klogin1

Usage

Overview

klogin forwards your Kerberos ticket-granting ticket to the machine host using kftgt(1) and then connects to that machine using Kerberos rlogin. If invoked with the -T option or as ktelnet, it uses Kerberos telnet instead, and also takes an optional port argument to connect to a non-standard port.

By default, klogin always uses encryption (the -x option to rlogin or telnet) and always forwards forwardable Kerberos v5 tickets (the -F option). When invoking telnet, klogin always passes the -a flag to tell telnet to automatically log on to the remote system.

You can also give klogin any options supported by either telnet or rlogin and then will be passed to telnet or rlogin as appropriate. Note, however, that the -a option to telnet isn't recognized because klogin always uses -a when using telnet, and the meanings of the -f, -F, and -x flags are reversed (see below).

The host given to klogin is put through a forward and then reverse DNS lookup before being used, to resolve any CNAMEs to their canonical hosts and to handle load-balanced hosts or hosts with multiple A records.

Options

-f

Don't forward tickets to the remote host. This both tells klogin not to run kftgt(1) and tells it not to pass either -f or -F to rlogin or telnet so that Kerberos v5 tickets won't be forwarded.

-F

Don't forward forwardable Kerberos v5 tickets. This tells klogin to pass the -f option to telnet or rlogin rather than -F. Kerberos v4 tickets will still be forwarded, as will Kerberos v5 tickets, but the forwarded Kerberos v5 tickets cannot be forwarded to another host.

--help, -h

Print a summary of options and exit.

--login=username, -l username

Set the username on the remote system to username. This is the user to log in as as well as user to which to forward tickets. If this option is not given, the default will be the username on the local host. This option will often be necessary if the local username differs from the Kerberos principal name, since kftgt and rlogin differ on the default otherwise.

--telnet, -T

Use telnet rather than rlogin. Using this option has the same effect as invoking klogin as ktelnet.

--verbose, -V

Print out each command and the arguments used before it's executed.

--version, -v

Print the version number of klogin and exit.

-x

Don't use encryption. Use of this option is not recommended, as anything sent through the resulting connection can be read by a potential attacker.

--xauth, -A

Try to forward the .Xauthority file to the remote host. This is done using rcp and the .Xauthority file on the remote system will be overwritten, not merged. Note that if the remote system uses AFS as its file system, your dotfiles must be set up so that rcp to that system after a ticket has been forwarded will acquire a token and be able to write to your home directory.

In addition, klogin tries to recognize rlogin and telnet options and pass them along to rlogin or telnet as appropriate.

Caveats

See kftgt(1) for some additional details about Kerberos v4 ticket forwarding and some of the peculiarities thereof.