NAME

       kvno - print key version numbers of Kerberos principals

SYNOPSIS

       kvno [-c ccache] [-e etype] [-q] [-h] [-P] [-S sname] [-U for_user] [--u2u ccache] service1 service2 ...

DESCRIPTION

       kvno  acquires  a  service  ticket  for  the specified Kerberos principals and prints out the key version
       numbers of each.

OPTIONS

       -c ccache
              Specifies the name of a credentials cache to use (if not the default)

       -e etype
              Specifies the enctype which will be requested for the session key of all the services named on the
              command line.  This is useful in certain backward compatibility situations.

       -q     Suppress  printing  output  when  successful.   If  a  service ticket cannot be obtained, an error
              message will still be printed and kvno will exit with nonzero status.

       -h     Prints a usage statement and exits.

       -P     Specifies that the service1 service2 ...  arguments are  to  be  treated  as  services  for  which
              credentials  should be acquired using constrained delegation.  This option is only valid when used
              in conjunction with protocol transition.

       -S sname
              Specifies that the service1 service2 ... arguments are interpreted as hostnames, and  the  service
              principals  are  to  be  constructed from those hostnames and the service name sname.  The service
              hostnames will be canonicalized according to the usual rules for constructing service principals.

       -U for_user
              Specifies that protocol transition (S4U2Self) is to be used to  acquire  a  ticket  on  behalf  of
              for_user.  If constrained delegation is not requested, the service name must match the credentials
              cache client principal.

       --u2u ccache
              Requests a user-to-user ticket.  ccache  must  contain  a  local  krbtgt  ticket  for  the  server
              principal.   The  reported  version  number  will  typically  be 0, as the resulting ticket is not
              encrypted in the server's long-term key.

ENVIRONMENT

       See kerberos(7) for a description of Kerberos environment variables.

FILES

       FILE:/tmp/krb5cc_%{uid}
              Default location of the credentials cache

SEE ALSO

       kinit(1), kdestroy(1), kerberos(7)

AUTHOR

       MIT

COPYRIGHT

       1985-2019, MIT