1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
|
'\" te
.\" Copyright 1987, 1989 by the Student Information Processing Board of the Massachusetts Institute of Technology. For copying and distribution information, please see the file kerberosv5/mit-sipb-copyright.h.
.\" Portions Copyright (c) 2004, Sun Microsystems, Inc. All Rights Reserved
.\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License"). You may not use this file except in compliance with the License.
.\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing. See the License for the specific language governing permissions and limitations under the License.
.\" When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE. If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
.TH WARN.CONF 4 "Mar 30, 2005"
.SH NAME
warn.conf \- Kerberos warning configuration file
.SH SYNOPSIS
.LP
.nf
/etc/krb5/warn.conf
.fi
.SH DESCRIPTION
.LP
The \fBwarn.conf\fR file contains configuration information specifying how
users will be warned by the \fBktkt_warnd\fR daemon about ticket expiration. In
addition, this file can be used to auto-renew the user's Ticket-Granting Ticket
(TGT) instead of warning the user. Credential expiration warnings and
auto-renew results are sent, by means of syslog, to \fBauth.notice\fR.
.sp
.LP
Each Kerberos client host must have a \fBwarn.conf\fR file in order for users
on that host to get Kerberos warnings from the client. Entries in the
\fBwarn.conf\fR file must have the following format:
.sp
.in +2
.nf
\fIprincipal\fR [renew[:\fIopt1\fR,...\fIoptN\fR]] syslog|terminal \fItime\fR
.fi
.in -2
.sp
.LP
or:
.sp
.in +2
.nf
\fIprincipal\fR [renew[:\fIopt1\fR,...\fIoptN\fR]] mail \fItime\fR [\fIemail address\fR]
.fi
.in -2
.sp
.ne 2
.na
\fB\fIprincipal\fR\fR
.ad
.RS 17n
Specifies the principal name to be warned. The asterisk (\fB*\fR) wildcard can
be used to specify groups of principals.
.RE
.sp
.ne 2
.na
\fB\fBrenew\fR\fR
.ad
.RS 17n
Automatically renew the credentials (TGT) until renewable lifetime expires.
This is equivalent to the user running \fBkinit\fR \fB-R\fR.
.sp
The renew options include:
.sp
.ne 2
.na
\fB\fBlog-success\fR\fR
.ad
.RS 15n
Log the result of the renew attempt on success using the specified method
(\fBsyslog\fR|\fBterminal\fR|\fBmail\fR).
.RE
.sp
.ne 2
.na
\fB\fBlog-failure\fR\fR
.ad
.RS 15n
Log the result of the renew attempt on failure using the specified method
(\fBsyslog\fR|\fBterminal\fR|\fBmail\fR). Some renew failure conditions are:
TGT renewable lifetime has expired, the KDCs are unavailable, or the cred cache
file has been removed.
.RE
.sp
.ne 2
.na
\fB\fBlog\fR\fR
.ad
.RS 15n
Same as specifying both \fBlog-success\fR and \fBlog-failure\fR.
.RE
.LP
Note -
.sp
.RS 2
If no log options are given, no logging is done.
.RE
.RE
.sp
.ne 2
.na
\fB\fBsyslog\fR\fR
.ad
.RS 17n
Sends the warnings to the system's syslog. Depending on the
\fB/etc/syslog.conf\fR file, syslog entries are written to the
\fB/var/adm/messages\fR file and/or displayed on the terminal.
.RE
.sp
.ne 2
.na
\fB\fBterminal\fR\fR
.ad
.RS 17n
Sends the warnings to display on the terminal.
.RE
.sp
.ne 2
.na
\fB\fBmail\fR\fR
.ad
.RS 17n
Sends the warnings as email to the address specified by \fIemail_address\fR.
.RE
.sp
.ne 2
.na
\fB\fItime\fR\fR
.ad
.RS 17n
Specifies how much time before the \fBTGT\fR expires when a warning should be
sent. The default time value is seconds, but you can specify \fBh\fR (hours)
and \fBm\fR (minutes) after the number to specify other time values.
.RE
.sp
.ne 2
.na
\fB\fIemail_address\fR\fR
.ad
.RS 17n
Specifies the email address at which to send the warnings. This field must be
specified only with the \fBmail\fR field.
.RE
.SH EXAMPLES
.LP
\fBExample 1 \fRSpecifying Warnings
.sp
.LP
The following \fBwarn.conf\fR entry
.sp
.in +2
.nf
\fB* syslog 5m\fR
.fi
.in -2
.sp
.sp
.LP
specifies that warnings will be sent to the syslog five minutes before the
expiration of the \fBTGT\fR for all principals. The form of the message is:
.sp
.in +2
.nf
jdb@ACME.COM: your kerberos credentials expire in 5 minutes
.fi
.in -2
.sp
.LP
\fBExample 2 \fRSpecifying Renewal
.sp
.LP
The following \fBwarn.conf\fR entry:
.sp
.in +2
.nf
* renew:log terminal 30m
.fi
.in -2
.sp
.LP
\&...specifies that renew results will be sent to the user's terminal 30
minutes before the expiration of the TGT for all principals. The form of the
message (on renew success) is:
.sp
.in +2
.nf
myname@ACME.COM: your kerberos credentials have been renewed
.fi
.in -2
.SH FILES
.ne 2
.na
\fB\fB/usr/lib/krb5/ktkt_warnd\fR\fR
.ad
.RS 28n
Kerberos warning daemon
.RE
.SH ATTRIBUTES
.LP
See \fBattributes\fR(5) for descriptions of the following attributes:
.sp
.sp
.TS
box;
c | c
l | l .
ATTRIBUTE TYPE ATTRIBUTE VALUE
_
Interface Stability Evolving
.TE
.SH SEE ALSO
.LP
\fBkinit\fR(1), \fBkdestroy\fR(1), \fBktkt_warnd\fR(1M), \fBsyslog.conf\fR(4),
\fButmpx\fR(4), \fBattributes\fR(5), \fBkerberos\fR(5), \fBpam_krb5\fR(5)
.SH NOTES
.LP
The auto-renew of the TGT is attempted only if the user is logged-in, as
determined by examining \fButmpx\fR(4).
|
