2005-12-08 12:14:33 +00:00
|
|
|
=head1 NAME
|
|
|
|
|
|
|
|
kaserver - Initializes the Authentication Server
|
|
|
|
|
2006-03-29 22:00:50 +01:00
|
|
|
=head1 SYNOPSIS
|
|
|
|
|
|
|
|
=for html
|
|
|
|
<div class="synopsis">
|
2005-12-08 12:14:33 +00:00
|
|
|
|
2010-05-26 17:25:39 +01:00
|
|
|
B<kaserver> [B<-noAuth>] [B<-database> <I<dbpath>>]
|
2019-09-25 20:39:40 +01:00
|
|
|
S<<< [B<-auditlog> [<I<interface name>>:]<I<path to log file>>[:<I<parameters to interface>>]] >>>
|
|
|
|
S<<< [B<-audit-interface> <I<interface name>>] >>>
|
2006-03-29 22:00:50 +01:00
|
|
|
S<<< [B<-localfiles> <I<lclpath>>] >>> S<<< [B<-minhours> <I<n>>] >>>
|
|
|
|
S<<< [B<-servers> <I<serverlist>>] >>> [B<-enable_peer_stats>]
|
2013-06-14 22:15:03 +01:00
|
|
|
[B<-enable_process_stats>] [B<-rxbind>] [B<-crossrealm>] [B<-help>]
|
2005-12-08 12:14:33 +00:00
|
|
|
|
2006-03-29 22:00:50 +01:00
|
|
|
=for html
|
|
|
|
</div>
|
|
|
|
|
2005-12-08 12:14:33 +00:00
|
|
|
=head1 DESCRIPTION
|
|
|
|
|
2010-05-27 22:40:21 +01:00
|
|
|
The B<kaserver> command initializes the Authentication Server, an obsolete
|
|
|
|
way of providing authentication services to an AFS cell. It should no
|
|
|
|
longer be used; instead, it should be replaced with a Kerberos version 5
|
|
|
|
KDC. It is provided only for support of sites already running the
|
|
|
|
Authentication Server and that have not yet migrated to Kerberos version
|
|
|
|
5.
|
|
|
|
|
|
|
|
For a cell using the Authentication Server, it runs on every database
|
|
|
|
server machine. In the conventional configuration, its binary file is
|
|
|
|
located in the F</usr/afs/bin> directory on a file server machine.
|
2005-12-08 12:14:33 +00:00
|
|
|
|
2005-12-13 19:21:13 +00:00
|
|
|
The B<kaserver> command is not normally issued at the command shell prompt
|
|
|
|
but rather placed into a file server machine's F</usr/afs/local/BosConfig>
|
|
|
|
file with the B<bos create> command. If it is ever issued at the command
|
|
|
|
shell prompt, the issuer must be logged onto a database server machine as
|
|
|
|
the local superuser C<root>.
|
2005-12-08 12:14:33 +00:00
|
|
|
|
|
|
|
As it initializes, the Authentication Server process creates the two files
|
2005-12-13 19:21:13 +00:00
|
|
|
that constitute the Authentication Database, F<kaserver.DB0> and
|
|
|
|
F<kaserver.DBSYS1>, in the F</usr/afs/db> directory if they do not already
|
|
|
|
exist. Use the commands in the B<kas> suite to administer the database.
|
2005-12-08 12:14:33 +00:00
|
|
|
|
|
|
|
The Authentication Server is responsible for several aspects of AFS
|
|
|
|
security, including:
|
|
|
|
|
|
|
|
=over 4
|
|
|
|
|
|
|
|
=item *
|
|
|
|
|
|
|
|
Maintenance of all AFS server encryption keys and user passwords in the
|
|
|
|
Authentication Database.
|
|
|
|
|
|
|
|
=item *
|
|
|
|
|
|
|
|
Creation of the tickets and tokens that users and servers use to establish
|
2005-12-13 19:21:13 +00:00
|
|
|
secure connections. Its Ticket Granting Service (TGS) component performs
|
|
|
|
this function.
|
2005-12-08 12:14:33 +00:00
|
|
|
|
|
|
|
=back
|
|
|
|
|
|
|
|
The Authentication Server records a trace of its activity in the
|
2005-12-13 19:21:13 +00:00
|
|
|
F</usr/afs/logs/AuthLog> file. Use the B<bos getlog> command to display
|
|
|
|
the contents of the file. Use the B<kdb> command to read the protected
|
|
|
|
files associated with the F<AuthLog> file, F<AuthLog.dir> and
|
|
|
|
F<AuthLog.pag>.
