mirror of
https://git.openafs.org/openafs.git
synced 2025-01-22 17:00:15 +00:00
308 lines
17 KiB
HTML
308 lines
17 KiB
HTML
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 4//EN">
|
|
<HTML><HEAD>
|
|
<TITLE>Administration Reference</TITLE>
|
|
<!-- Begin Header Records ========================================== -->
|
|
<!-- /tmp/idwt3672/auarf000.scr converted by idb2h R4.2 (359) ID -->
|
|
<!-- Workbench Version (AIX) on 3 Oct 2000 at 16:18:30 -->
|
|
<META HTTP-EQUIV="updated" CONTENT="Tue, 03 Oct 2000 16:18:29">
|
|
<META HTTP-EQUIV="review" CONTENT="Wed, 03 Oct 2001 16:18:29">
|
|
<META HTTP-EQUIV="expires" CONTENT="Thu, 03 Oct 2002 16:18:29">
|
|
</HEAD><BODY>
|
|
<!-- (C) IBM Corporation 2000. All Rights Reserved -->
|
|
<BODY bgcolor="ffffff">
|
|
<!-- End Header Records ============================================ -->
|
|
<A NAME="Top_Of_Page"></A>
|
|
<H1>Administration Reference</H1>
|
|
<HR><P ALIGN="center"> <A HREF="../index.htm"><IMG SRC="../books.gif" BORDER="0" ALT="[Return to Library]"></A> <A HREF="auarf002.htm#ToC"><IMG SRC="../toc.gif" BORDER="0" ALT="[Contents]"></A> <A HREF="auarf199.htm"><IMG SRC="../prev.gif" BORDER="0" ALT="[Previous Topic]"></A> <A HREF="#Bot_Of_Page"><IMG SRC="../bot.gif" BORDER="0" ALT="[Bottom of Topic]"></A> <A HREF="auarf201.htm"><IMG SRC="../next.gif" BORDER="0" ALT="[Next Topic]"></A> <A HREF="auarf284.htm#HDRINDEX"><IMG SRC="../index.gif" BORDER="0" ALT="[Index]"></A> <P>
|
|
<P>
|
|
<H2><A NAME="HDRKLOG" HREF="auarf002.htm#ToC_214">klog</A></H2>
|
|
<A NAME="IDX5176"></A>
|
|
<A NAME="IDX5177"></A>
|
|
<A NAME="IDX5178"></A>
|
|
<A NAME="IDX5179"></A>
|
|
<A NAME="IDX5180"></A>
|
|
<A NAME="IDX5181"></A>
|
|
<A NAME="IDX5182"></A>
|
|
<P><STRONG>Purpose</STRONG>
|
|
<P>Authenticates with the Authentication Server
|
|
<P><STRONG>Synopsis</STRONG>
|
|
<PRE><B>klog</B> [<B>-x</B>] [<B>-principal</B> <<VAR>user name</VAR>>] [<B>-password</B> <<VAR>user's password</VAR>>]
|
|
[<B>-cell</B> <<VAR>cell name</VAR>>] [<B>-servers</B> <<VAR>explicit list of servers</VAR>><SUP>+</SUP>]
|
|
[<B>-pipe</B>] [<B>-silent</B>] [<B>-lifetime</B> <<VAR>ticket lifetime in hh[:mm[:ss]]</VAR>>]
|
|
[<B>-setpag</B>] [<B>-tmp</B>] [<B>-help</B>]
|
|
|
|
<B>klog</B> [<B>-x</B>] [<B>-pr</B> <<VAR>user name</VAR>>] [<B>-pa</B> <<VAR>user's password</VAR>>] [<B>-c</B> <<VAR>cell name</VAR>>]
|
|
[<B>-s</B> <<VAR>explicit list of servers</VAR>><SUP>+</SUP>] [<B>-pi</B>] [<B>-si</B>]
|
|
[<B>-l</B> <<VAR>ticket lifetime in hh[:mm[:ss]]</VAR>>] [<B>-se</B>] [<B>-t</B>] [<B>-h</B>]
|
|
</PRE>
|
|
<P><STRONG>Description</STRONG>
|
|
<P>The <B>klog</B> command obtains an AFS token from the Authentication
|
|
Server. The Cache Manager on the local machine stores the token in a
|
|
credential structure in kernel memory and uses it when obtaining authenticated
|
|
access to the AFS filespace. This command does not affect the
|
|
issuer's identity (UNIX UID) in the local file system.
