LOGIN(8)

👑 LOGIN(8) — login.krb5, bestie edition

okay so real talk: this is the LOGIN(8) page from the System Manager's Manual, and the star of the show is login.krb5, aka the kerberos enhanced login program. she's an icon, she's a vibe, and she's about to authenticate u. let's get into it 💅

login.krb5 [-p] [-fFe username] [-r | -k | -K | -h hostname]

---

✨ NAME ✨

login.krb5 — the kerberos enhanced login program 🎀

---

🦋 SYNOPSIS 🦋

login.krb5 [-p] [-fFe username] [-r | -k | -K | -h hostname]

---

💖 DESCRIPTION 💖

so login.krb5 is literally a glow-up of the BSD login program, and she's out here doing two jobs, no cap 🫶

first: she's the sub-process that krlogind and telnetd use to kick off a user session. second: she's a drop-in replacement for the command-line login program, and when u invoke her with a password she goes and acquires Kerberos tickets for u. main character energy fr.

here's the flow, bestie: login.krb5 will prompt for a username, or u can just hand her one on the command line like login.krb5 username, and then she prompts for a password. that password gets used to acquire Kerberos Version 5 tickets (if possible ✨). she'll also attempt to run aklog to snag AFS tokens for the user. the version 5 tickets get tested against a local krb5.keytab if one's available — that's the vibe check, verifying the tickets before letting the user in 🔥

but!! and this is the important part: if the password matches the entry in /etc/passwd, the user gets unconditionally allowed in. that's the safety net so u can still use the machine if the network's being a whole mess 😭

---

🌸 OPTIONS 🌸

• -p — preserve the current environment. keep the vibes exactly as they were ✨
• -r hostname — pass hostname to rlogind. must be the last argument, periodt.
• -h hostname — pass hostname to telnetd, etc. also must be the last argument 🫶
• -f name — perform pre-authenticated login, e.g. datakit, xterm, etc.; this one allows preauthenticated login as root 👑
• -F name — perform pre-authenticated login, e.g. datakit, xterm, etc.; allows preauthenticated login as root too 💅
• -e name — perform pre-authenticated, encrypted login. must do term negotiation 🔐

ok tiny heads-up: -r and -h both gotta be the last thing u say. she's not flexible about that, she's a queen with boundaries.

---

🧚 CONFIGURATION 🧚

plot twist, login.krb5 is also configured via krb5.conf using the login stanza. here's a little collection of options dealing with initial authentication, served fresh 🍓

• krb5_get_tickets — use password to get V5 tickets. default value true ✨
• krb_run_aklog — attempt to run aklog. default value false
• aklog_path — where to find it [not yet implemented.] default value $(prefix)/bin/aklog
• accept_passwd — don't accept plaintext passwords [not yet implemented]. default value false

ngl, two of these are labeled not yet implemented, so don't come for me if they're not doing anything yet 🙈

---

💀 DIAGNOSTICS 💀

all diagnostic messages are returned on the connection or tty associated with stderr. so if something's acting up, that's where she'll be spilling the tea 😭

---

🌈 SEE ALSO 🌈

rlogind(8), rlogin(1), telnetd(8)

---

that's the whole page, bestie — no crumbs left behind 🫶 this was the LOGIN(8) entry from the System Manager's Manual, and yeah, the footer's just that same LOGIN(8) tag again, no fancy version or date to brag about. go forth and authenticate responsibly 💜