|
|
|
|
|
|
|
|
This command does not use the syntax conventions of the AFS command
|
|
|
|
suites. Provide the command name and all option names in full.
|
2005-12-08 12:14:33 +00:00
|
|
|
|
2010-05-27 22:40:21 +01:00
|
|
|
=head1 CAUTIONS
|
|
|
|
|
|
|
|
The Authentication Server provides only Kerberos version 4, which is no
|
|
|
|
longer considered sufficiently secure. It can only use DES encryption for
|
|
|
|
user keys, is vulnerable to known flaws in the Kerberos version 4
|
|
|
|
protocol, and is based on protocols that are obsolete and no longer
|
|
|
|
developed. The Authentication Server is also not widely tested and is
|
|
|
|
known to have problems on some platforms OpenAFS otherwise supports.
|
|
|
|
|
|
|
|
The Authentication Server should not be used for any new deployment. It is
|
|
|
|
provided only for sites that need to use it while preparing for a
|
|
|
|
migration to Kerberos KDC. No significant updates to the Authentication
|
|
|
|
Server will be developed, and it will be removed from a future version of
|
|
|
|
OpenAFS.
|
|
|
|
|
2005-12-08 12:14:33 +00:00
|
|
|
=head1 OPTIONS
|
|
|
|
|
|
|
|
=over 4
|
|
|
|
|
2005-12-13 19:21:13 +00:00
|
|
|
=item B<-noAuth>
|
2005-12-08 12:14:33 +00:00
|
|
|
|
2005-12-13 19:21:13 +00:00
|
|
|
Assigns the unprivileged identity C<anonymous> to the issuer. Thus, it
|
|
|
|
establishes an unauthenticated connection between the issuer and the
|
|
|
|
Authentication Server. It is useful only when authorization checking is
|
|
|
|
disabled on the database server machine. In normal circumstances, the
|
|
|
|
Authentication Server allows only authorized (privileged) users to issue
|
|
|
|
commands that affect or contact the Authentication Database and will
|
|
|
|
refuse to perform such an action even if the B<-noAuth> flag is used.
|
2005-12-08 12:14:33 +00:00
|
|
|
|
2005-12-13 19:21:13 +00:00
|
|
|
=item B<-database> <I<dbpath>>
|
2005-12-08 12:14:33 +00:00
|
|
|
|
|
|
|
Specifies the pathname of an alternate directory in which the
|
|
|
|
Authentication Database files reside. Provide the complete pathname,
|
2005-12-13 19:21:13 +00:00
|
|
|
ending in the base filename to which the C<.DB0> and C<.DBSYS1> extensions
|
|
|
|
are appended. For example, the appropriate value for the default database
|
|
|
|
files is F</usr/afs/db/kaserver>.
|
2005-12-08 12:14:33 +00:00
|
|
|
|
2005-12-13 19:21:13 +00:00
|
|
|
Provide the B<-localfiles> argument along with this one; otherwise, the
|
|
|
|
B<-localfiles> argument is also set to the value of this argument, which
|
|
|
|
is probably inappropriate.
|
2005-12-08 12:14:33 +00:00
|
|
|
|
2019-09-25 20:39:40 +01:00
|
|
|
=item B<-auditlog> [<I<interface name>>:]<I<path to log file>>[:<I<parameters to interface>>]
|
2009-06-24 22:46:27 +01:00
|
|
|
|
2009-07-25 18:37:08 +01:00
|
|
|
Turns on audit logging, and sets the path for the audit log. The audit
|
2009-07-27 02:26:59 +01:00
|
|
|
log records information about RPC calls, including the name of the RPC
|
2009-07-25 18:37:08 +01:00
|
|
|
call, the host that submitted the call, the authenticated entity (user)
|
|
|
|
that issued the call, the parameters for the call, and if the call
|
2019-09-25 20:39:40 +01:00
|
|
|
succeeded or failed. See L<fileserver(8)> for an explanation of the audit
|
|
|
|
facility.
|
2009-06-24 22:46:27 +01:00
|
|
|
|
2019-09-25 20:39:40 +01:00
|
|
|
Note: kaserver supports only a single -auditlog.
