k5start, when run with the -K option to run as a daemon, no longer exits if the initial authentication fails (unless -x was given). Instead, it reports the error to standard error and then continues to run, attempting authentication every minute as if authentication had failed after it had started. For both k5start with a command or -K and no -x flag, and krenew with the -i flag, repeatedly retry the initial authentication. The first retry will be immediate, and then the commands will keep trying with exponential backoff to one minute intervals, and then continuously at one minute intervals until the command is killed or authentication succeeds. k5start and krenew will no longer start any other command until the initial authentication succeeds, fixing startup behavior when running a command that must have valid Kerberos tickets immediately on start. Clean up the temporary ticket cache on k5start failure if -o, -g, or -m were given. The -H flag to k5start or krenew may now be used in conjunction with -K and controls whether the ticket is renewed when the command wakes up. Normally, the ticket will be renewed if it will expire sooner than two minutes after the next time the command will wake up. If -H is specified, its value replaces the default value of two minutes. Add a new -a option to both k5start and krenew that, when used with -K, tells those programs to refresh tickets every time they wake up. This is useful with -t to ensure that the AFS token renewal program is always run, even if something else renews the ticket cache before k5start or krenew wake up. It also provides more predictable ticket refresh behavior. This probably should have been the default with -K from the beginning, but the default wasn't changed to keep backward compatibility. Consider always using -a with -K. Fix k5start and krenew to not incorrectly reject the -b flag in conjunction with -K or a command.