# Install heimdal with Homebrew, apk, apt, dnf, MacPorts, Nix Free Kerberos 5 implementation. Version 7.8.0 via Homebrew; verified 2026-06-22. ## Install ```sh sudo av install brew:heimdal ``` Additional install commands: ### macOS - Homebrew (100%): ```sh brew install heimdal ``` Evidence: local Homebrew formula metadata - MacPorts (94%): ```sh sudo port install heimdal ``` Evidence: MacPorts ports tree: net/heimdal/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1 ### Linux - apk (92%): ```sh sudo apk add heimdal ``` Evidence: Alpine Linux edge package indexes: heimdal from https://dl-cdn.alpinelinux.org/alpine/edge/main/x86_64/APKINDEX.tar.gz - Debian apt (92%): ```sh sudo apt install heimdal-clients ``` Evidence: Debian stable package indexes: heimdal-clients from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz - dnf (92%): ```sh sudo dnf install heimdal-devel ``` Evidence: Fedora Rawhide package metadata: heimdal-devel from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/e5ca8ce900cd68f5419e1c39ae517343100b306336cbaeb70a3c153121d95094-primary.xml.zst - Nix (92%): ```sh nix profile install nixpkgs#heimdal ``` Evidence: nixpkgs package indexes: pkgs/by-name/he/heimdal/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 ## Package facts - **Package key:** brew:heimdal - **Package manager:** Homebrew - **Package manager page:** - **Version:** 7.8.0 - **Source summary:** Free Kerberos 5 implementation - **Homepage:** - **Repository:** - **Upstream docs:** - **License:** BSD-3-Clause AND BSD-2-Clause AND HPND-export2-US AND LicenseRef-Homebrew-public-domain - **Source archive:** - **Last updated:** 2026-06-22T14:03:42-07:00 - **Generated:** 2026-07-08T07:18:31+00:00 ## Executables - bsearch (cli) - gsstool (cli) - heimtools (cli) - hxtool (cli) - idn-lookup (cli) - iprop-log (cli) - kf (cli) - kgetcred (cli) - kstash (cli) - string2key (cli) - su (cli) - verify_krb5_conf (cli) - bsearch (alias) - gsstool (alias) - heimtools (alias) - hxtool (alias) - idn-lookup (alias) - iprop-log (alias) - kf (alias) - kgetcred (alias) - kstash (alias) - string2key (alias) - su (alias) - verify_krb5_conf (alias) ## Dependencies - lmdb - openldap - openssl@3 ## Build dependencies - pkgconf ## Uses from macOS - libxcrypt - ncurses ## Install behavior - Post-install hook: not defined - Bottle: available on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux ## Freshness - Page generated: 2026-07-08 - Package-manager version: 7.8.0 - Package-manager updated: 2026-06-22 - Local data: ok - Upstream repository: https://github.com/heimdal/heimdal - info: No cached GitHub release or tag data was available. ## Project history and usage Heimdal is a free implementation of Kerberos 5 and related security components, including ASN.1/DER, PKIX, GSS-API tooling, client commands, KDC pieces, and administrative utilities. It matters in package-manager culture because Kerberos is infrastructure software: one package can affect login, single sign-on, service keytabs, credential caches, cross-realm trust, and legacy interoperability. ### Project history Heimdal began as an independent Kerberos 5 implementation associated with Swedish academic and research institutions. The 1998 USENIX paper by Johan Danielsson and Assar Westerlund describes it as an independently developed free Kerberos 5 implementation, unencumbered by United States export restrictions, compatible with other implementations, and close to the MIT Kerberos 5 API. That origin explains both the project's name and its long-running role as an alternative to MIT Kerberos in Unix-like systems. The project repository describes Heimdal as implementing ASN.1/DER, PKIX, and Kerberos, with man pages for most commands and community channels for discussion and announcements. The codebase is not just a KDC: it includes client programs, libraries, administrative tools, GSS mechanisms, PKIX utilities, and support code such as roken. Heimdal's NEWS file shows the long maintenance arc of security infrastructure. Entries include protocol and interoperability work such as AES, SPNEGO, CCAPI, KCM credential caches, Windows change-password support, incremental propagation, PKINIT work, Samba-related plugin improvements, and repeated vulnerability fixes. The release notes also show a gradual move away from weak historical cryptography, including default changes around DES and RC4 in the Heimdal 8 notes. ### Adoption history Heimdal's adoption history is tied to sites and operating systems that need Kerberos but do not necessarily choose MIT Kerberos. The input package facts record Heimdal packages across Homebrew, Debian and Ubuntu clients, Fedora development packages, MacPorts, Nix, Alpine, and other Unix packaging systems. Its presence in package managers reflects the need to build software against Kerberos and GSS-API libraries even when a machine is not itself a KDC. The setup manual reflects real deployment patterns: administrators create realms, configure `/etc/krb5.conf`, initialize the database, manage keytabs, run kadmind, configure slave servers, and use incremental propagation. This makes Heimdal both a developer dependency and an operations package; package updates can matter to security posture, enterprise authentication, and cross-platform