|
2009-06-24 22:46:27 +01:00
|
|
|
|
2019-09-25 20:39:40 +01:00
|
|
|
=item B<-audit-interface> <I<interface name>>
|
|
|
|
|
|
|
|
Sets the default audit interface used by the B<-auditlog> option. The
|
|
|
|
initial default is the C<file> interface. See L<fileserver(8)> for
|
|
|
|
an explanation of each interface.
|
2009-06-24 22:46:27 +01:00
|
|
|
|
2005-12-13 19:21:13 +00:00
|
|
|
=item B<-localfiles> <I<lclpath>>
|
2005-12-08 12:14:33 +00:00
|
|
|
|
|
|
|
Specifies the pathname of an alternate directory in which the auxiliary
|
|
|
|
Authentication Database file resides. Provide the complete pathname,
|
2005-12-13 19:21:13 +00:00
|
|
|
ending in the base filename to which the C<auxdb> suffix is appended. For
|
|
|
|
example, the appropriate value for the default auxiliary database file is
|
|
|
|
F</usr/afs/local/kaserver>.
|
2005-12-08 12:14:33 +00:00
|
|
|
|
2005-12-13 19:21:13 +00:00
|
|
|
=item B<-minhours> <I<n>>
|
2005-12-08 12:14:33 +00:00
|
|
|
|
|
|
|
Specifies the minimum number of hours that must pass between password
|
2005-12-13 19:21:13 +00:00
|
|
|
changes made by any regular user. System administrators (with the C<ADMIN>
|
|
|
|
flag in their Authentication Database entry) can change passwords as often
|
|
|
|
as desired. Setting a minimum time between password changes is not
|
|
|
|
recommended.
|
2005-12-08 12:14:33 +00:00
|
|
|
|
2005-12-13 19:21:13 +00:00
|
|
|
=item B<-servers> <I<authentication servers>>+
|
2005-12-08 12:14:33 +00:00
|
|
|
|
|
|
|
Names each database server machine running an Authentication Server with
|
|
|
|
which the local Authentication Server is to synchronize its copy of the
|
2005-12-13 19:21:13 +00:00
|
|
|
Authentication Database, rather than with the machines listed in the local
|
|
|
|
F</usr/afs/etc/CellServDB> file.
|
2005-12-08 12:14:33 +00:00
|
|
|
|
2005-12-13 19:21:13 +00:00
|
|
|
=item B<-enable_peer_stats>
|
2005-12-08 12:14:33 +00:00
|
|
|
|
|
|
|
Activates the collection of Rx statistics and allocates memory for their
|
2005-12-13 19:21:13 +00:00
|
|
|
storage. For each connection with a specific UDP port on another machine,
|
|
|
|
a separate record is kept for each type of RPC (FetchFile, GetStatus, and
|
|
|
|
so on) sent or received. To display or otherwise access the records, use
|
|
|
|
the Rx Monitoring API.
|
2005-12-08 12:14:33 +00:00
|
|
|
|
2005-12-13 19:21:13 +00:00
|
|
|
=item B<-enable_process_stats>
|
2005-12-08 12:14:33 +00:00
|
|
|
|
|
|
|
Activates the collection of Rx statistics and allocates memory for their
|
|
|
|
storage. A separate record is kept for each type of RPC (FetchFile,
|
|
|
|
GetStatus, and so on) sent or received, aggregated over all connections to
|
|
|
|
other machines. To display or otherwise access the records, use the Rx
|
|
|
|
Monitoring API.
|
|
|
|
|
2013-06-14 22:15:03 +01:00
|
|
|
=item B<-rxbind>
|
|
|
|
|
|
|
|
Bind the Rx socket to the primary interface only. (If not specified, the Rx
|
|
|
|
socket will listen on all interfaces.)
|
|
|
|
|
|
|
|
=item B<-crossrealm>
|
|
|
|
|
|
|
|
Enable cross-realm authentication. The use of this option is considered
|
|
|
|
insecure, and thus strongly discouraged. See OPENAFS-SA-2003-001.
|
|
|
|
|
2005-12-13 19:21:13 +00:00
|
|
|
=item B<-help>
|
2005-12-08 12:14:33 +00:00
|
|
|
|
2005-12-13 19:21:13 +00:00
|
|
|
Prints the online help for this command. All other valid options are
|
|
|
|
ignored.
|
2005-12-08 12:14:33 +00:00
|
|
|
|
|
|
|
=back
|
|
|
|
|
|
|
|
=head1 EXAMPLES
|
|
|
|
|
2005-12-13 19:21:13 +00:00
|
|
|
The following B<bos create> command creates a C<kaserver> process on
|
doc: replace hostnames with IETF example hostnames
There were several different real and made-up hostnames and company names used
throughout our documentation examples.
