mirror of
https://git.openafs.org/openafs.git
synced 2025-01-18 23:10:58 +00:00
ed52ea68c6
Document the built-in version sub-command which displays the OpenAFS version string. This sub-command is provided by the cmd library. Document the switch style -version option provided by the cmd library for the initcmd based commands: afsmonitor, scout, xstat_fs_test, and xstat_cm_test. Change-Id: Id421d2c68a5c49a2b1a5abb2f3e9ca64ea36cd3e Reviewed-on: http://gerrit.openafs.org/11161 Reviewed-by: Benjamin Kaduk <kaduk@mit.edu> Tested-by: BuildBot <buildbot@rampaginggeek.com>
232 lines
7.9 KiB
Plaintext
232 lines
7.9 KiB
Plaintext
=head1 NAME
|
|
|
|
kas - Introduction to the kas command suite
|
|
|
|
=head1 DESCRIPTION
|
|
|
|
The commands in the B<kas> command suite are the administrative interface
|
|
to the Authentication Server, an obsolete AFS server process that
|
|
maintains the Authentication Database and provides the authentication
|
|
tickets that client applications must present to AFS servers in order to
|
|
obtain access to AFS data and other services. It is used only for cells
|
|
still running the Authentication Server until they can migrate to a
|
|
Kerberos version 5 KDC.
|
|
|
|
There are several categories of commands in the B<kas> command suite:
|
|
|
|
=over 4
|
|
|
|
=item *
|
|
|
|
Commands to create, modify, examine and delete entries in the
|
|
Authentication Database, including passwords:
|
|
L<B<kas create>|kas_create(8)>,
|
|
L<B<kas delete>|kas_delete(8)>,
|
|
L<B<kas examine>|kas_examine(8)>,
|
|
L<B<kas list>|kas_list(8)>,
|
|
L<B<kas setfields>|kas_setfields(8)>,
|
|
L<B<kas setkey>|kas_setkey(8)>,
|
|
L<B<kas setpassword>|kas_setpassword(8)>,
|
|
and L<B<kas unlock>|kas_unlock(8)>.
|
|
|
|
=item *
|
|
|
|
Commands to create, delete, and examine tokens and server tickets:
|
|
L<B<kas forgetticket>|kas_forgetticket(8)>,
|
|
L<B<kas listtickets>|kas_listtickets(8)>,
|
|
L<B<kas noauthentication>|kas_noauthentication(8)>,
|
|
and L<B<kas stringtokey>|kas_stringtokey(8)>.
|
|
|
|
=item *
|
|
|
|
A command to enter interactive mode:
|
|
L<B<kas interactive>|kas_interactive(8)>.
|
|
|
|
=item *
|
|
|
|
A command to trace Authentication Server operations:
|
|
L<B<kas statistics>|kas_statistics(8)>.
|
|
|
|
=item *
|
|
|
|
Commands to obtain help:
|
|
L<B<kas apropos>|kas_apropos(8)>
|
|
and L<B<kas help>|kas_help(8)>.
|
|
|
|
=item *
|
|
|
|
A command to display the OpenAFS command suite version: B<kas version>.
|
|
|
|
=back
|
|
|
|
Because of the sensitivity of information in the Authentication Database,
|
|
the Authentication Server authenticates issuers of B<kas> commands
|
|
directly, rather than accepting the standard token generated by the Ticket
|
|
Granting Service. Any B<kas> command that requires administrative
|
|
privilege prompts the issuer for a password. The resulting ticket is valid
|
|
for six hours unless the maximum ticket lifetime for the issuer or the
|
|
Authentication Server's Ticket Granting Service is shorter.
|
|
|
|
To avoid having to provide a password repeatedly when issuing a sequence
|
|
of B<kas> commands, enter I<interactive mode> by issuing the B<kas
|
|
interactive> command, typing B<kas> without any operation code, or typing
|
|
B<kas> followed by a user and cell name, separated by an at-sign (C<@>; an
|
|
example is C<kas smith.admin@example.com>). After prompting once for a
|
|
password, the Authentication Server accepts the resulting token for every
|
|
command issued during the interactive session. See L<kas_interactive(8)>
|
|
for a discussion of when to use each method for entering interactive mode
|
|
and of the effects of entering a session.
|
|
|
|
The Authentication Server maintains two databases on the local disk of the
|
|
machine where it runs:
|
|
|
|
=over 4
|
|
|
|
=item *
|
|
|
|
The Authentication Database (F</usr/afs/db/kaserver.DB0>) stores the
|
|
information used to provide AFS authentication services to users and
|
|
servers, including the password scrambled as an encryption key. The
|
|
reference page for the B<kas examine> command describes the information in
|
|
a database entry.
|
|
|
|
=item *
|
|
|
|
An auxiliary file (F</usr/afs/local/kaauxdb> by default) that tracks how
|
|
often the user has provided an incorrect password to the local
|
|
Authentication Server. The reference page for the B<kas setfields> command
|
|
describes how the Authentication Server uses this file to enforce the
|
|
limit on consecutive authentication failures. To designate an alternate
|
|
directory for the file, use the B<kaserver> command's B<-localfiles>
|
|
argument.