interoperability. ### How it is used Typical Heimdal usage spans user commands, service configuration, and realm administration. Users acquire and inspect credentials with tools such as `kinit` and `klist`; services use keytabs; administrators configure realms and KDC discovery in `krb5.conf`; KDC operators create databases, manage principals through kadmin, and propagate changes to slaves. The manual also documents environment variables shared with MIT-style Kerberos tooling, including `KRB5_CONFIG` for alternate configuration, `KRB5CCNAME` for credential cache selection, and keytab-related variables for service and client keytabs. Those knobs are important in package environments because multiple Kerberos implementations or test realms can coexist on one machine. ### Why package nerds care Heimdal is package-nerd significant because it is one of the packages where ABI, command naming, crypto defaults, and distro policy all matter. A seemingly ordinary formula can provide libraries that many other packages link against, command names that conflict or complement system Kerberos, and defaults that affect whether old realms, Samba, SSH/GSSAPI, LDAP, or campus SSO integrations keep working. It is also a reminder that package managers distribute institutions, not just programs: Kerberos sits at the boundary between operating systems, universities, enterprises, network filesystems, directory services, and standards bodies. Heimdal's independent origin, BSD-style licensing, and broad Unix packaging make it an enduring alternative implementation in that ecosystem. ### Timeline - 1998: Danielsson and Westerlund presented Heimdal as an independent free Kerberos 5 implementation at USENIX. - 2000s: NEWS entries document Kerberos 4 compatibility work, Windows password-change support, AFS-related features, AES, SPNEGO, CCAPI, and KCM support. - 2009: GitHub repository metadata records the hosted Heimdal repository. - 2022: Heimdal 7.8 release notes list multiple security fixes, including PAC parsing, SPNEGO, DES/3DES/arcfour, Unicode normalization, and ASN.1 decoder issues. - Heimdal 8 development: NEWS entries document OpenSSL 3 support, PKINIT algorithm agility, stronger default enctypes, KDC/plugin improvements, KEYRING credential cache support, and removal of NTLM-related functionality. ### Related projects - Heimdal is directly related to MIT Kerberos, the Kerberos protocol standards, GSS-API, PKIX tooling, Samba integration, AFS-related workflows, OpenSSH/GSSAPI deployments, and operating-system Kerberos stacks. In package managers it often appears beside MIT krb5, cyrus-sasl, OpenLDAP, Samba, SSH, and other software that can use Kerberos credentials. ### Sources - - - - - ## Security Notes narrow executable package without higher-risk signals. - **Geiger risk:** green / low - narrow executable package without higher-risk signals ## Configuration and credential file locations These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval. ## Configuration files - Unix: /etc/krb5.conf, /var/heimdal/kadmind.acl, /var/heimdal/slaves ## Credential files - Unix: /etc/krb5.keytab, %{LOCALSTATEDIR}/user/%{euid}/client.keytab, /tmp/krb5cc_ ## Source Database Details - **Source Database:** Homebrew formula API - **Tap:** homebrew/core - **Full Name:** heimdal - **Version Scheme:** 0 - **Revision:** 1 - **Bottle Stable Root URL:** - **Deprecated:** no - **Disabled:** no - **Keg Only:** yes - **URL Keys:** stable ## Other Package-Manager Records - Debian apt - heimdal-clients - 7.8.git20221117.28daf24+dfsg-9+deb13u1: normalized package name match | Debian stable package indexes: heimdal-clients from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | Heimdal Kerberos - clients | http://www.h5l.org/ - Debian apt - heimdal-dev - 7.8.git20221117.28daf24+dfsg-9+deb13u1: normalized package name match | Debian stable package indexes: heimdal-dev from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | Heimdal Kerberos - development files | http://www.h5l.org/ - Debian apt - heimdal-docs - 7.8.git20221117.28daf24+dfsg-9+deb13u1: normalized package name match | Debian stable package indexes: heimdal-docs from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | Heimdal Kerberos - documentation | http://www.h5l.org/ - Debian apt - heimdal-kcm - 7.8.git20221117.28daf24+dfsg-9+deb13u1: normalized package name match | Debian stable package indexes: heimdal-kcm from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | Heimdal Kerberos - KCM daemon | http://www.h5l.org/ - Debian apt - heimdal-kdc - 7.8.git20221117.28daf24+dfsg-9+deb13u1: normalized package name match | Debian stable package indexes: heimdal-kdc from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | Heimdal Kerberos - key distribution center (KDC) | http://www.h5l.org/ - Debian apt - heimdal-multidev - 7.8.git20221117.28daf24+dfsg-9+deb13u1: normalized package name match | Debian stable package indexes: heimdal-multidev from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | Heimdal Kerberos - Multi-implementation Development | http://www.h5l.org/ - Debian apt - heimdal-servers - 7.8.git20221117.28daf24+dfsg-9+deb13u1: normalized package name match | Debian stable package indexes: heimdal-servers from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | Heimdal