The IETF has reserved "example.com" and other "example" TLDs for use in
examples (RFC 2606). Replace almost all references to ABC Corporation, DEF
Corporation, and State University, as well as "abc.com", "bigcell.com",
"def.com", "def.gov", "ghi.com", "ghi.gov", "jkl.com", "mit.edu",
"stanford.edu", "state.edu", "stateu.edu", "uncc.edu", and "xyz.com".
Standardize on "Example Corporation", "Example Network", "Example
Organization" (example.com, example.net, and example.org).
The Scout documentation in the Admin Guide contains PNG images that contain
the old cell names, so I left those references until the images can be
replaced.
Change-Id: I4e44815b2d2ffe204810b7fd850842248f67c367
Reviewed-on: http://gerrit.openafs.org/6697
Reviewed-by: Jeffrey Altman <jaltman@secure-endpoints.com>
Tested-by: Jeffrey Altman <jaltman@secure-endpoints.com>
2012-02-11 16:43:30 +00:00
|
|
|
C<fs3.example.com> (the command appears on two lines here only for
|
2005-12-13 19:21:13 +00:00
|
|
|
legibility):
|
2005-12-08 12:14:33 +00:00
|
|
|
|
doc: replace hostnames with IETF example hostnames
There were several different real and made-up hostnames and company names used
throughout our documentation examples.
The IETF has reserved "example.com" and other "example" TLDs for use in
examples (RFC 2606). Replace almost all references to ABC Corporation, DEF
Corporation, and State University, as well as "abc.com", "bigcell.com",
"def.com", "def.gov", "ghi.com", "ghi.gov", "jkl.com", "mit.edu",
"stanford.edu", "state.edu", "stateu.edu", "uncc.edu", and "xyz.com".
Standardize on "Example Corporation", "Example Network", "Example
Organization" (example.com, example.net, and example.org).
The Scout documentation in the Admin Guide contains PNG images that contain
the old cell names, so I left those references until the images can be
replaced.
Change-Id: I4e44815b2d2ffe204810b7fd850842248f67c367
Reviewed-on: http://gerrit.openafs.org/6697
Reviewed-by: Jeffrey Altman <jaltman@secure-endpoints.com>
Tested-by: Jeffrey Altman <jaltman@secure-endpoints.com>
2012-02-11 16:43:30 +00:00
|
|
|
% bos create -server fs3.example.com -instance kaserver \
|
2005-12-08 12:14:33 +00:00
|
|
|
-type simple -cmd /usr/afs/bin/kaserver
|
|
|
|
|
|
|
|
=head1 PRIVILEGE REQUIRED
|
|
|
|
|
2005-12-13 19:21:13 +00:00
|
|
|
The issuer must be logged in as the superuser C<root> on a file server
|
|
|
|
machine to issue the command at a command shell prompt. It is conventional
|
|
|
|
instead to create and start the process by issuing the B<bos create>
|
|
|
|
command.
|
2005-12-08 12:14:33 +00:00
|
|
|
|
|
|
|
=head1 SEE ALSO
|
|
|
|
|
2005-12-13 19:21:13 +00:00
|
|
|
L<AuthLog(5)>,
|
|
|
|
L<BosConfig(5)>,
|
|
|
|
L<CellServDB(5)>,
|
|
|
|
L<kaserver.DB0(5)>,
|
|
|
|
L<kaserverauxdb(5)>,
|
|
|
|
L<bos(8)>,
|
|
|
|
L<bos_create(8)>,
|
|
|
|
L<bos_getlog(8)>,
|
|
|
|
L<kas(8)>,
|
|
|
|
L<kdb(8)>
|
2005-12-08 12:14:33 +00:00
|
|
|
|
|
|
|
=head1 COPYRIGHT
|
|
|
|
|
|
|
|
IBM Corporation 2000. <http://www.ibm.com/> All Rights Reserved.
|
|
|
|
|
|
|
|
This documentation is covered by the IBM Public License Version 1.0. It was
|
|
|
|
converted from HTML to POD by software written by Chas Williams and Russ
|
|
|
|
Allbery, based on work by Alf Wachsmann and Elizabeth Cassell.
|