KCM(8)

💖 kcm(8) — the process-based credential cache for Kerberos tickets 💖

okay bestie, sit down, hydrate, because this one is a system manager's manual page and it's lowkey iconic. it's called kcm, it lives in section 8 of the manual, and it's giving "the girl who holds everyone's tickets and never tells" energy. 🎟️✨

🌸 NAME 🌸

kcm — process-based credential cache for Kerberos tickets.

like. that's the whole name. short, sweet, slays. 💅

🦋 SYNOPSIS 🦋

kcm [--cache-name=cachename] [-c file | --config-file=file] [-g group |
    --group=group] [--max-request=size] [--disallow-getting-krbtgt]
    [--detach] [-h | --help] [-k principal |
    --system-principal=principal] [-l time | --lifetime=time] [-m mode |
    --mode=mode] [-n | --no-name-constraints] [-r time |
    --renewable-life=time] [-s path | --socket-path=path]
    [--door-path=path] [-S principal | --server=principal] [-t keytab |
    --keytab=keytab] [-u user | --user=user] [-v | --version]

no cap, that's a LOT of options for one little daemon. she's high maintenance and she's worth it. 👑

💜 DESCRIPTION 💜

so kcm is a process based credential cache. that's the whole vibe. 🫶

to actually use it, you gotta set the KRB5CCNAME environment variable to KCM:uid — literally just that, bestie — or you can add this little stanza to your /etc/krb5.conf configuration file:

[libdefaults]
        default_cc_name = KCM:%{uid}

and then make sure kcm is started in the system startup files. do NOT forget that part, it's the whole plot. 🙈

the kcm daemon can hold the credentials for all users in the system. access control is done with Unix-like permissions, which is so real of her. the daemon checks the access on all operations based on the uid and gid of the user. and the tickets are renewed as long as is permitted by the KDC's policy. she keeps them fresh, she keeps them fed. 🍓

the kcm daemon can also keep a SYSTEM credential that server processes can use to access services. one example of usage might be an nss_ldap module that quickly needs to get credentials and doesn't want to renew the ticket itself. lazy? no. efficient. main character energy. ⭐

supported options:

✨ OPTIONS ✨

• --cache-name=cachename — system cache name. name your cache, she deserves a name. 🎀
• -c file, --config-file=file — location of config file. tell her where the config lives.
• -g group, --group=group — system cache group. the group chat the system cache belongs to.
• --max-request=size — max size for a kcm-request. she has boundaries, and this is them.
• --disallow-getting-krbtgt — disallow extracting any krbtgt from the kcm daemon. the krbtgt stays in the building. 🚫
• --detach — detach from console. she's leaving, bye. 👋
• -h, --help — no description given in the original, she just does the thing, iykyk. 💅
• -k principal, --system-principal=principal — system principal name.
• -l time, --lifetime=time — lifetime of system tickets.
• -m mode, --mode=mode — octal mode of system cache. yes, octal. not vibes. numbers. 🔢
• -n, --no-name-constraints — disable credentials cache name constraints.
• -r time, --renewable-life=time — renewable lifetime of system tickets.
• -s path, --socket-path=path — path to kcm domain socket.
• --door-path=path — path to kcm door socket. yes, door. two different sockets, two different paths, don't mix them up bestie. 🚪
• -S principal, --server=principal — server to get system ticket for.
• -t keytab, --keytab=keytab — system keytab name.
• -u user, --user=user — system cache owner.
• -v, --version — no description given in the original either. she's mysterious like that. 🙈

fr fr, that's every single option. nothing skipped, nothing merged, nothing invented. we keep the receipts. 🧾💖

aaaand that's the whole page, bestie! 🌈 this one came from the Debian crew, dated May 29, 2005, and it's filed under KCM(8). love her, respect her, go set that KRB5CCNAME and thrive. periodt. 💅💖✨🦋🌸