# Install kstart with Homebrew, apk, apt, dnf, Nix
Modified version of kinit that can use keytabs to authenticate. Version 4.3 via Homebrew; verified from local package data. Also installable with debian: sudo apt install kstart.
## Install
```sh
sudo av install brew:kstart
```
Additional install commands:
### macOS
- Homebrew (100%):
```sh
brew install kstart
```
Evidence: local Homebrew formula metadata
### Linux
- apk (92%):
```sh
sudo apk add kstart
```
Evidence: Alpine Linux edge package indexes: kstart from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz
- Debian apt (92%):
```sh
sudo apt install kstart
```
Evidence: Debian stable package indexes: kstart from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz
- dnf (92%):
```sh
sudo dnf install kstart
```
Evidence: Fedora Rawhide package metadata: kstart from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/07190dc5ae9f35ae73866675fed6d95fe6e8d9fe22c9d7cdf85862cb2ed24a4c-primary.xml.zst
- Nix (92%):
```sh
nix profile install nixpkgs#kstart
```
Evidence: nixpkgs package indexes: pkgs/by-name/ks/kstart/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1
## Package facts
- **Package key:** brew:kstart
- **Package manager:** Homebrew
- **Version:** 4.3
- **Source summary:** Modified version of kinit that can use keytabs to authenticate
- **Homepage:**
- **Generated:** 2026-08-03T19:37:03+00:00
## Executables
- k5start (alias)
- krenew (alias)
## Install behavior
- Bottle: not available
## Freshness
- Page generated: 2026-08-03
- Package-manager version: 4.3
## Project history and usage
kstart is Russ Allbery's Kerberos helper package containing k5start and krenew, modified kinit-like tools for obtaining, renewing, and maintaining Kerberos ticket caches for long-running processes.
### Project history
The Eyrie documentation describes k5start as a modified version of kinit that can obtain credentials from a keytab, run as a daemon, refresh credentials periodically, and optionally obtain AFS tokens. krenew shares much of the role but renews an existing renewable ticket cache rather than obtaining new tickets from a password or keytab.
### Adoption history
kstart's adoption is strongest in Kerberos-heavy Unix environments: servers, cron jobs, daemons, batch jobs, and AFS sites where ticket renewal should be handled outside the application. The project page links Debian packages and Debian package tracking, reflecting its place as a small infrastructure utility rather than an end-user application.
### How it is used
Administrators use k5start to run a command with keytab-backed credentials and keep its ticket cache alive, or to run a daemon that refreshes credentials. Users use krenew when a renewable ticket cache exists and a long-running command needs renewal without storing a keytab.
### Why package nerds care
kstart is a classic sysadmin package: small, security-sensitive, low-glamour, and essential in the places that need it. Its value is that it makes Kerberos ticket lifetime management scriptable and separable from the services that consume those tickets.
### Timeline
- 2021-08-31: kstart 4.3 was released.
- 2021-08-31: The project page listed tar.gz and tar.xz release archives plus PGP signatures.
- 2021: The documentation described MIT Kerberos and Heimdal as the thoroughly tested Kerberos libraries on Debian.
### Related projects
- Related projects include MIT Kerberos, Heimdal, kinit, AFS aklog, afslog, OpenAFS, and Debian Kerberos packaging.
### Sources
-
-
-
## Security Notes
narrow executable package without higher-risk signals.
- **Geiger risk:** green / low
- narrow executable package without higher-risk signals
## Other Package-Manager Records
- Debian apt - kstart - 4.3-1: normalized package name match | Debian stable package indexes: kstart from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | Kerberos kinit supporting AFS and ticket refreshing | https://www.eyrie.org/~eagle/software/kstart/
- Nix - kstart: normalized package name match | nixpkgs package indexes: pkgs/by-name/ks/kstart/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1
- Ubuntu apt - kstart - 4.3-1: normalized package name match | Ubuntu 24.04 LTS package indexes: kstart from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | Kerberos kinit supporting AFS and ticket refreshing | https://www.eyrie.org/~eagle/software/kstart/
- apk - kstart - 4.3-r1: normalized package name match | Alpine Linux edge package indexes: kstart from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | Port of kinit for automated refreshing of service kerberos tickets | https://www.eyrie.org/~eagle/software/kstart/
- apk - kstart-doc - 4.3-r1: normalized package name match | Alpine Linux edge package indexes: kstart-doc from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | Port of kinit for automated refreshing of service kerberos tickets (documentation) | https://www.eyrie.org/~eagle/software/kstart/
- dnf - kstart - 4.3-19.fc45: normalized package name match | Fedora Rawhide package metadata: kstart from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/07190dc5ae9f35ae73866675fed6d95fe6e8d9fe22c9d7cdf85862cb2ed24a4c-primary.xml.zst | Daemon version of kinit for Kerberos v5 | http://www.eyrie.org/~eagle/software/kstart/
## Combined YAML source
View the package source record on GitHub. [combined/kstart.yml](https://github.com/mxcl/pkgdb/blob/main/combined/kstart.yml)
## Sources
- pkg.so package database
- Geiger risk classifier
- curated package history
- pkgdb category and tag curation
- external package-manager database matches
- cross-ecosystem install command graph