|
|
<P>By default, the command interpreter obtains a token for the AFS user name
|
|
that matches the issuer's identity in the local file system. To
|
|
specify an alternate user, include the <B>-principal</B> argument.
|
|
The user named by the <B>-principal</B> argument does not have to appear
|
|
in the local password file (the <B>/etc/passwd</B> file or
|
|
equivalent).
|
|
<P>By default, the command interpreter obtains a token for the local cell, as
|
|
defined by the AFSCELL environment variable set in the command shell or by the
|
|
<B>/usr/vice/etc/ThisCell</B> file on the local machine. To specify
|
|
an alternate cell, include the <B>-cell</B> argument. The command
|
|
interpreter contacts an Authentication Server chosen at random from the
|
|
cell's entry in the local <B>/usr/afs/etc/CellServDB</B> file, unless
|
|
the <B>-servers</B> argument is used to name one or more database server
|
|
machines.
|
|
<P>A user can have tokens in multiple cells simultaneously, but only one token
|
|
per cell per connection to the client machine. If the user's
|
|
credential structure already contains a token for the requested cell, the
|
|
token resulting from this command replaces it.
|
|
<P>Sites that employ standard Kerberos authentication instead of the AFS
|
|
Authentication Server must use the Kerberos version of this command,
|
|
<B>klog.krb</B>, on all client machines. It automatically
|
|
places the issuer's Kerberos tickets in the file named by the KRBTKFILE
|
|
environment variable, which the <B>pagsh.krb</B> command defines
|
|
automatically as <B>/tmp/tktp</B><I>X</I> where <I>X</I> is the
|
|
number of the user's PAG.
|
|
<P>The lifetime of the token resulting from this command is the smallest of
|
|
the following.
|
|
<UL>
|
|
<P><LI>The lifetime specified by the issuer with the <B>-lifetime</B>
|
|
argument. If the issuer does not include this argument, the value
|
|
defaults to 720 hours (30 days).
|
|
<P><LI>The maximum ticket lifetime recorded for the <B>afs</B> entry in the
|
|
Authentication Database. The default is 100 hours.
|
|
<P><LI>The maximum ticket lifetime recorded in the specified user's
|
|
Authentication Database entry. The default is 25 hours for user entries
|
|
created by an Authentication Server running AFS 3.1 or later.
|
|
<P><LI>The maximum ticket lifetime recorded in the
|
|
<B>krbtgt.</B><VAR>CELLNAME</VAR> entry in the Authentication
|
|
Database; this entry corresponds to the ticket-granting ticket used
|
|
internally in generating the token. The default is 720 hours (30
|
|
days).
|
|
</UL>
|
|
<P>The output from the <B>kas examine</B> command displays an
|
|
Authentication Database entry's maximum ticket lifetime as <TT>Max
|
|
ticket lifetime</TT>. Administrators can display any entry, and users
|
|
can display their own entries.
|
|
<P>If none of the defaults have been changed, the token lifetime is 25 hours
|
|
for user accounts created by an Authentication Server running AFS 3.1
|
|
or higher. The maximum lifetime for any token is 720 hours (30 days),
|
|
and the minimum is 5 minutes.
|
|
<P>Between the minimum and maximum values, the Authentication Server uses a
|
|
defined set of values, according to the following rules. Requested
|
|
lifetimes between 5 minutes and 10 hours 40 minutes are granted at 5 minute
|
|
intervals, rounding up. For example, if the issuer requests a lifetime
|
|
of 12 minutes, the token's actual lifetime is 15 minutes.
