KINKD(8)

NAME
kinkd - KINK key management daemon

SYNOPSIS
kinkd [-dhFV] [-f configfile] [-D level]

DESCRIPTION
kinkd is a key management daemon, which supports the Kerberized Internet Negotiation of Keys (KINK) protocol. It is driven by upcalls from the kernel via the PF_KEYv2 interface or by negotiation requests from remote peers, and manages IPsec SAs according to racoon2.conf.

The following options are available:

-d  Increase the debugging level. This causes more verbose logging. This flag may occur multiple times.

-f configfile
    Read configurations from the specified file.

-h  Show simple help messages.

-D level
    Use the directly specified debugging level (1 -- 3).

-F  Run in the foreground. kinkd does not detach itself from the terminal and does not become a daemon. Logs are output to the stderr.

-V  Show the version.

kinkd exits on SIGTERM or SIGINT. It reloads the configuration on SIGHUP.

IPsec policies are managed by spmd(8), thus it must be started before kinkd. When spmd(8) restarts, kinkd needs to be reloaded to reconnect with it.

FILES
/usr/pkg/etc/racoon2/racoon2.conf
    The default configuration file for racoon2.
/var/run/kinkd.pid
    The PID file of the current instance of the daemon.
/var/run/kinkd.rc
    The replay cache file.

COMPATIBILITY

This version of kinkd, which is based on RFC 4430, is not interoperable with racoon2-20051102a and older, which is based on draft-ietf-kink-kink-06.
-   The KINK header format and the location of the Cksum field were changed.
-   The format of KINK_ENCRYPT was changed.
-   Kerberos prfs for Simplified Profiles were changed from draft-ietf-krb-wg-crypto-07 to RFC 3961.
-   The values of KINK next payload types were defiend. (Values from draft-02 have been used previously.)
-   Key usage numbers were assigned. (Zeros have been used previously by mistake.)

SEE ALSO
racoon2(7), racoon2.conf(5), spmd(8), iked(8), ipsec(4) Kerberized Internet Negotiation of Keys (KINK), RFC 4430, March 2006.

Documentations on the Kerberos5 library you are using. Its FILES, ENVIRONMENT, etc will affect the behavior of kinkd.

HISTORY
The kinkd command was first implemented at The University of Tokyo in 2003. It took the ISAKMP parser from racoon(8). It then appeared in the racoon2 IPsec key management kit.

AUTHORS
kinkd was written by KAMADA Ken'ichi. WIDE/racoon2 project <http://www.racoon2.wide.ad.jp/> maintains the code.

BUGS
User-to-User mode is not yet available (and thus the GETTGT command and related payloads are not yet implemented).

Retrieving ticket is currently implemented as a blocking operation. Therefore kinkd will be stalled for a while if there is no answer from the KDC (the KDC is not responding, packets are dropped, etc).

The replay cache is not preserved across restarts.

When linked with the MIT krb5 library, the ccache size (thus the virtual size of the daemon) will continue to grow and never be reduced.

SA bundles (e.g. AH+ESP) in tunnel mode do not work.

and more.