If you are an HPC user and need Kerberos support, you need to call the service number for your home realm MSRC.
Our site runs MIT Kerberos V to support many services. To use the Kerberized versions of telnet, ftp, rlogin, and rsh, place /usr/krb5/bin in your PATH environment variable ahead of system-located Berkeley "r" commands (/usr/ucb and /usr/bsd).
We require the use of Kerberos on all incoming connections.
Once you have been authenticated to the Kerberos server, you can automatically pass your Kerberos credentials to other hosts and services. You would then be able to log into other hosts in the cmf.nrl.navy.mil domain without supplying your password again. It is important to avoid sending a cleartext password across any network.
The command klist will list your Kerberos tickets. Each ticket has a default expiration time of 10 hours. For long-running jobs see the renewable tickets below.
The command kinit will obtain a Kerberos ticket-granting ticket. The command aklog will use the ticket-granting ticket to obtain an AFS ticket and token.
Note... If possible, run kinit on your local machine to avoid sending your password in cleartext across the network. This is important computer security for both you and our site.
As mentioned previously, Kerberos tickets expire after 10 hours. There are many cases where you wish to run a program that will take longer than 10 hours, but still have credentials to write into AFS space. You can accomplish this by using the krenew program.
To use this program, first get a renewable ticket using the -r option to kinit. The -r option takes as an argument the maximum amount of time you wish to renew the ticket.
You can check the maximum renewable time of your ticket using klist.
Once you have a renewable ticket, run your job using krenew. (Just run the command krenew with your job as the command-line argument.)
krenew will automatically renew your tokens at the appropriate times, making sure that you always have valid Kerberos and AFS credentials.
The maximum amount of time you may renew tickets is seven days. If you wish to run jobs that last longer than seven days, please send your request to the ccshelp@cmf.nrl.navy.mil mailing list.
It is possible to run authenticated cron and/or at jobs, but it requires the involvement of an administrator. Please contact the ccshelp@cmf.nrl.navy.mil mailing list if you wish to do this.
You can read the Kerberos User's Guide for more detailed information on how to use Kerberos.
Send comments or questions to ccshelp@cmf.nrl.navy.mil
NRL ~ Code 5000 ~ Code 5500 ~ Code 5590