kftgtd8

Usage

Overview

kftgtd is the server for kftgt. It accepts forwarded Kerberos v4 ticket-granting tickets and saves them for later use by a login session. Access checking is done the same as Kerberos v4 klogind(8).

See kftgt(1) for more information about kftgt and other warnings and caveats about this service.

kftgtd should be started from inetd and must be run as root or be installed setuid root as it needs to be able to read the system srvtab file and change its UID to create tickets. A typical inetd.conf entry looks like:

  kftgtd stream tcp nowait root /usr/sbin/tcpd /usr/local/sbin/kftgtd

You will also need the corresponding entry in /etc/services:

  kftgt         2109/tcp        kftgtd  # Kerberos TGT forwarding svc.

kftgtd times out in 60 seconds if the transaction is not completed.

kftgtd must be running on a machine that is registered for rlogin service; that is, the host must have a srvtab containing an rcmd.<host> key where <host> is the value returned by the krb_get_phost(3) Kerberos library call.