Do I Need to Run Kinit Again When Ticket Expires Kerberos
Provided by: kstart_4.two-1_amd64 
Proper name
krenew - Renew a Kerberos ticket
SYNOPSIS
krenew [-abhiLstvx] [-c child pid file] [-H minutes] [-K minutes] [-k ticket cache] [-p pid file] [command ...]
Clarification
krenew renews an existing renewable ticket. When run without any arguments, information technology just attempts to renew the existing ticket-granting ticket in the current ticket cache, equivalent to "kinit -R", just information technology can optionally run a program like aklog to refresh AFS tokens, tin run as a daemon and wake upward periodically to renew the ticket enshroud, or tin can run a specified control and go on renewing the ticket cache until the command finishes (or renewal is no longer possible). If a command is specified, krenew past default wakes upward every 60 minutes (1 hour) to cheque the ticket cache. If a control is given, krenew makes a copy of the ticket cache and creates a private ticket cache just for that command, thus isolating it from after destruction of the original ticket enshroud. This allows krenew to maintain authentication for a command fifty-fifty if, for instance, the user running the command logs out and OpenSSH destroys their original ticket cache. If a control is given, information technology will not be run using the trounce, so if you want to use shell metacharacters in the control with their special significant, give "sh -c command" equally the command to run and quote command. If the command contains command-line options (like "-c"), put "--" on the command line before the showtime of the command to tell krenew to not parse those options as its own. If krenew is built with setpag() back up and AFS tokens are requested with the -t option, it will put the command in a separate PAG before obtaining AFS tokens then that they don't interfere with other processes on the system. When running a command, krenew propagates HUP, TERM, INT, and QUIT signals to the kid process and does non get out when those signals are received. (If the propagated signal causes the child process to exit, krenew will then get out.) This allows krenew to react properly when run nether a command supervision arrangement such as runit(eight) or svscan(viii) that uses signals to command supervised commands, and to run interactive commands that should receive Ctrl-C. If a running krenew receives an ALRM bespeak, it immediately refreshes the ticket cache regardless of whether information technology is in danger of expiring.
OPTIONS
-a When run with either the -K flag or a command, always renew tickets each time krenew wakes up. Without this selection, krenew volition only endeavour to renew a ticket as often equally necessary to prevent the ticket from expiring. With this option, krenew will renew tickets according to the interval specified with the -K flag. This behavior probably should take been the default behavior of -K. The default was not changed to avert changes for existing users, but for new applications, consider always using -a with -K. This pick is important if some other program is manipulating the ticket cache that krenew is using. For example, if some other program is automatically renewing a ticket more than ofttimes than krenew, then krenew volition never see a ticket that is close to expiring and will therefore, by default, never try to renew the ticket. This means that krenew will also never renew AFS tokens, fifty-fifty if the -t pick was given, since krenew merely renews AFS tokens subsequently it successfully renews a ticket. If this option is specified in such a state of affairs, krenew will renew its ticket every time it checks the ticket, and then AFS tokens volition be renewed. This argument is only valid in combination with either -Thousand or a command to run. -b Later starting, detach from the decision-making terminal and run in the groundwork. This option merely makes sense in combination with -One thousand or a command that krenew volition exist running. krenew will not groundwork itself until afterward it does the initial ticket renewal, and then that whatsoever initial errors volition exist reported, merely it will then redirect output to /dev/null and no subsequent errors will be reported. If this flag is given, krenew will besides change directories to "/". All paths (such as to a command to run or a PID file) should therefore exist given equally absolute, not relative, paths. If used in conjunction with a command to run, that control will also run in the background and volition also have its input and output redirected to /dev/null. It volition take to report any errors via some other mechanism for the errors to be seen. Use of this flag on Mac OS X without specifying a file-based ticket enshroud past either using -k or setting KRB5CCNAME volition probably non do what you want. Ticket caches on Mac OS X are, past default, per-session and with -b krenew will detach itself from your existing ticket cache. Instead, to renew the default ticket cache on Mac Os 10, try something similar: (krenew -K 60 &) to run krenew in the background but within the current session. When using this option, consider too using -L to study krenew errors to syslog. -c child pid file Relieve the process ID (PID) of the child process into child pid file. kid pid file is created if information technology doesn't exist and overwritten if it does exist. This pick is only immune when a command was given on the command line and is most useful in