SYNOPSIS
       kinit  [-5] [-4] [-V] [-l lifetime] [-s start_time] [-r renewable_life]
              [-p | -P] [-f | -F] [-a] [-A] [-v] [-R] [-k [-t keytab_file]]
              [-c cache_name] [-S service_name] [-X attribute[=value]] [prin-
              cipal]

DESCRIPTION
       kinit obtains and caches an initial ticket-granting ticket for  princi-
       pal.   The typical default behavior is to acquire only Kerberos 5 tick-
       ets.  However, if kinit was built with both Kerberos 4 support and with
       the default behavior of acquiring both types of tickets, it will try to
       acquire both Kerberos 5 and Kerberos 4 by default.   Any  documentation
       particular  to  Kerberos 4 does not apply if Kerberos 4 support was not
       built into kinit.

OPTIONS
       -5     get Kerberos 5 tickets.  This  overrides  whatever  the  default
              built-in behavior may be.  This option may be used with -4

       -4     get  Kerberos  4  tickets.   This overrides whatever the default
              built-in behavior may be.  This  option  is  only  available  if
              kinit  was built with Kerberos 4 compatibility.  This option may
              be used with -5

       -V     display verbose output.

       -l lifetime
              requests a ticket with the lifetime  lifetime.   The  value  for
              lifetime  must  be  followed immediately by one of the following
              delimiters:

                 s  seconds
                 m  minutes
                 h  hours
                 d  days

              as in "kinit -l 90m".  You cannot mix units; a value of  `3h30m'
              will result in an error.

              If  the  -l option is not specified, the default ticket lifetime
              (configured by each site) is used.  Specifying a ticket lifetime
              longer  than  the  maximum  ticket  lifetime (configured by each
              site) results in a ticket with the maximum lifetime.

       -s start_time
              requests a  postdated  ticket,  valid  starting  at  start_time.
              Postdated tickets are issued with the invalid flag set, and need
              to be fed back to the kdc before use.  (Not applicable  to  Ker-
              beros 4.)

       -r renewable_life
              requests  renewable  tickets,  with  a  total lifetime of renew-
              Kerberos 4.)

       -A     request address-less tickets.  (Not applicable to Kerberos 4.)

       -v     requests that the ticket granting ticket in the cache (with  the
              invalid  flag  set) be passed to the kdc for validation.  If the
              ticket is within its requested time range, the cache is replaced
              with the validated ticket.  (Not applicable to Kerberos 4.)

       -R     requests  renewal  of  the ticket-granting ticket.  Note that an
              expired ticket cannot be renewed, even if the  ticket  is  still
              within its renewable life.  When using this option with Kerberos
              4, the kdc must support Kerberos 5 to Kerberos 4 ticket  conver-
              sion.

       -k [-t keytab_file]
              requests  a host ticket, obtained from a key in the local host's
              keytab file.  The name and location of the keytab  file  may  be
              specified  with the -t keytab_file option; otherwise the default
              name and location will be used.  When  using  this  option  with
              Kerberos 4, the kdc must support Kerberos 5 to Kerberos 4 ticket
              conversion.

       -c cache_name
              use cache_name as the Kerberos 5 credentials (ticket) cache name
              and location; if this option is not used, the default cache name
              and location are used.

              The default credentials cache may vary between systems.  If  the
              KRB5CCNAME  environment  variable  is  set, its value is used to
              name the default ticket cache.  Any  existing  contents  of  the
              cache  are destroyed by kinit.  (Note: The default name for Ker-
              beros 4 comes from the  KRBTKFILE  environment  variable.   This
              option does not apply to Kerberos 4.)

       -S service_name
              specify  an  alternate  service name to use when getting initial
              tickets.  (Applicable to Kerberos 5 or if using both Kerberos  5
              and Kerberos 4 with a kdc that supports Kerberos 5 to Kerberos 4
              ticket conversion.)

       -X attribute[=value]
              specify a pre-authentication attribute and value to be passed to
              pre-authentication  plugins.  The acceptable attribute and value
              values vary from  pre-authentication  plugin  to  plugin.   This
              option  may  be  specified  multiple  times  to specify multiple
              attributes.  If no value is  specified,  it  is  assumed  to  be
              "yes".

              The following attributes are recognized by the OpenSSL pkinit
              pre-authentication mechanism:
                 X509_user_identity=value

FILES
       /tmp/krb5cc_[uid]  default location of  Kerberos  5  credentials  cache
                          ([uid] is the decimal UID of the user).

       /tmp/tkt[uid]  default  location of Kerberos 4 credentials cache ([uid]
                      is the decimal UID of the user).

       /etc/krb5.keytab
                      default location for the local host's keytab file.

SEE ALSO
       klist(1), kdestroy(1), kerberos(1)



                                                                      KINIT(1)