid time seconds into the future. and honestly time can really be a generic time specification, like ‘1h’ 🕐
• -k, --use-keytab — the same as --keytab, but with the default keytab name (normally FILE:/etc/krb5.keytab). default queen 👑
• -v, --validate — try to validate an invalid ticket. glow-up for a ticket that's not doing so hot 💅
• -e, --enctypes=enctypes — request tickets with this particular enctype.
• --password-file=filename — read the password from the first line of filename. and if the filename is STDIN, the password gets read from the standard input. sneaky but valid 🍓
• --fcache-version=version-number — create a credentials cache of version version-number.
• -a, --extra-addresses=enctypes — adds a set of addresses that will, in addition to the system's local addresses, be put in the ticket. this can be useful if all the addresses a client can use can't be automatically figured out. one such example is if the client is behind a firewall. also settable via libdefaults/extra_addresses in krb5.conf(5). lowkey a lifesaver behind a firewall 🧱🔥
• -A, --no-addresses — request a ticket with no addresses. ghost mode 👻
• -n, --anonymous — request an anonymous ticket. here's the tea: with the default (false) setting of the historical_anon_pkinit configuration parameter, if the principal is specified as @REALM, then anonymous PKINIT will be used to acquire an unauthenticated anonymous ticket, and both the client name and (with fully RFC-comformant KDCs) the realm in the returned ticket will be anonymized. otherwise, authentication proceeds as normal and the anonymous ticket will have only the client name anonymized. with historical_anon_pkinit set to true, the principal is interpreted as a realm even without an at-sign prefix, and it is not possible to obtain authenticated anonymized tickets. 🫥
• --enterprise — parse principal as an enterprise (KRB5-NT-ENTERPRISE) name. enterprise names are email-like principals that are stored in the name part of the principal, and since there are two @ characters the parser needs to know that the first one is not a realm. an example of an enterprise name is “lha@e.kth.se@KTH.SE”, and this option is usually used with canonicalize so that the principal returned from the KDC will typically be the real principal name. 💌
• --afslog — gets AFS tickets, converts them to version 4 format, and stores them in the kernel. only useful if you have AFS. if you don't have AFS this does nothing for you, bestie 🙈

---

ok so also: the forwardable, proxiable, ticket_life, and renewable_life options can be set to a default value from the appdefaults section in krb5.conf — see krb5_appdefault(3). defaults, we love her 🎀

and here's the cute part: if a command is given, kinit will set up new credentials caches, and AFS PAG, and then run the given command. when it finishes, the credentials will be removed. like a lil pop-up shop that closes when you leave 🛍️✨

---

🌈 ENVIRONMENT 🌈

• KRB5CCNAME — specifies the default credentials cache. this is where your tickets live rent-free 🏡
• KRB5_CONFIG — the file name of krb5.conf, the default being /etc/krb5.conf. 📂

---

🫶 SEE ALSO 🫶

• kdestroy(1)
• klist(1)
• krb5_appdefault(3)
• krb5.conf(5)

go read those too, bestie, they're the supporting cast and they ate 💅

---

and that's the whole page!! this one came from HEIMDAL, dated April 25, 2006 — an absolute icon of a release date, no cap. mwah, go get those tickets 🎀💖✨