conjunction with -b to allow management of the running kid process. Annotation that, when used with -b, the PID file is written out later on krenew is backgrounded and changes its working directory to /, so relative paths for the PID file will be relative to / (probably not what you lot want). -H minutes Simply renew the ticket if it has a remaining lifetime of less than minutes minutes. If either the ticket already has a sufficiently long remaining lifetime or renewal was successful, run the command (if one was specified) or exit immediately with status 0 (if none was). Otherwise, try to renew the ticket so that it volition have a remaining lifetime of at least minutes, exit with an mistake if unsuccessful, and so run the command, if any. If -H is used with -Chiliad, krenew will not exit immediately. Instead, the specified remaining lifetime will supplant the default value of two minutes, meaning that krenew volition ensure, each time it wakes upward, that the ticket has a remaining lifetime of the minutes argument. This is an alternative to -a to ensure that tickets e'er have a sure minimal amount of lifetime remaining. -h Display a usage message and exit. -i Ignore errors in renewing the ticket and continue running. Usually, krenew exits every bit shortly as the ticket cache either disappears or the tickets run out of renewable lifetime. If this flag is given, it will complain about the failure to standard error (unless -b was given) just continue running, waking up to endeavor again after the next bank check interval (come across -K). This is useful if some other process may recreate an expired ticket cache and krenew should stay around and deed on that recreated ticket enshroud in one case information technology'due south nowadays. If the initial ticket cache renew fails, krenew will retry the renewal immediately and then with exponential backoff to once per minute, and keep trying until authentication succeeds or it is killed. The control, if any, will non exist started until cache renewal succeeds. This flag is just useful in daemon mode or when a command was given. -K minutes Run in daemon style to keep a ticket alive indefinitely. The program reawakens after minutes minutes, checks if the ticket volition expire before or less than two minutes before the next scheduled check, and renews the ticket if needed. (In other words, it ensures that the ticket will e'er take a remaining lifetime of at least two minutes.) If the -H flag is too given, the lifetime specified by information technology replaces the two infinitesimal default. If this selection is not given but a control was given on the command line, the default interval is 60 minutes (1 hr). If an error occurs in refreshing the ticket cache that doesn't cause krenew to exit, the wake-up interval will be shortened to one minute and the operation retried at that interval for as long equally the error persists. -k ticket cache Use ticket cache equally the ticket cache rather than the contents of the surround variable KRB5CCNAME or the library default. ticket cache may be any ticket cache identifier recognized by the underlying Kerberos libraries. This more often than not supports a path to a file, with or without a leading "FILE:" string, simply may also support other ticket enshroud types. -L Report messages to syslog also as to standard output or standard error. All messages volition be logged with facility LOG_DAEMON. Regular letters that are displayed on standard output are logged with level LOG_NOTICE. Errors that don't cause krenew to terminate when run with -i are logged with level LOG_WARNING. Fatal errors are logged with level LOG_ERR. This is useful when debugging problems in combination with -b. -p pid file Relieve the process ID (PID) of the running krenew procedure into pid file. pid file is created if information technology doesn't be and overwritten if information technology does exist. This option is almost useful in conjunction with -b to allow management of the running krenew daemon. Note that, when used with -b the PID file is written out subsequently krenew is backgrounded and changes its working directory to /, so relative paths for the PID file will exist relative to / (probably not what you want). -due south Normally, when krenew exits abnormally while running a command (if, for example, the ticket'due south renewable lifetime has expired), it leaves the command running. If -s is given, it volition transport a SIGHUP signal to the command before exiting. This can be useful if it'due south pointless for the command to continue running without Kerberos tickets. -t Run an external program after getting a ticket. The default employ of this is to run aklog to go a token. If the environs variable KINIT_PROG is gear up, information technology overrides the compiled-in default. If krenew has been congenital with AFS setpag() back up and a command was given on the command line, krenew volition create a new PAG before obtaining AFS tokens. Otherwise, it volition obtain tokens in the current PAG. -five Be verbose. This will print out a bit of additional information about what is being attempted and what the results are. -x Go out immediately on whatever error. Unremarkably, when running a command or when run with the -K option, krenew keeps running even if it fails to renew the ticket cache equally long as the ticket cache still exists and appears to be renewable. It tries once more at the next check interval. With this selection, krenew volition instead get out.
