jimzah/openafs
1
0
Fork 0
mirror of https://git.openafs.org/openafs.git synced 2025-01-18 23:10:58 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Update the asetkey man page for rxkad-k5

Browse Source 
Also add the usage for the six-argument form while here.

Update some generic text to account for the existence of rxkad-k5,
and mention that the Update Server is not the only thing which can copy
around KeyFiles.  Give an example of the seven-argument form's usage for
rxkad-k5.

(cherry picked from commit 2a9a98f405)

Change-Id: I3156a4f27c4aa7a7db546dbd3d012eb7c39e37c5
This commit is contained in:
Ben Kaduk 2013-07-12 12:43:57 -04:00 committed by Simon Wilkinson
parent 1cd7e3cff5
commit 8f86bfeb54
1 changed files with 36 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

45
doc/man-pages/pod8/asetkey.pod
View File

@ -11,6 +11,10 @@ B<asetkey> add <I<kvno>> <I<keyfile>> <I<principal>>
B<asetkey> add <I<kvno>> <I<key>> B<asetkey> add <I<kvno>> <I<key>>
B<asetkey> add <I<type>> <I<kvno>> <I<subtype>> <I<key>>
B<asetkey> add <I<type>> <I<kvno>> <I<subtype>> <I<keyfile>> <I<princ>>
B<asetkey> delete <I<kvno>> B<asetkey> delete <I<kvno>>
B<asetkey> list B<asetkey> list
@ -20,8 +24,8 @@ B<asetkey> list
=head1 DESCRIPTION =head1 DESCRIPTION
The B<asetkey> command is used to add a key to an AFS KeyFile from a The B<asetkey> command is used to add a key to an AFS KeyFile or KeyFileExt
Kerberos keytab. It is similar to B<bos addkey> except that it must be from a Kerberos keytab. It is similar to B<bos addkey> except that it must be
run locally on the system where the KeyFile is located and it takes the run locally on the system where the KeyFile is located and it takes the
new key from the command line or a Kerberos 5 keytab rather than prompting new key from the command line or a Kerberos 5 keytab rather than prompting
for the password. for the password.
@ -51,8 +55,9 @@ KeyFile to all other systems.
=head1 CAUTIONS =head1 CAUTIONS
AFS currently only supports des-cbc-crc:v4 Kerberos keys. Make sure, when Historically, AFS only supported des-cbc-crc:v4 Kerberos keys. In environments
creating the keytab with C<ktadd>, you pass C<-e des-cbc-crc:v4> to force which have not been upgraded to use the rxkad-k5 extension, when
creating the keytab with C<ktadd>, you must pass C<-e des-cbc-crc:v4> to force
the encryption type. Otherwise, AFS authentication may not work. the encryption type. Otherwise, AFS authentication may not work.
As soon as a new keytab is created with C<ktadd>, new AFS service tickets As soon as a new keytab is created with C<ktadd>, new AFS service tickets
@ -65,14 +70,36 @@ work properly.
All of the KeyFile entries must match the key in the Kerberos KDC, but All of the KeyFile entries must match the key in the Kerberos KDC, but
each time C<ktadd> is run, it creates a new key. Either the Update Server each time C<ktadd> is run, it creates a new key. Either the Update Server
must be used to distribute the KeyFile to all servers or the same keytab or some other mechanism must be used to distribute the KeyFile to all servers,
must be used with B<asetkey> on each server. or the same keytab must be used with B<asetkey> on each server.
=head1 EXAMPLES =head1 EXAMPLES
The following commands create a new keytab for the principal C<afs> and In a cell which is using the rxkad-k5 extension, the following commands
then import the key into the KeyFile. Note the kvno in the output from create a new keytab for the principal C<afs/I<cell name>> and then import
C<ktadd>. its keys into the KeyFileExt. Note the kvno in the output from C<ktadd>.
The values 18, 17, and 16 are the assigned numbers corresponding to the
kerberos enctypes in the keytab. These numbers can be determined from your
system's krb5 headers.
% kadmin
Authenticating as principal kaduk/admin@ZONE.MIT.EDU with password.
Password for kaduk/admin@ZONE.MIT.EDU:
kadmin: ktadd -k /tmp/afs.keytab afs/disarray.mit.edu
Entry for principal afs/disarray.mit.edu with kvno 4, encryption type
aes256-cts-hmac-sha1-96 added to keytab WRFILE:/tmp/afs.keytab.
Entry for principal afs/disarray.mit.edu with kvno 4, encryption type
aes128-cts-hmac-sha1-96 added to keytab WRFILE:/tmp/afs.keytab.
Entry for principal afs/disarray.mit.edu with kvno 4, encryption type
des3-cbc-sha1 added to keytab WRFILE:/tmp/afs.keytab.
kadmin: exit
% asetkey add rxkad_krb5 4 18 /tmp/afs.keytab afs/disarray.mit.edu
% asetkey add rxkad_krb5 4 17 /tmp/afs.keytab afs/disarray.mit.edu
% asetkey add rxkad_krb5 4 16 /tmp/afs.keytab afs/disarray.mit.edu
In a cell which is <B<not>> using the rxkad-k5 extension, the following
commands create a new keytab for the principal C<afs> and then import the
key into the KeyFile. Note the kvno in the output from C<ktadd>.
% kadmin % kadmin
Authenticating as principal rra/admin@stanford.edu with password. Authenticating as principal rra/admin@stanford.edu with password.