KLIST(1)

💖 KLIST(1) 💖

okay bestie, welcome to the MIT Kerberos manual, and today's main character is klist — she's the one who tells you what tickets and keys you're actually holding. 🎀

---

✨ NAME ✨

klist — list cached Kerberos tickets 🎟️

---

🦋 SYNOPSIS 🦋

klist [-e] [[-c] [-l] [-A] [-f] [-s] [-a [-n]]] [-C] [-k [-i] [-t] [-K]]
[-V] [-d] [cache_name|keytab_name]

---

🌸 DESCRIPTION 🌸

So basically, klist lists the Kerberos principal and the Kerberos tickets that are chilling in a credentials cache, or the keys that are held in a keytab file. That's it, that's the whole vibe. 👑

---

✨ OPTIONS ✨

• -e — shows you the encryption types of the session key and the ticket, for every credential in the credentials cache, or for every key in the keytab file. ✨
• -l — if there's a cache collection available, this pops up a whole table summarising all the caches hanging out in that collection. 🗂️
• -A — if there's a cache collection available, this shows the contents of all the caches in the collection. not one, not some — all of them. 💅
• -c — list the tickets held in a credentials cache. this is the default if you don't specify either -c or -k, so like, she's the main character by default. 👑
• -f — shows the flags present in the credentials, using these abbreviations:
  • F — Forwardable
  • f — forwarded
  • P — Proxiable
  • p — proxy
  • D — postDateable
  • d — postdated
  • R — Renewable
  • I — Initial
  • i — invalid
  • H — Hardware authenticated
  • A — preAuthenticated
  • T — Transit policy checked
  • O — Okay as delegate
  • a — anonymous
• -s — makes klist run silently (produces no output at all, so quiet, so mysterious 🤫). klist will exit with status 1 if the credentials cache can't be read or is expired, and with status 0 otherwise.
• -a — display the list of addresses in credentials. 📍
• -n — show numeric addresses instead of reverse-resolving them. no detective work, just numbers. 🔢
• -C — list the configuration data that has been stored in the credentials cache when klist encounters it. by default, configuration data is not listed. 🙈
• -k — list the keys held in a keytab file. 🔑
• -i — combined with -k, this defaults to using the default client keytab instead of the default acceptor keytab, if no name is given. 🫶
• -t — display the time entry timestamps for each keytab entry in the keytab file. ⏰
• -K — display the value of the encryption key in each keytab entry in the keytab file. 👀
• -d — display the authdata types (if any) for each entry. 🔍
• -V — display the Kerberos version number and then exit. bye bestie 👋

okay so if cache_name or keytab_name isn't specified, klist will display the credentials in the default credentials cache or keytab file, whichever is appropriate. and if the KRB5CCNAME environment variable is set, its value is used to locate the default ticket cache. iykyk 💅

---

🌈 ENVIRONMENT 🌈

see kerberos for a description of the Kerberos environment variables. 🧚

---

🍓 FILES 🍓

• FILE:/tmp/krb5cc_%{uid} — default location of the Kerberos 5 credentials cache 💖
• FILE:/etc/krb5.keytab — default location for the local host's keytab file 🔑

---

👑 SEE ALSO 👑

kinit, kdestroy, kerberos

---

💜 AUTHOR 💜

MIT

---

⭐ COPYRIGHT ⭐

1985-2026, MIT

---

and that's a wrap, babe 🎀 this was KLIST(1) from the MIT Kerberos manual, version 1.22.2 — stay caffeinated, stay authenticated, and go run kinit before your tickets expire, fr fr 💖✨🦋