1 '\" te
   2 .\" Copyright 1987, 1989 by the Student Information Processing Board of the Massachusetts Institute of Technology.  For copying and distribution information,  please see the file kerberosv5/mit-sipb-copyright.h.
   3 .\" Portions Copyright (c) 2004, Sun Microsystems, Inc.  All Rights Reserved
   4 .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License").  You may not use this file except in compliance with the License.
   5 .\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing.  See the License for the specific language governing permissions and limitations under the License.
   6 .\" When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE.  If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
   7 .TH WARN.CONF 4 "Mar 30, 2005"
   8 .SH NAME
   9 warn.conf \- Kerberos warning configuration file
  10 .SH SYNOPSIS
  11 .LP
  12 .nf
  13 /etc/krb5/warn.conf
  14 .fi
  15 
  16 .SH DESCRIPTION
  17 .sp
  18 .LP
  19 The \fBwarn.conf\fR file contains configuration information specifying how
  20 users will be warned by the \fBktkt_warnd\fR daemon about ticket expiration. In
  21 addition, this file can be used to auto-renew the user's Ticket-Granting Ticket
  22 (TGT) instead of warning the user. Credential expiration warnings and
  23 auto-renew results are sent, by means of syslog, to \fBauth.notice\fR.
  24 .sp
  25 .LP
  26 Each Kerberos client host must have a \fBwarn.conf\fR file in order for users
  27 on that host to get Kerberos warnings from the client. Entries in the
  28 \fBwarn.conf\fR file must have the following format:
  29 .sp
  30 .in +2
  31 .nf
  32 \fIprincipal\fR [renew[:\fIopt1\fR,...\fIoptN\fR]] syslog|terminal \fItime\fR
  33 .fi
  34 .in -2
  35 
  36 .sp
  37 .LP
  38 or:
  39 .sp
  40 .in +2
  41 .nf
  42 \fIprincipal\fR [renew[:\fIopt1\fR,...\fIoptN\fR]] mail \fItime\fR [\fIemail address\fR]
  43 .fi
  44 .in -2
  45 
  46 .sp
  47 .ne 2
  48 .na
  49 \fB\fIprincipal\fR\fR
  50 .ad
  51 .RS 17n
  52 Specifies the principal name to be warned. The asterisk (\fB*\fR) wildcard can
  53 be used to specify groups of principals.
  54 .RE
  55 
  56 .sp
  57 .ne 2
  58 .na
  59 \fB\fBrenew\fR\fR
  60 .ad
  61 .RS 17n
  62 Automatically renew the credentials (TGT) until renewable lifetime expires.
  63 This is equivalent to the user running \fBkinit\fR \fB-R\fR.
  64 .sp
  65 The renew options include:
  66 .sp
  67 .ne 2
  68 .na
  69 \fB\fBlog-success\fR\fR
  70 .ad
  71 .RS 15n
  72 Log the result of the renew attempt on success using the specified method
  73 (\fBsyslog\fR|\fBterminal\fR|\fBmail\fR).
  74 .RE
  75 
  76 .sp
  77 .ne 2
  78 .na
  79 \fB\fBlog-failure\fR\fR
  80 .ad
  81 .RS 15n
  82 Log the result of the renew attempt on failure using the specified method
  83 (\fBsyslog\fR|\fBterminal\fR|\fBmail\fR). Some renew failure conditions are:
  84 TGT renewable lifetime has expired, the KDCs are unavailable, or the cred cache
  85 file has been removed.
  86 .RE
  87 
  88 .sp
  89 .ne 2
  90 .na
  91 \fB\fBlog\fR\fR
  92 .ad
  93 .RS 15n
  94 Same as specifing both \fBlog-success\fR and \fBlog-failure\fR.
  95 .RE
  96 
  97 .LP
  98 Note -
  99 .sp
 100 .RS 2
 101 If no log options are given, no logging is done.
 102 .RE
 103 .RE
 104 
 105 .sp
 106 .ne 2
 107 .na
 108 \fB\fBsyslog\fR\fR
 109 .ad
 110 .RS 17n
 111 Sends the warnings to the system's syslog. Depending on the
 112 \fB/etc/syslog.conf\fR file, syslog entries are written to the
 113 \fB/var/adm/messages\fR file and/or displayed on the terminal.
