2005-12-08 12:14:33 +00:00
|
|
|
=head1 NAME
|
|
|
|
|
2007-11-11 22:54:56 +00:00
|
|
|
kas_setpassword - Changes the key field in an Authentication Database entry
|
2005-12-08 12:14:33 +00:00
|
|
|
|
|
|
|
=head1 SYNOPSIS
|
|
|
|
|
2006-03-01 05:02:29 +00:00
|
|
|
=for html
|
|
|
|
<div class="synopsis">
|
|
|
|
|
|
|
|
B<kas setpassword> S<<< B<-name> <I<name of user>> >>>
|
|
|
|
S<<< [B<-new_password> <I<new password>>] >>> S<<< [B<-kvno> <I<key version number>>] >>>
|
|
|
|
S<<< [B<-admin_username> <I<admin principal to use for authentication>>] >>>
|
|
|
|
S<<< [B<-password_for_admin> <I<admin password>>] >>> S<<< [B<-cell> <I<cell name>>] >>>
|
|
|
|
S<<< [B<-servers> <I<explicit list of authentication servers>>+] >>>
|
2005-12-13 19:21:13 +00:00
|
|
|
[B<-noauth>] [B<-help>]
|
|
|
|
|
2006-03-01 05:02:29 +00:00
|
|
|
B<kas setpasswd> S<<< B<-na> <I<name of user>> >>> S<<< [B<-ne> <I<new password>>] >>>
|
|
|
|
S<<< [B<-k> <I<key version number>>] >>>
|
|
|
|
S<<< [B<-a> <I<admin principal to use for authentication>>] >>>
|
|
|
|
S<<< [B<-p> <I<admin password>>] >>> S<<< [B<-c> <I<cell name>>] >>>
|
|
|
|
S<<< [B<-s> <I<explicit list of authentication servers>>+] >>> [B<-no>] [B<-h>]
|
|
|
|
|
|
|
|
B<kas setp> S<<< B<-na> <I<name of user>> >>> S<<< [B<-ne> <I<new password>>] >>>
|
|
|
|
S<<< [B<-k> <I<key version number>>] >>>
|
|
|
|
S<<< [B<-a> <I<admin principal to use for authentication>>] >>>
|
|
|
|
S<<< [B<-p> <I<admin password>>] >>> S<<< [B<-c> <I<cell name>>] >>>
|
|
|
|
S<<< [B<-s> <I<explicit list of authentication servers>>+] >>> [B<-no>] [B<-h>]
|
|
|
|
|
|
|
|
B<kas sp> S<<< B<-na> <I<name of user>> >>> S<<< [B<-ne> <I<new password>>] >>>
|
|
|
|
S<<< [B<-k> <I<key version number>>] >>>
|
|
|
|
S<<< [B<-a> <I<admin principal to use for authentication>>] >>>
|
|
|
|
S<<< [B<-p> <I<admin password>>] >>> S<<< [B<-c> <I<cell name>>] >>>
|
|
|
|
S<<< [B<-s> <I<explicit list of authentication servers>>+] >>> [B<-no>] [B<-h>]
|
|
|
|
|
|
|
|
=for html
|
|
|
|
</div>
|
2005-12-08 12:14:33 +00:00
|
|
|
|
|
|
|
=head1 DESCRIPTION
|
|
|
|
|
2005-12-13 19:21:13 +00:00
|
|
|
The B<kas setpassword> command accepts a character string of unlimited
|
|
|
|
length, scrambles it into a form suitable for use as an encryption key,
|
|
|
|
places it in the key field of the Authentication Database entry named by
|
|
|
|
the B<-name> argument, and assigns it the key version number specified by
|
|
|
|
the B<-kvno> argument.
|
2005-12-08 12:14:33 +00:00
|
|
|
|
|
|
|
To avoid making the password string visible at the shell prompt, omit the
|
2005-12-13 19:21:13 +00:00
|
|
|
B<-new_password> argument. Prompts then appear at the shell which do not
|
|
|
|
echo the password visibly.
