KINIT(1)

✨ KINIT ✨

okay bestie, welcome to kinit 💖 it's the MIT Kerberos girlie that gets you a ticket and caches it — specifically a Kerberos ticket-granting ticket. yes, the ticket-granting ticket. the VIP pass. the blueprint. no cap 🎀

---

🌸 SYNOPSIS 🌸

kinit [-V] [-l lifetime] [-s start_time] [-r renewable_life] [-p | -P]
[-f | -F] [-a] [-A] [-C] [-E] [-v] [-R] [-k [-i | -t keytab_file]] [-c
cache_name] [-n] [-S service_name] [-I input_ccache] [-T armor_ccache]
[-X attribute[=value]] [--request-pac | --no-request-pac] [principal]

---

🦋 DESCRIPTION 🦋

kinit obtains and caches an initial ticket-granting ticket for principal. periodt 💅

and if principal isn't there? no worries, she'll figure it out — kinit chooses an appropriate principal name based on whatever's already chillin' in your credential cache, or on the local username of whoever's running kinit. iconic behavior honestly.

also just so you know, some of the options down there modify the choice of principal name. so like. they're not just vibes. 👑

---

✨ OPTIONS ✨

• -V — display verbose output. she talks more. we love that for her 🗣️
• -l lifetime — (Time duration string.) Requests a ticket with the lifetime lifetime.

for example, kinit -l 5:30 or kinit -l 5h30m. both valid, both cute 🍓

if you don't pass -l, the default ticket lifetime is used (each site configures its own). and ngl, if you ask for a ticket lifetime longer than the maximum ticket lifetime (which is, again, configured by each site), it will not override that configured maximum ticket lifetime. the site said no and it meant no 😭

• -s start_time — (Time duration string.) Requests a postdated ticket. postdated tickets get issued with the invalid flag set, and they need to be resubmitted to the KDC for validation before use. like a ticket that has to go get its own permission slip 🙈

start_time specifies the duration of the delay before the ticket can become valid.

• -r renewable_life — (Time duration string.) Requests renewable tickets, with a total lifetime of renewable_life. renewable = she can come back later 💫
• -f — requests forwardable tickets.
• -F — requests non-forwardable tickets.
• -p — requests proxiable tickets.
• -P — requests non-proxiable tickets.
• -a — requests tickets restricted to the host's local address[es].
• -A — requests tickets not restricted by address.
• -C — requests canonicalization of the principal name, and allows the KDC to reply with a different client principal from the one requested. plot twist energy 🔥
• -E — treats the principal name as an enterprise name.
• -v — requests that the ticket-granting ticket in the cache (with the invalid flag set) be passed to the KDC for validation. if the ticket is within its requested time range, the cache is replaced with the validated ticket. glow-up arc ✨
• -R — requests renewal of the ticket-granting ticket. note that an expired ticket cannot be renewed, even if the ticket is still within its renewable life. harsh but true 💀

note that renewable tickets that have expired as reported by klist may sometimes be renewed using this option, because the KDC applies a grace period to account for client-KDC clock skew. see krb5.conf clockskew setting. she's a little forgiving, as a treat 🫶

• -k [-i | -t keytab_file] — requests a ticket, obtained from a key in the local host's keytab. where's the keytab at? you can point to it with the -t keytab_file option, or use -i to say "use the default client keytab". otherwise the default keytab gets used. by default, a host ticket for the local host is requested, but any principal may be specified. and on a KDC, there's a special keytab location, KDB:, that you can use to indicate that kinit should open the KDC database and look up the key directly — which lets an administrator obtain tickets as any principal that supports authentication based on the key. admin main character energy 👑
• -n — Requests anonymous processing. Two types of anonymous principals are supported.

for fully anonymous Kerberos, configure pkinit on the KDC and configure pkinit_anchors in the client's krb5.conf. then use the -n option with a principal of the form @REALM (an empty principal name followed by the at-sign and a realm name). if the KDC permits it, an anonymous ticket will be returned. incognito mode fr fr 🕶️

a second form of anonymous tickets is supported too; these are realm-exposed tickets — they hide the identity of the client but not the client's realm. for this mode, use kinit -n with a normal principal name. if supported by the KDC, the principal (but not realm) will be replaced by the anonymous principal.

as of release 1.8, the MIT Kerberos KDC only supports fully anonymous operation. so like. that's the one 💀

• -I input_ccache — Specifies the name of a credentials cache that already contains a ticket. When obtaining that ticket, if information about how that ticket was obtained was also stored to the cache, that information will be used to affect how new credentials are obtained, including preselecting the same methods of authenticating to the KDC. she remembers how she did it last time 💅
• -T armor_ccache — Specifies the name of a credentials cache that already contains a ticket. If supported by the KDC, this cache will be used to armor the request, preventing offline dictionary attacks and allowing the use of additional preauthentication mechanisms. Armoring also makes sure that the response from the KDC is not modified in transit. armor. like actual armor. iconic 🛡️
• -c cache_name — use cache_name as the Kerberos 5 credentials (ticket) cache location. if you don't use this option, the default cache location is used.

the default cache location may vary between systems. if the KRB5CCNAME environment variable is set, its value is used to locate the default cache. if a principal name is specified and the type of the default cache supports a collection (such as the DIR type), an existing cache containing credentials for the principal is selected — or a new one is created and becomes the new primary cache. otherwise, any existing contents of the default cache are destroyed by kinit. bestie. she will not hesitate. back up your stuff 😭

• -S service_name — specify an alternate service name to use when getting initial tickets.
• -X attribute[=value] — specify a pre-authentication attribute and value to be interpreted by pre-authentication modules. the acceptable attribute and value values vary from module to module. this option may be specified multiple times to specify multiple attributes. if no value is specified, it is assumed to be "yes".

the following attributes are recognized by the PKINIT pre-authentication mechanism:

• X509_user_identity=value — specify where to find user's X509 identity information
• X509_anchors=value — specify where to find trusted X509 anchor information
• disable_freshness[=yes] — disable sending freshness tokens (for testing purposes only)

• --request-pac | --no-request-pac — mutually exclusive, okay? if --request-pac is set, ask the KDC to include a PAC in authdata; if --no-request-pac is set, ask the KDC not to include a PAC; if neither are set, the KDC will follow its default, which is typically is to include a PAC if doing so is supported. pick a lane, both is not an option 🎀

---

🌈 ENVIRONMENT 🌈

See kerberos for a description of Kerberos environment variables. yes that's the whole section. go read kerberos. iykyk 📖

---

🎀 FILES 🎀

• FILE:/tmp/krb5cc_%{uid} — default location of Kerberos 5 credentials cache
• FILE:/etc/krb5.keytab — default location for the local host's keytab.

---

💜 SEE ALSO 💜

klist, kdestroy, kerberos

---

👑 AUTHOR 👑

MIT

---

🌸 COPYRIGHT 🌸

1985-2025, MIT

---

and that's the whole page, bestie 🫶 shoutout to MIT Kerberos, version 1.22.1, dated 1985-2025 — she's been serving since before you were born and she's still slaying. go get your ticket 💅✨