 114 .RE
 115 
 116 .sp
 117 .ne 2
 118 .na
 119 \fB\fBterminal\fR\fR
 120 .ad
 121 .RS 17n
 122 Sends the warnings to display on the terminal.
 123 .RE
 124 
 125 .sp
 126 .ne 2
 127 .na
 128 \fB\fBmail\fR\fR
 129 .ad
 130 .RS 17n
 131 Sends the warnings as email to the address specified by \fIemail_address\fR.
 132 .RE
 133 
 134 .sp
 135 .ne 2
 136 .na
 137 \fB\fItime\fR\fR
 138 .ad
 139 .RS 17n
 140 Specifies how much time before the \fBTGT\fR expires when a warning should be
 141 sent. The default time value is seconds, but you can specify \fBh\fR (hours)
 142 and \fBm\fR (minutes) after the number to specify other time values.
 143 .RE
 144 
 145 .sp
 146 .ne 2
 147 .na
 148 \fB\fIemail_address\fR\fR
 149 .ad
 150 .RS 17n
 151 Specifies the email address at which to send the warnings. This field must be
 152 specified only with the \fBmail\fR field.
 153 .RE
 154 
 155 .SH EXAMPLES
 156 .LP
 157 \fBExample 1 \fRSpecifying Warnings
 158 .sp
 159 .LP
 160 The following \fBwarn.conf\fR entry
 161 
 162 .sp
 163 .in +2
 164 .nf
 165 \fB* syslog 5m\fR
 166 .fi
 167 .in -2
 168 .sp
 169 
 170 .sp
 171 .LP
 172 specifies that warnings will be sent to the syslog five minutes before the
 173 expiration of the \fBTGT\fR for all principals. The form of the message is:
 174 
 175 .sp
 176 .in +2
 177 .nf
 178 jdb@ACME.COM: your kerberos credentials expire in 5 minutes
 179 .fi
 180 .in -2
 181 .sp
 182 
 183 .LP
 184 \fBExample 2 \fRSpecifying Renewal
 185 .sp
 186 .LP
 187 The following \fBwarn.conf\fR entry:
 188 
 189 .sp
 190 .in +2
 191 .nf
 192 * renew:log terminal 30m
 193 .fi
 194 .in -2
 195 
 196 .sp
 197 .LP
 198 \&...specifies that renew results will be sent to the user's terminal 30
 199 minutes before the expiration of the TGT for all principals. The form of the
 200 message (on renew success) is:
 201 
 202 .sp
 203 .in +2
 204 .nf
 205 myname@ACME.COM: your kerberos credentials have been renewed
 206 .fi
 207 .in -2
 208 
 209 .SH FILES
 210 .sp
 211 .ne 2
 212 .na
 213 \fB\fB/usr/lib/krb5/ktkt_warnd\fR\fR
 214 .ad
 215 .RS 28n
 216 Kerberos warning daemon
 217 .RE
 218 
 219 .SH ATTRIBUTES
 220 .sp
 221 .LP
 222 See \fBattributes\fR(5) for descriptions of the following attributes:
 223 .sp
 224 
 225 .sp
 226 .TS
 227 box;
 228 c | c
 229 l | l .
 230 ATTRIBUTE TYPE  ATTRIBUTE VALUE
 231 _
 232 Interface Stability     Evolving
 233 .TE
 234 
 235 .SH SEE ALSO
 236 .sp
 237 .LP
 238 \fBkinit\fR(1), \fBkdestroy\fR(1), \fBktkt_warnd\fR(1M), \fBsyslog.conf\fR(4),
 239 \fButmpx\fR(4), \fBattributes\fR(5), \fBkerberos\fR(5), \fBpam_krb5\fR(5)
 240 .SH NOTES
 241 .sp
 242 .LP
 243 The auto-renew of the TGT is attempted only if the user is logged-in, as
 244 determined by examining \fButmpx\fR(4).