Not all tickets are alike. One ticket might, for example, be forwardable. Another ticket might be postdated. While a third ticket might be both forwardable and postdated. You can see which tickets you have, and what their attributes are, by using the klist command with the -f option:
% /usr/bin/klist -f |
The following symbols indicate the attributes that are associated with each ticket, as displayed by klist:
Preauthenticated
Postdatable
Postdated
Forwardable
Forwarded
Initial
Invalid
Proxiable
Proxy
Renewable
Types of Tickets describes the various attributes that a ticket can have.
This example shows that the user jennifer has an initial ticket, which is forwardable (F) and postdated (d), but not yet validated (i).
% /usr/bin/klist -f Ticket cache: /tmp/krb5cc_74287 Default principal: jennifer@EXAMPLE.COM Valid starting Expires Service principal 09 Mar 04 15:09:51 09 Mar 04 21:09:51 nfs/EXAMPLE.COM@EXAMPLE.COM renew until 10 Mar 04 15:12:51, Flags: Fdi |
The following example shows that the user david has two tickets that were forwarded (f) to his host from another host. The tickets are also forwardable (F).
% klist -f Ticket cache: /tmp/krb5cc_74287 Default principal: david@EXAMPLE.COM Valid starting Expires Service principal 07 Mar 04 06:09:51 09 Mar 04 23:33:51 host/EXAMPLE.COM@EXAMPLE.COM renew until 10 Mar 04 17:09:51, Flags: fF Valid starting Expires Service principal 08 Mar 04 08:09:51 09 Mar 04 12:54:51 nfs/EXAMPLE.COM@EXAMPLE.COM renew until 10 Mar 04 15:22:51, Flags: fF |
The following example shows how to display the encryption types of the session key and the ticket by using the -e option. The -a option is used to map the host address to a host name if the name service can do the conversion.
% klist -fea Ticket cache: /tmp/krb5cc_74287 Default principal: david@EXAMPLE.COM Valid starting Expires Service principal 07 Mar 04 06:09:51 09 Mar 04 23:33:51 krbtgt/EXAMPLE.COM@EXAMPLE.COM renew until 10 Mar 04 17:09:51, Flags: FRIA Etype(skey, tkt): DES cbc mode with RSA-MD5, DES cbc mode with CRC-32 Addresses: client.example.com |