2005-12-08 12:14:33 +00:00
|
|
|
=head1 NAME
|
|
|
|
|
|
|
|
KeyFile - Defines AFS server encryption keys
|
|
|
|
|
|
|
|
=head1 DESCRIPTION
|
|
|
|
|
2005-12-14 01:30:20 +00:00
|
|
|
The F<KeyFile> file defines the server encryption keys that the AFS server
|
|
|
|
processes running on the machine use to decrypt the tickets presented by
|
|
|
|
clients during the mutual authentication process. AFS server processes
|
|
|
|
perform privileged actions only for clients that possess a ticket
|
|
|
|
encrypted with one of the keys from the file. The file must reside in the
|
|
|
|
F</usr/afs/etc> directory on every server machine. For more detailed
|
|
|
|
information on mutual authentication and server encryption keys, see the
|
|
|
|
I<IBM AFS Administration Guide>.
|
2005-12-08 12:14:33 +00:00
|
|
|
|
|
|
|
Each key has a corresponding a key version number that distinguishes it
|
2005-12-14 01:30:20 +00:00
|
|
|
from the other keys. The tickets that clients present are also marked with
|
|
|
|
a key version number to tell the server process which key to use to
|
|
|
|
decrypt it. The F<KeyFile> file must always include a key with the same
|
|
|
|
key version number and contents as the key currently listed for the C<afs>
|
|
|
|
entry in the Authentication Database.
|
2005-12-08 12:14:33 +00:00
|
|
|
|
2005-12-14 01:30:20 +00:00
|
|
|
The F<KeyFile> file is in binary format, so always use the appropriate
|
|
|
|
commands from the B<bos> command suite to administer it:
|
2005-12-08 12:14:33 +00:00
|
|
|
|
|
|
|
=over 4
|
|
|
|
|
|
|
|
=item *
|
|
|
|
|
2005-12-14 01:30:20 +00:00
|
|
|
The B<bos addkey> command to define a new key.
|
2005-12-08 12:14:33 +00:00
|
|
|
|
|
|
|
=item *
|
|
|
|
|
2005-12-14 01:30:20 +00:00
|
|
|
The B<bos listkeys> command to display the keys.
|
2005-12-08 12:14:33 +00:00
|
|
|
|
|
|
|
=item *
|
|
|
|
|
2005-12-14 01:30:20 +00:00
|
|
|
The B<bos removekey> command to remove a key from the file.
|
2005-12-08 12:14:33 +00:00
|
|
|
|
|
|
|
=back
|
|
|
|
|
2005-12-14 01:30:20 +00:00
|
|
|
In cells that use the Update Server to distribute the contents of the
|
|
|
|
F</usr/afs/etc> directory, it is customary to edit only the copy of the
|
|
|
|
file stored on the system control machine. Otherwise, edit the file on
|
|
|
|
each server machine individually.
|
2005-12-08 12:14:33 +00:00
|
|
|
|
|
|
|
=head1 SEE ALSO
|
|
|
|
|
2005-12-14 01:30:20 +00:00
|
|
|
L<bos_addkey(8)>,
|
|
|
|
L<bos_listkeys(8)>,
|
|
|
|
L<bos_removekey(8)>,
|
|
|
|
L<kas_setpassword(8)>,
|
|
|
|
L<upclient(8)>,
|
|
|
|
L<upserver(8)>
|
2005-12-08 12:14:33 +00:00
|
|
|
|
|
|
|
I<IBM AFS Administration Guide>
|
|
|
|
|
|
|
|
=head1 COPYRIGHT
|
|
|
|
|
|
|
|
IBM Corporation 2000. <http://www.ibm.com/> All Rights Reserved.
|
|
|
|
|
|
|
|
This documentation is covered by the IBM Public License Version 1.0. It was
|
|
|
|
converted from HTML to POD by software written by Chas Williams and Russ
|
|
|
|
Allbery, based on work by Alf Wachsmann and Elizabeth Cassell.
|