|
2005-12-08 12:14:33 +00:00
|
|
|
|
2005-12-13 19:21:13 +00:00
|
|
|
When changing the B<afs> server key, also issue B<bos addkey> command to
|
|
|
|
add the key (with the same key version number) to the
|
2010-05-26 18:20:57 +01:00
|
|
|
F</usr/afs/etc/KeyFile> file. See the I<OpenAFS Administration Guide> for
|
2005-12-13 19:21:13 +00:00
|
|
|
instructions.
|
2005-12-08 12:14:33 +00:00
|
|
|
|
2005-12-13 19:21:13 +00:00
|
|
|
The command interpreter checks the password string subject to the
|
|
|
|
following conditions:
|
2005-12-08 12:14:33 +00:00
|
|
|
|
|
|
|
=over 4
|
|
|
|
|
|
|
|
=item *
|
|
|
|
|
2005-12-13 19:21:13 +00:00
|
|
|
If there is a program called kpwvalid in the same directory as the B<kas>
|
|
|
|
binary, the command interpreter invokes it to process the password. For
|
|
|
|
details, see L<kpwvalid(8)>.
|
2005-12-08 12:14:33 +00:00
|
|
|
|
|
|
|
=item *
|
|
|
|
|
2005-12-13 19:21:13 +00:00
|
|
|
If the B<-reuse> argument to the B<kas setfields> command has been used to
|
|
|
|
prohibit reuse of previous passwords, the command interpreter verifies
|
|
|
|
that the password is not too similar too any of the user's previous 20
|
|
|
|
passwords. It generates the following error message at the shell:
|
2005-12-08 12:14:33 +00:00
|
|
|
|
|
|
|
Password was not changed because it seems like a reused password
|
|
|
|
|
2005-12-13 19:21:13 +00:00
|
|
|
To prevent a user from subverting this restriction by changing the
|
|
|
|
password twenty times in quick succession (manually or by running a
|
|
|
|
script), use the B<-minhours> argument on the B<kaserver> initialization
|
|
|
|
command. The following error message appears if a user attempts to change
|
|
|
|
a password before the minimum time has passed:
|
2005-12-08 12:14:33 +00:00
|
|
|
|
2005-12-21 00:41:17 +00:00
|
|
|
Password was not changed because you changed it too
|
2005-12-08 12:14:33 +00:00
|
|
|
recently; see your systems administrator
|
|
|
|
|
|
|
|
=back
|
|
|
|
|
|
|
|
=head1 OPTIONS
|
|
|
|
|
|
|
|
=over 4
|
|
|
|
|
2005-12-13 19:21:13 +00:00
|
|
|
=item B<-name> <I<name of user>>
|
2005-12-08 12:14:33 +00:00
|
|
|
|
|
|
|
Names the entry in which to record the new key.
|
|
|
|
|
2005-12-13 19:21:13 +00:00
|
|
|
=item B<-new_password> <I<new password>>
|
2005-12-08 12:14:33 +00:00
|
|
|
|
|
|
|
Specifies the character string the user types when authenticating to
|
|
|
|
AFS. Omit this argument and type the string at the resulting prompts so
|
2005-12-13 19:21:13 +00:00
|
|
|
that the password does not echo visibly. Note that some non-AFS programs
|
|
|
|
cannot handle passwords longer than eight characters.
|
2005-12-08 12:14:33 +00:00
|
|
|
|
2005-12-13 19:21:13 +00:00
|
|
|
=item B<-kvno> <I<key version number>>
|
2005-12-08 12:14:33 +00:00
|
|
|
|
2005-12-13 19:21:13 +00:00
|
|
|
Specifies the key version number associated with the new key. Provide an
|
|
|
|
integer in the range from C<0> through C<255>. If omitted, the default is
|
|
|
|
C<0> (zero), which is probably not desirable for server keys.
|
2005-12-08 12:14:33 +00:00
|
|
|
|
2005-12-13 19:21:13 +00:00
|
|
|
=item B<-admin_username> <I<admin principal>>
|
2005-12-08 12:14:33 +00:00
|
|
|
|
|
|
|
Specifies the user identity under which to authenticate with the
|
2005-12-13 19:21:13 +00:00
|
|
|
Authentication Server for execution of the command. For more details, see
|
|
|
|
L<kas(8)>.
