mirror of
https://git.openafs.org/openafs.git
synced 2025-01-19 07:20:11 +00:00
86 lines
2.7 KiB
Plaintext
86 lines
2.7 KiB
Plaintext
|
=head1 NAME
|
||
|
|
|
||
|
|
ka-forwarder - Forward AFS Authentication Server requests to another server
|
||
|
|
|
||
|
|
=head1 SYNOPSIS
|
||
|
|
|
||
|
|
=for html
|
||
|
|
<div class="synopsis">
|
||
|
|
|
||
|
|
B<ka-forwarder> S<<< [B<-p> <I<port>>] >>> <I<server>>[/<I<port>>] [...]
|
||
|
|
|
||
|
|
=for html
|
||
|
|
</div>
|
||
|
|
|
||
|
|
=head1 DESCRIPTION
|
||
|
|
|
||
|
|
B<ka-forwarder> listens for requests for an AFS Authentication Server and
|
||
|
|
forwards them to a remove B<fakeka> server. B<fakeka> is a server that
|
||
|
|
answers AFS Authentication Server protocol requests using a regular
|
||
|
|
Kerberos KDC and is provided with some Kerberos 5 implementations.
|
||
|
|
B<fakeka> has to run on the same host as the Kerberos KDC, however, and
|
||
|
|
AFS clients send all native AFS authentication requests to the AFS
|
||
|
|
database servers. If you don't want to run your Kerberos KDCs and your
|
||
|
|
AFS database servers on the same host, run B<ka-forwarder> on the AFS
|
||
|
|
database servers and point it to B<fakeka> running on the Kerberos KDCs.
|
||
|
|
|
||
|
|
B<ka-forwarder> takes one or more servers to which to forward the
|
||
|
|
requests. The default port on the remote server to which to forward the
|
||
|
|
command is 7004, but a different port can be specified by following the
|
||
|
|
server name with a slash (C</>) and the port number. If multiple servers
|
||
|
|
are given, B<ka-forwarder> will send queries to each server in turn in a
|
||
|
|
round-robin fashion.
|
||
|
|
|
||
|
|
=head1 CAUTIONS
|
||
|
|
|
||
|
|
Due to the way that B<ka-forwarder> distinguishes from client requests and
|
||
|
|
server responses, any messages from one of the servers to which
|
||
|
|
B<ka-forwarder> is forwarding will be considered a reply rather than a
|
||
|
|
command and will not be forwarded. This means that the servers running
|
||
|
|
B<fakeka> will not be able to use native AFS authentication requests and
|
||
|
|
rely on B<ka-forwarder> to send the requests to the right server.
|
||
|
|
|
||
|
|
B<ka-forwarder> does not background itself. It should either be run in
|
||
|
|
the background via the shell, or run via the Basic OverSeer Server (see
|
||
|
|
L<bosserver(8)>).
|
||
|
|
|
||
|
|
=head1 OPTIONS
|
||
|
|
|
||
|
|
=over 4
|
||
|
|
|
||
|
|
=item B<-p> <I<port>>
|
||
|
|
|
||
|
|
By default, B<ka-forwarder> listens to the standard AFS Authentication
|
||
|
|
Server port (7004). To listen to a different port, specify it with the
|
||
|
|
B<-p> option.
|
||
|
|
|
||
|
|
=back
|
||
|
|
|
||
|
|
=head1 EXAMPLES
|
||
|
|
|
||
|
|
Forward AFS Authentication Server reqests to the B<fakeka> servers on
|
||
|
|
kdc1.example.com and kdc2.example.com:
|
||
|
|
|
||
|
|
% ka-forwarder kdc1.example.com kdc2.example.com &
|
||
|
|
|
||
|
|
Note the C<&> to tell the shell to run this command in the background.
|
||
|
|
|
||
|
|
=head1 PRIVILEGE REQUIRED
|
||
|
|
|
||
|
|
B<ka-forwarder> only has to listen to port 7004 and therefore does not
|
||
|
|
require any special privileges unless a privileged port is specified with
|
||
|
|
the B<-p> option.
|
||
|
|
|
||
|
|
=head1 SEE ALSO
|
||
|
|
|
||
|
|
L<bosserver(8)>,
|
||
|
|
fakeka(8),
|
||
|
|
L<kaserver(8)>
|
||
|
|
|
||
|
|
=head1 COPYRIGHT
|
||
|
|
|
||
|
|
Copyright 2006 Russ Allbery <rra@stanford.edu>
|
||
|
|
|
||
|
|
This documentation is covered by the IBM Public License Version 1.0. This
|
||
|
|
man page was written by Russ Allbery for OpenAFS.
|