RETURN VALUES
The plan normally exits with condition 0 if it successfully renews a ticket. If krenew runs aklog or some other program krenew returns the exit condition of that programme.
EXAMPLES
Renew the current ticket-granting ticket. krenew Wake up every ten minutes and check to run across if the ticket cache needs renewing. If it does, re-run aklog as well. krenew -G 10 -t Run the programme /usr/local/bin/compute-job in the background, checking every hour to come across if the ticket needs to be renewed (the default). Put the PID of the krenew task in /var/run/compute.pid. Obtain a new AFS token each time the ticket has to be renewed. krenew -b -t -p /var/run/compute.pid /usr/local/bin/compute-job If you wanted to pass options to /usr/local/bin/compute-job, putting a "--" statement before it would be necessary to keep krenew from interpreting those options as its own. If y'all want to redirect output to a file that requires hallmark to write to, y'all volition need to do that redirection in a sub-shell. In other words, the post-obit control: krenew -t compute-job > /afs/local/data/output won't work if /afs/local/information/output requires an AFS token to write to. The chore, while running, will have an AFS token, but the output redirection is done in the parent shell and doesn't benefit from krenew. The above should instead be written as: krenew -t -- sh -c 'compute-job > /afs/local/data/output' With this command, the vanquish doing the redirection will likewise be run under krenew and have the do good of the AFS token it obtains.
ENVIRONMENT
If the environment variable AKLOG is set, its value volition be used as the program to run with -t rather than the default complied into krenew. If AKLOG is not set and KINIT_PROG is set, its value will be used instead. KINIT_PROG is honored for backward compatibility but its use is not recommended due to its confusing name. If no ticket file (with -yard) or control is specified on the command line, krenew will utilise the environment variable KRB5CCNAME to decide the location of the the ticket granting ticket. If the -k pick is used, KRB5CCNAME will be set to point to the ticket file before running the aklog program or any control given on the control line.
FILES
The default ticket cache is determined by the underlying Kerberos libraries. The default path for aklog is determined at build time, and will usually exist whichever of aklog or afslog is establish in the user's path.
AUTHORS
krenew was written past Russ Allbery <eagle@eyrie.org>. Information technology was based heavily on k5start past Booker C. Bense, which in plow was based on the k4start code written by Robert Morgan.
COPYRIGHT AND LICENSE
Copyright 2022 Russ Allbery <eagle@eyrie.org> Copyright 2006, 2008, 2009, 2010, 2011, 2012, 2022 The Board of Trustees of the Leland Stanford Junior University Copying and distribution of this file, with or without modification, are permitted in any medium without royalty provided the copyright find and this notice are preserved. This file is offered as-is, without any warranty.
Encounter Likewise
k5start(ane), kinit(ane) The kstart spider web page at <http://world wide web.eyrie.org/~eagle/software/kstart/> will have the electric current version of krenew.
Source: https://manpages.ubuntu.com/manpages/bionic/man1/krenew.1.html
0 Response to "Do I Need to Run Kinit Again When Ticket Expires Kerberos"
Post a Comment