|
2005-12-08 12:14:33 +00:00
|
|
|
|
2005-12-13 19:21:13 +00:00
|
|
|
=item B<-password_for_admin> <I<admin password>>
|
2005-12-08 12:14:33 +00:00
|
|
|
|
2005-12-13 19:21:13 +00:00
|
|
|
Specifies the password of the command's issuer. If it is omitted (as
|
|
|
|
recommended), the B<kas> command interpreter prompts for it and does not
|
|
|
|
echo it visibly. For more details, see L<kas(8)>.
|
2005-12-08 12:14:33 +00:00
|
|
|
|
2005-12-13 19:21:13 +00:00
|
|
|
=item B<-cell> <I<cell name>>
|
2005-12-08 12:14:33 +00:00
|
|
|
|
|
|
|
Names the cell in which to run the command. For more details, see
|
2005-12-13 19:21:13 +00:00
|
|
|
L<kas(8)>.
|
2005-12-08 12:14:33 +00:00
|
|
|
|
2005-12-13 19:21:13 +00:00
|
|
|
=item B<-servers> <I<authentication servers>>+
|
2005-12-08 12:14:33 +00:00
|
|
|
|
|
|
|
Names each machine running an Authentication Server with which to
|
2005-12-13 19:21:13 +00:00
|
|
|
establish a connection. For more details, see L<kas(8)>.
|
2005-12-08 12:14:33 +00:00
|
|
|
|
2005-12-13 19:21:13 +00:00
|
|
|
=item B<-noauth>
|
2005-12-08 12:14:33 +00:00
|
|
|
|
2005-12-13 19:21:13 +00:00
|
|
|
Assigns the unprivileged identity C<anonymous> to the issuer. For more
|
|
|
|
details, see L<kas(8)>.
|
2005-12-08 12:14:33 +00:00
|
|
|
|
2005-12-13 19:21:13 +00:00
|
|
|
=item B<-help>
|
2005-12-08 12:14:33 +00:00
|
|
|
|
2005-12-13 19:21:13 +00:00
|
|
|
Prints the online help for this command. All other valid options are
|
|
|
|
ignored.
|
2005-12-08 12:14:33 +00:00
|
|
|
|
|
|
|
=back
|
|
|
|
|
|
|
|
=head1 EXAMPLES
|
|
|
|
|
2005-12-13 19:21:13 +00:00
|
|
|
In the following example, an administrator using the C<admin> account
|
|
|
|
changes the password for C<pat> (presumably because C<pat> forgot the
|
|
|
|
former password or got locked out of his account in some other way).
|
2005-12-08 12:14:33 +00:00
|
|
|
|
|
|
|
% kas setpassword pat
|
|
|
|
Password for admin:
|
|
|
|
new_password:
|
|
|
|
Verifying, please re-enter new_password:
|
|
|
|
|
|
|
|
=head1 PRIVILEGE REQUIRED
|
|
|
|
|
2005-12-13 19:21:13 +00:00
|
|
|
Individual users can change their own passwords. To change another user's
|
|
|
|
password or the password (server encryption key) for server entries such
|
|
|
|
as C<afs>, the issuer must have the C<ADMIN> flag set in his or her
|
|
|
|
Authentication Database entry.
|
2005-12-08 12:14:33 +00:00
|
|
|
|
|
|
|
=head1 SEE ALSO
|
|
|
|
|
2005-12-13 19:21:13 +00:00
|
|
|
L<bos_addkey(8)>,
|
|
|
|
L<kas(8)>,
|
2006-02-27 20:46:25 +00:00
|
|
|
L<kaserver(8)>,
|
|
|
|
L<kpwvalid(8)>
|
2005-12-08 12:14:33 +00:00
|
|
|
|
|
|
|
=head1 COPYRIGHT
|
|
|
|
|
|
|
|
IBM Corporation 2000. <http://www.ibm.com/> All Rights Reserved.
|
|
|
|
|
|
|
|
This documentation is covered by the IBM Public License Version 1.0. It was
|
|
|
|
converted from HTML to POD by software written by Chas Williams and Russ
|
|
|
|
Allbery, based on work by Alf Wachsmann and Elizabeth Cassell.
|