Prompt for password if any checks fail and the - p option was supplied. The configuration of klogind is done by command line argu- ments passed by inetd. If this authentication system is used by the client and the authorization check is passed, then the user is allowed to log in. If this authentication system is used by the client and the authorization check is passed, then the user is allowed to log in. If this option is not included, access is denied without successful authentication and authorization using one of the previous mechanisms.
P Prompt the user for a password.
This checksum provides additionl security by preventing an attacker from changing the initial connection information. If this option is specified, older Kerberos V5 clients that do not send a checksum in the authenticator will not be able to authenticate to this server. This option is mutually exclusive with the -i option. Since it is difficult to remove a checksum from an authenticator without making the authenticator invalid, this default mode is almost as significant of a security improvement as -c if new clients are used. It has the additional advantage of backwards compatability with some clients.