kinit

kinit USER asks the KDC for a TGT and stores it in the ticket cache. klist shows what is in the cache: the default principal (who you are), each ticket's service, and its start and expiry (klist -k reads a keytab instead). kvno SERVICE obtains and prints the key version of a service ticket without using it: the quick way to ask "does the KDC know this principal?". kdestroy throws the tickets away. -l sets a shorter lifetime; KRB5CCNAME points every tool at a particular cache file.

kinit command usage

kinit [-l LIFETIME] [-c CACHE] PRINCIPAL
klist [-k [KEYTAB]]
kvno SERVICE[/HOST]
kdestroy

Options

-l 20s / -l 10h

kinit: ask for this ticket lifetime

-k [FILE]

klist: read a keytab, not the ticket cache

-c FILE / KRB5CCNAME=FILE

use a particular ticket cache

kinit examples

echo correct-horse | kinit alice

Gets a TGT for alice (reading the password from the pipe; normally typed).

klist

Shows the current tickets, who you are, and when they expire.

kvno host/shellserver.lab

Asks the KDC for a service ticket to that principal and prints its key version.

kdestroy

Empties the ticket cache.

Pitfalls

• No credentials cache found: you have no tickets; run kinit first.
• A clock more than the realm's clockskew off the KDC gets no ticket at all (Clock skew too great).
• A ticket cache is as good as a password while it lasts: keep it readable only by its owner.

Run it on real machines