KINIT(1) General Commands Manual KINIT(1)

# [NAME](#NAME)

`kinit` — acquire initial tickets

# [SYNOPSIS](#SYNOPSIS)

`kinit` \[`--afslog`] \[`-c` `cachename` | `--cache=cachename`] \[`-f` | `--forwardable`] \[`-F` | `--no-forwardable`] \[`-t` `keytabname` | `--keytab=keytabname`] \[`-l` `time` | `--lifetime=time`] \[`-p` | `--proxiable`] \[`-R` | `--renew`] \[`--renewable`] \[`-r` `time` | `--renewable-life=time`] \[`-S` `principal` | `--server=principal`] \[`-s` `time` | `--start-time=time`] \[`-k` | `--use-keytab`] \[`-v` | `--validate`] \[`-e` `enctypes` | `--enctypes=enctypes`] \[`-a` `addresses` | `--extra-addresses=addresses`] \[`--password-file=filename`] \[`--fcache-version=version-number`] \[`-A` | `--no-addresses`] \[`-n` | `--anonymous`] \[`--enterprise`] \[`--version`] \[`--help`] \[`principal` \[`command`]]

# [DESCRIPTION](#DESCRIPTION)

`kinit` is used to authenticate to the Kerberos server as `principal`, or if none is given, a system generated default (typically your login name at the default realm), and acquire a ticket granting ticket that can later be used to obtain tickets for other services.

Supported options:

[`-c`](#c) `cachename` `--cache=cachename`

The credentials cache to put the acquired ticket in, if other than default.

[`-f`](#f) `--forwardable`

Obtain a ticket than can be forwarded to another host.

[`-F`](#F) `--no-forwardable`

Do not obtain a forwardable ticket.

[`-t`](#t) `keytabname`, `--keytab=keytabname`

Don't ask for a password, but instead get the key from the specified keytab.

[`-l`](#l) `time`, `--lifetime=time`

Specifies the lifetime of the ticket. The argument can either be in seconds, or a more human readable string like ‘1h’.

[`-p`](#p), `--proxiable`

Request tickets with the proxiable flag set.

[`-R`](#R), `--renew`

Try to renew ticket. The ticket must have the ‘renewable’ flag set, and must not be expired.

[`--renewable`](#renewable)

The same as `--renewable-life`, with an infinite time.

[`-r`](#r) `time`, `--renewable-life=time`

The max renewable ticket life.

[`-S`](#S) `principal`, `--server=principal`

Get a ticket for a service other than krbtgt/LOCAL.REALM.

[`-s`](#s) `time`, `--start-time=time`

Obtain a ticket that starts to be valid `time` (which can really be a generic time specification, like ‘1h’) seconds into the future.

[`-k`](#k), `--use-keytab`

The same as `--keytab`, but with the default keytab name (normally `FILE:/etc/krb5.keytab`).

[`-v`](#v), `--validate`

Try to validate an invalid ticket.

[`-e`](#e), `--enctypes=enctypes`

Request tickets with this particular enctype.

[`--password-file=`](#password-file=)`filename`

read the password from the first line of `filename`. If the `filename` is `STDIN`, the password will be read from the standard input.

[`--fcache-version=`](#fcache-version=)`version-number`

Create a credentials cache of version `version-number`.

[`-a`](#a), `--extra-addresses=enctypes`

Adds a set of addresses that will, in addition to the systems local addresses, be put in the ticket. This can be useful if all addresses a client can use can't be automatically figured out. One such example is if the client is behind a firewall. Also settable via `libdefaults/extra_addresses` in [krb5.conf(5)](/man/os/heimdal/krb5.conf.5).

[`-A`](#A), `--no-addresses`

Request a ticket with no addresses.

[`-n`](#n), `--anonymous`

Request an anonymous ticket. With the default (false) setting of the `historical_anon_pkinit` configuration parameter, if the principal is specified as @REALM, then anonymous PKINIT will be used to acquire an unauthenticated anonymous ticket and both the client name and (with fully RFC-comformant KDCs) realm in the returned ticket will be anonymized. Otherwise, authentication proceeds as normal and the anonymous ticket will have only the client name anonymized. With `historical_anon_pkinit` set to `true`, the principal is interpreted as a realm even without an at-sign prefix, and it is not possible to obtain authenticated anonymized tickets.

[`--enterprise`](#enterprise)

Parse principal as a enterprise (KRB5-NT-ENTERPRISE) name. Enterprise names are email like principals that are stored in the name part of the principal, and since there are two @ characters the parser needs to know that the first is not a realm. An example of an enterprise name is “lha@e.kth.se@KTH.SE”, and this option is usually used with canonicalize so that the principal returned from the KDC will typically be the real principal name.

[`--afslog`](#afslog)

Gets AFS tickets, converts them to version 4 format, and stores them in the kernel. Only useful if you have AFS.

The `forwardable`, `proxiable`, `ticket_life`, and `renewable_life` options can be set to a default value from the `appdefaults` section in krb5.conf, see [krb5\_appdefault(3)](/man/os/heimdal/krb5_appdefault.3).

If a `command` is given, `kinit` will set up new credentials caches, and AFS PAG, and then run the given command. When it finishes the credentials will be removed.

# [ENVIRONMENT](#ENVIRONMENT)

[`KRB5CCNAME`](#KRB5CCNAME)

Specifies the default credentials cache.

[`KRB5_CONFIG`](#KRB5_CONFIG)

The file name of krb5.conf, the default being /etc/krb5.conf.

# [SEE ALSO](#SEE_ALSO)

[kdestroy(1)](/man/os/heimdal/kdestroy.1), [klist(1)](/man/os/heimdal/klist.1), [krb5\_appdefault(3)](/man/os/heimdal/krb5_appdefault.3), [krb5.conf(5)](/man/os/heimdal/krb5.conf.5)

April 25, 2006 HEIMDAL

---

Document: kinit(1) from heimdal 7.8.0-r55 (Chainguard OS)
Source: https://github.com/heimdal/heimdal