Administration Reference

kaserver

Purpose

Initializes the Authentication Server

Description

kaserver [-noAuth]  [-fastKeys]  [-database <dbpath>] 
         [-localfiles <lclpath>]  [-minhours <n>] 
         [-servers <serverlist>]  [-enable_peer_stats]  
         [-enable_process_stats]  [-help]

This command does not use the syntax conventions of the AFS command suites. Provide the command name and all option names in full.

Description

The kaserver command initializes the Authentication Server, which runs on every database server machine. In the conventional configuration, its binary file is located in the /usr/afs/bin directory on a file server machine.

The kaserver command is not normally issued at the command shell prompt but rather placed into a file server machine's /usr/afs/local/BosConfig file with the bos create command. If it is ever issued at the command shell prompt, the issuer must be logged onto a database server machine as the local superuser root.

As it initializes, the Authentication Server process creates the two files that constitute the Authentication Database, kaserver.DB0 and kaserver.DBSYS1, in the /usr/afs/db directory if they do not already exist. Use the commands in the kas suite to administer the database.

The Authentication Server is responsible for several aspects of AFS security, including:

Maintenance of all AFS server encryption keys and user passwords in the Authentication Database.
Creation of the tickets and tokens that users and servers use to establish secure connections. Its Ticket Granting Service (TGS) component performs this function.

The Authentication Server records a trace of its activity in the /usr/afs/logs/AuthLog file. Use the bos getlog command to display the contents of the file. Use the kdb command to read the protected files associated with the AuthLog file, AuthLog.dir and AuthLog.pag.

Options

-noAuth

Assigns the unprivileged identity anonymous to the issuer. Thus, it establishes an unauthenticated connection between the issuer and the Authentication Server. It is useful only when authorization checking is disabled on the database server machine. In normal circumstances, the Authentication Server allows only authorized (privileged) users to issue commands that affect or contact the Authentication Database and will refuse to perform such an action even if the -noAuth flag is used.

-fastKeys

Is a test flag for use by the AFS Development staff; it serves no functional purpose.

-database

Specifies the pathname of an alternate directory in which the Authentication Database files reside. Provide the complete pathname, ending in the base filename to which the .DB0 and .DBSYS1 extensions are appended. For example, the appropriate value for the default database files is /usr/afs/db/kaserver.

Provide the -localfiles argument along with this one; otherwise, the -localfiles argument is also set to the value of this argument, which is probably inappropriate.

-localfiles

Specifies the pathname of an alternate directory in which the auxiliary Authentication Database file resides. Provide the complete pathname, ending in the base filename to which the auxdb suffix is appended. For example, the appropriate value for the default auxiliary database file is /usr/afs/local/kaserver.

-minhours

Specifies the minimum number of hours that must pass between password changes made by any regular user. System administrators (with the ADMIN flag in their Authentication Database entry) can change passwords as often as desired. Setting a minimum time between password changes is not recommended.

-servers

Names each database server machine running an Authentication Server with which the local Authentication Server is to synchronize its copy of the Authentication Database , rather than with the machines listed in the local /usr/afs/etc/CellServDB file.

-enable_peer_stats

Activates the collection of Rx statistics and allocates memory for their storage. For each connection with a specific UDP port on another machine, a separate record is kept for each type of RPC (FetchFile, GetStatus, and so on) sent or received. To display or otherwise access the records, use the Rx Monitoring API.

-enable_process_stats

Activates the collection of Rx statistics and allocates memory for their storage. A separate record is kept for each type of RPC (FetchFile, GetStatus, and so on) sent or received, aggregated over all connections to other machines. To display or otherwise access the records, use the Rx Monitoring API.

-help

Prints the online help for this command. All other valid options are ignored.

Examples

The following bos create command creates a kaserver process on fs3.abc.com (the command appears on two lines here only for legibility):

   % bos create -server fs3.abc.com -instance kaserver \
                -type simple -cmd /usr/afs/bin/kaserver

Privilege Required

The issuer must be logged in as the superuser root on a file server machine to issue the command at a command shell prompt. It is conventional instead to create and start the process by issuing the bos create command.

Related Information

AuthLog

BosConfig

CellServDB (server version)

kaserver.DB0 and kaserver.DBSYS1