|
|
|
|
=back
|
|
|
|
=head1 CAUTIONS
|
|
|
|
The B<kas> command suite is provided only for administration of the
|
|
obsolete Authentication Server for cells that have not yet migrated to a
|
|
Kerberos version 5 KDC. New deployments should not use the Authentication
|
|
Server, and it and the B<kas> command suite will be removed in a future
|
|
version of OpenAFS.
|
|
|
|
=head1 OPTIONS
|
|
|
|
The following arguments and flags are available on many commands in the
|
|
B<kas> suite. (Some of them are unavailable on commands entered in
|
|
interactive mode, because the information they specify is established when
|
|
entering interactive mode and cannot be changed except by leaving
|
|
interactive mode.) The reference page for each command also lists them,
|
|
but they are described here in greater detail.
|
|
|
|
=over 4
|
|
|
|
=item B<-admin_username> <I<user name>>
|
|
|
|
Specifies the user identity under which to authenticate with the
|
|
Authentication Server for execution of the command. If this argument is
|
|
omitted, the B<kas> command interpreter requests authentication for the
|
|
identity under which the issuer is logged onto the local machine. Do not
|
|
combine this argument with the B<-noauth> flag.
|
|
|
|
=item B<-cell> <I<cell name>>
|
|
|
|
Names the cell in which to run the command. It is acceptable to abbreviate
|
|
the cell name to the shortest form that distinguishes it from the other
|
|
entries in the F</usr/vice/etc/CellServDB> file on the local machine. If
|
|
the B<-cell> argument is omitted, the command interpreter determines the
|
|
name of the local cell by reading the following in order:
|
|
|
|
=over 4
|
|
|
|
=item *
|
|
|
|
The value of the AFSCELL environment variable.
|
|
|
|
=item *
|
|
|
|
The local F</usr/vice/etc/ThisCell> file.
|
|
|
|
=back
|
|
|
|
The B<-cell> argument is not available on commands issued in interactive
|
|
mode. The cell defined when the B<kas> command interpreter enters
|
|
interactive mode applies to all commands issued during the interactive
|
|
session.
|
|
|
|
=item B<-help>
|
|
|
|
Prints a command's online help message on the standard output stream. Do
|
|
not combine this flag with any of the command's other options; when it is
|
|
provided, the command interpreter ignores all other options, and only
|
|
prints the help message.
|
|
|
|
=item B<-noauth>
|
|
|
|
Establishes an unauthenticated connection to the Authentication Server, in
|
|
which the Authentication Server treats the issuer as the unprivileged user
|
|
C<anonymous>. It is useful only when authorization checking is disabled on
|
|
the server machine (during the installation of a server machine or when
|
|
the B<bos setauth> command has been used during other unusual
|
|
circumstances). In normal circumstances, the Authentication Server allows
|
|
only privileged users to issue most B<kas> commands, and refuses to
|
|
perform such an action even if the B<-noauth> flag is provided. Do not
|
|
combine this flag with the B<-admin_username> and B<-password_for_admin>
|
|
arguments.
|
|
|
|
=item B<-password_for_admin> <I<password>>
|
|
|
|
Specifies the password of the command's issuer. It is best to omit this
|
|
argument, which echoes the password visibly in the command shell, instead
|
|
enter the password at the prompt. Do not combine this argument with the
|
|
B<-noauth> flag.
|
|
|
|
=item B<-servers> <I<machine name>>+
|
|
|
|
Establishes a connection with the Authentication Server running on each
|
|
specified database server machine, instead of on each machine listed in
|
|
the local F</usr/vice/etc/CellServDB> file. In either case, the B<kas>
|
|
command interpreter then chooses one of the machines at random to contact
|
|
for execution of each subsequent command. The issuer can abbreviate the
|
|
machine name to the shortest form that allows the local name service to
|
|
identify it uniquely.
|
|
|
|
=back
|
|
|
|
=head1 PRIVILEGE REQUIRED
|
|
|
|
To issue most kas commands, the issuer must have the C<ADMIN> flag set in
|
|
his or her Authentication Database entry (use the B<kas setfields> command
|
|
to turn the flag on).
|
|
|
|
=head1 SEE ALSO
|
|
|
|
L<CellServDB(5)>,
|
|
L<kaserver.DB0(5)>,
|
|
L<kaserverauxdb(5)>,
|
|
L<kas_apropos(8)>,
|
|
L<kas_create(8)>,
|
|
L<kas_delete(8)>,
|
|
L<kas_examine(8)>,
|
|
L<kas_forgetticket(8)>,
|
|
L<kas_help(8)>,
|
|
L<kas_interactive(8)>,
|
|
L<kas_list(8)>,
|
|
L<kas_listtickets(8)>,
|
|
L<kas_noauthentication(8)>,
|
|
L<kas_quit(8)>,
|
|
L<kas_setfields(8)>,
|
|
L<kas_setpassword(8)>,
|
|
L<kas_statistics(8)>,
|
|
L<kas_stringtokey(8)>,
|
|
L<kas_unlock(8)>,
|
|
L<kaserver(8)>
|
|
|
|
=head1 COPYRIGHT
|
|
|
|
IBM Corporation 2000. <http://www.ibm.com/> All Rights Reserved.
|
|
|
|
This documentation is covered by the IBM Public License Version 1.0. It was
|
|
converted from HTML to POD by software written by Chas Williams and Russ
|
|
Allbery, based on work by Alf Wachsmann and Elizabeth Cassell.
|