kinit(1) on Solnix vs Linux and the BSDs
On Solnix, kinit is the illumos kinit at /usr/bin/kinit. It takes short options only and, by default, stores tickets in /tmp/krb5cc_uid. The most important difference for BSD users is that NetBSD's kinit has a different option set: -S takes a principal, -a takes an address list, and a trailing command can be run.
The manual pages
- Solnix: kinit(1) from
pkgs.solnix.illumos-world-man· illumos.org - FreeBSD: kinit(1) 15.1-RELEASE
- NetBSD: kinit(1) 11.0
What Solnix runs
A default Solnix system runs the illumos kinit at /usr/bin/kinit. No other variants are shipped. The bundle has no Linux page for kinit, so no Linux comparison is made. Use kdestroy(1) to destroy tickets.
Differences
| Compared with | Topic | What differs |
|---|---|---|
| NetBSD | -S meaning | Solnix -S names an alternate service name for the initial ticket. On NetBSD, -S (--server) takes a principal and gets a ticket for a service other than krbtgt/LOCAL.REALM. FreeBSD matches Solnix.Source: Solnix kinit(1) -S service_name; NetBSD kinit(1) -S principal, --server; FreeBSD kinit(1) -S service_name |
| NetBSD | -a meaning | Solnix -a takes no argument and requests tickets with the local addresses. On NetBSD, -a (--extra-addresses) takes an address list that is added to the system's local addresses in the ticket.Source: Solnix kinit(1) -a; NetBSD kinit(1) -a, --extra-addresses; FreeBSD kinit(1) -a |
| NetBSD | -k and -t keytab use | Solnix and FreeBSD use -k [-t keytab_file]: -k selects the keytab and -t names a file. On NetBSD, -t alone already reads the key from a keytab, and -k (--use-keytab) means the default keytab, normally FILE:/etc/krb5.keytab.Source: Solnix kinit(1) -k [-t keytab_file]; FreeBSD kinit(1) -k [-i | -t keytab_file]; NetBSD kinit(1) -t, -k |
| NetBSD | long options | NetBSD kinit accepts long forms of its options (--forwardable, --lifetime=time, --keytab= and so on). The Solnix synopsis lists short options only. Scripts using NetBSD long options fail on Solnix.Source: NetBSD kinit(1) SYNOPSIS; Solnix kinit(1) SYNOPSIS |
| NetBSD | -V and -P | Solnix and FreeBSD have -V (verbose) and -P (non-proxiable). The NetBSD page documents neither. It has --version and --help instead.Source: Solnix kinit(1) -V, -P; FreeBSD kinit(1) -V, -P; NetBSD kinit(1) SYNOPSIS |
| NetBSD | running a command | NetBSD kinit accepts [principal [command]]. With a command it sets up new credential caches (and an AFS PAG), runs the command, then removes the credentials. The Solnix synopsis takes only [principal]. Source: NetBSD kinit(1) SYNOPSIS and DESCRIPTION; Solnix kinit(1) SYNOPSIS |
| NetBSD | non-interactive password | NetBSD has --password-file=filename, which reads the password from the first line of a file, or from standard input if the name is STDIN. The Solnix and FreeBSD pages document no such option.Source: NetBSD kinit(1) --password-file; Solnix kinit(1) OPTIONS; FreeBSD kinit(1) OPTIONS |
| FreeBSD, NetBSD | anonymous, enterprise and canonicalized principals | FreeBSD has -n (anonymous), -C (canonicalize) and -E (enterprise name). NetBSD has -n/--anonymous and --enterprise. The Solnix synopsis has none of these.Source: FreeBSD kinit(1) -n, -C, -E; NetBSD kinit(1) -n, --enterprise; Solnix kinit(1) SYNOPSIS |
| FreeBSD | armoring, input cache, PAC | FreeBSD kinit adds -I input_ccache, -T armor_ccache, -i (default client keytab) and --request-pac/--no-request-pac. The Solnix page documents none of these.Source: FreeBSD kinit(1) SYNOPSIS, -I, -T, -k [-i | -t]; Solnix kinit(1) SYNOPSIS |
| NetBSD | -X and -e options | Solnix and FreeBSD accept -X attribute[=value] for pre-authentication plugins (for example X509_user_identity for PKINIT). NetBSD has no -X, but has -e to request a specific enctype, which Solnix lacks.Source: Solnix kinit(1) -X; FreeBSD kinit(1) -X; NetBSD kinit(1) -e, --enctypes |
| FreeBSD, NetBSD | default principal | Solnix kinit without options prompts for your principal and password. FreeBSD picks a principal from the existing cache or the local username. NetBSD uses a system-generated default, typically the login name at the default realm. Source: Solnix kinit(1) DESCRIPTION; FreeBSD kinit(1) DESCRIPTION; NetBSD kinit(1) DESCRIPTION |
| FreeBSD, NetBSD | default credential cache | Solnix stores tickets by default in /tmp/krb5cc_uid and destroys the cache's existing contents. FreeBSD says the default location varies and honours KRB5CCNAME, and may use a collection cache. NetBSD documents KRB5CCNAME. The visible Solnix text does not mention it. Source: Solnix kinit(1) DESCRIPTION; FreeBSD kinit(1) -c; NetBSD kinit(1) ENVIRONMENT |
| FreeBSD, NetBSD | -s start time format | Solnix -s accepts an absolute time or a duration, trying absolute first. FreeBSD -s takes a duration only, the delay before the ticket becomes valid. NetBSD takes a generic time specification, such as 1h, for a start in the future.Source: Solnix kinit(1) -s start_time; FreeBSD kinit(1) -s start_time; NetBSD kinit(1) -s, --start-time |
Standards
- POSIX: kinit is not a POSIX.1-2024 utility.
Writing portable scripts
- Use only the short options common to all three pages:
-c,-f,-F,-l,-p,-r,-R,-s,-vand-A. Avoid-a,-S,-kand-tin portable scripts, because their meaning or argument differs, mainly on NetBSD. - Do not assume a ticket cache path. Set KRB5CCNAME or pass
-cexplicitly, because the Solnix default is /tmp/krb5cc_uid and the FreeBSD default varies.
Every difference here is taken from the manual pages linked above: Solnix's published page, Linux (man-pages and the GNU and util-linux manuals), FreeBSD, OpenBSD and NetBSD. Each row names its source. Where a manual is silent, this page is too. Compiled 2026-10-26. Found a mistake? Mail hackers@lists.solnix.io.