Kerberos - server programs | http://www.h5l.org/ - Debian apt - libasn1-8t64-heimdal - 7.8.git20221117.28daf24+dfsg-9+deb13u1: normalized package name match | Debian stable package indexes: libasn1-8t64-heimdal from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | Heimdal Kerberos - ASN.1 library | http://www.h5l.org/ - Debian apt - libgssapi3t64-heimdal - 7.8.git20221117.28daf24+dfsg-9+deb13u1: normalized package name match | Debian stable package indexes: libgssapi3t64-heimdal from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | Heimdal Kerberos - GSSAPI support library | http://www.h5l.org/ - Debian apt - libhcrypto5t64-heimdal - 7.8.git20221117.28daf24+dfsg-9+deb13u1: normalized package name match | Debian stable package indexes: libhcrypto5t64-heimdal from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | Heimdal Kerberos - crypto library | http://www.h5l.org/ - Debian apt - libhdb9t64-heimdal - 7.8.git20221117.28daf24+dfsg-9+deb13u1: normalized package name match | Debian stable package indexes: libhdb9t64-heimdal from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | Heimdal Kerberos - kadmin server library | http://www.h5l.org/ - Debian apt - libheimbase1t64-heimdal - 7.8.git20221117.28daf24+dfsg-9+deb13u1: normalized package name match | Debian stable package indexes: libheimbase1t64-heimdal from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | Heimdal Kerberos - Base library | http://www.h5l.org/ - Debian apt - libheimntlm0t64-heimdal - 7.8.git20221117.28daf24+dfsg-9+deb13u1: normalized package name match | Debian stable package indexes: libheimntlm0t64-heimdal from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | Heimdal Kerberos - NTLM support library | http://www.h5l.org/ - Debian apt - libhx509-5t64-heimdal - 7.8.git20221117.28daf24+dfsg-9+deb13u1: normalized package name match | Debian stable package indexes: libhx509-5t64-heimdal from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | Heimdal Kerberos - X509 support library | http://www.h5l.org/ - Debian apt - libkadm5clnt7t64-heimdal - 7.8.git20221117.28daf24+dfsg-9+deb13u1: normalized package name match | Debian stable package indexes: libkadm5clnt7t64-heimdal from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | Heimdal Kerberos - kadmin client library | http://www.h5l.org/ - Debian apt - libkadm5srv8t64-heimdal - 7.8.git20221117.28daf24+dfsg-9+deb13u1: normalized package name match | Debian stable package indexes: libkadm5srv8t64-heimdal from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | Libraries for Heimdal Kerberos | http://www.h5l.org/ ## Related links - [Source-control packages](https://www.automicvault.com/pkg/source-control-tools/) - Belongs to a source-control command family. - [Terminal utility packages](https://www.automicvault.com/pkg/terminal-utilities/) - Matched terminal and command-line workflow metadata. - [Networking and protocol packages](https://www.automicvault.com/pkg/networking-protocol-tools/) - Matched network, protocol, or remote-service metadata. - [Security and crypto packages](https://www.automicvault.com/pkg/security-crypto-tools/) - Matched security, identity, cryptography, password, signing, or certificate metadata. - [lmdb](https://www.automicvault.com/pkg/brew/lmdb/) - Runtime dependency declared by Homebrew. - [openldap](https://www.automicvault.com/pkg/brew/openldap/) - Runtime dependency declared by Homebrew. - [openssl@3](https://www.automicvault.com/pkg/brew/openssl-3/) - Runtime dependency declared by Homebrew. - [pkgconf](https://www.automicvault.com/pkg/brew/pkgconf/) - Build dependency declared by Homebrew. - [krb5](https://www.automicvault.com/pkg/brew/krb5/) - Shares av.db curated category or tags: authentication, cli, kerberos, security. - [kstart](https://www.automicvault.com/pkg/brew/kstart/) - Shares av.db curated category or tags: authentication, cli, kerberos, security. - [msktutil](https://www.automicvault.com/pkg/brew/msktutil/) - Shares av.db curated category or tags: authentication, cli, kerberos, security. - [cyrus-sasl](https://www.automicvault.com/pkg/brew/cyrus-sasl/) - Shares av.db curated category or tags: authentication, cli, security. - [google-authenticator-libpam](https://www.automicvault.com/pkg/brew/google-authenticator-libpam/) - Shares av.db curated category or tags: authentication, cli, security. - [libjwt](https://www.automicvault.com/pkg/brew/libjwt/) - Shares av.db curated category or tags: authentication, cli, security. - [libu2f-server](https://www.automicvault.com/pkg/brew/libu2f-server/) - Shares av.db curated category or tags: authentication, cli, security. - [libyubikey](https://www.automicvault.com/pkg/brew/libyubikey/) - Shares av.db curated category or tags: authentication, cli, security. ## Combined YAML source View the package source record on GitHub. [combined/heimdal.yml](https://github.com/automic-vault/db/blob/main/combined/heimdal.yml) ## Sources - Nucleus package database - Geiger risk classifier - package-page enrichment - curated configuration and credential file locations - curated package history - package version freshness - av.db category and tag curation - package relationship graph - external package-manager database matches - cross-ecosystem install command graph