|
|
<P>For token lifetimes greater than 10 hours 40 minutes, consult the following
|
|
table, which presents all the possible times in units of
|
|
<VAR>hours</VAR><B>:</B><VAR>minutes</VAR><B>:</B><VAR>seconds</VAR>.
|
|
The number in parentheses is an approximation of the corresponding time in
|
|
days and hours (as indicated by the <TT>d</TT> and <TT>h</TT>
|
|
letters). For example, <TT>282:22:17</TT> means 282
|
|
hours, 22 minutes, and 17 seconds, which translates to approximately 11 days
|
|
and 18 hours (<TT>11d 18h</TT>). The Authentication Server rounds up
|
|
a requested lifetime to the next highest possible lifetime.
|
|
<PRE> 11:24:15 (0d 11h) 46:26:01 (1d 22h) 189:03:38 (7d 21h)
|
|
12:11:34 (0d 12h) 49:38:40 (2d 01h) 202:08:00 (8d 10h)
|
|
13:02:09 (0d 13h) 53:04:37 (2d 05h) 216:06:35 (9d 00h)
|
|
13:56:14 (0d 13h) 56:44:49 (2d 08h) 231:03:09 (9d 15h)
|
|
14:54:03 (0d 14h) 60:40:15 (2d 12h) 247:01:43 (10d 07h)
|
|
15:55:52 (0d 15h) 64:51:57 (2d 16h) 264:06:34 (11d 00h)
|
|
17:01:58 (0d 17h) 69:21:04 (2d 21h) 282:22:17 (11d 18h)
|
|
18:12:38 (0d 18h) 74:08:46 (3d 02h) 301:53:45 (12d 13h)
|
|
19:28:11 (0d 19h) 79:16:23 (3d 07h) 322:46:13 (13d 10h)
|
|
20:48:57 (0d 20h) 84:45:16 (3d 12h) 345:05:18 (14d 09h)
|
|
22:15:19 (0d 22h) 90:36:53 (3d 18h) 368:56:58 (15d 08h)
|
|
23:47:38 (0d 23h) 96:52:49 (4d 00h) 394:27:37 (16d 10h)
|
|
25:26:21 (1d 01h) 103:34:45 (4d 07h) 421:44:07 (17d 13h)
|
|
27:11:54 (1d 03h) 110:44:28 (4d 14h) 450:53:46 (18d 18h)
|
|
29:04:44 (1d 05h) 118:23:54 (4d 22h) 482:04:24 (20d 02h)
|
|
31:05:22 (1d 07h) 126:35:05 (5d 06h) 515:24:22 (21d 11h)
|
|
33:14:21 (1d 09h) 135:20:15 (5d 15h) 551:02:38 (22d 23h)
|
|
35:32:15 (1d 11h) 144:41:44 (6d 00h) 589:08:45 (24d 13h)
|
|
37:59:41 (1d 13h) 154:42:01 (6d 10h) 629:52:56 (26d 05h)
|
|
40:37:19 (1d 16h) 165:23:50 (6d 21h) 673:26:07 (28d 01h)
|
|
43:25:50 (1d 19h) 176:50:01 (7d 08h)
|
|
|
|
</PRE>
|
|
<P><STRONG>Cautions</STRONG>
|
|
<P>By default, this command does not create a new process authentication group
|
|
(PAG); see the description of the <B>pagsh</B> command to learn about
|
|
PAGs. If a cell does not use an AFS-modified login utility, users must
|
|
include <B>-setpag</B> option to this command, or issue the
|
|
<B>pagsh</B> command before this one, to have their tokens stored in a
|
|
credential structure that is identified by PAG rather than by local
|
|
UID.
|
|
<P>When a credential structure is identified by local UID, the potential
|
|
security exposure is that the local superuser <B>root</B> can use the UNIX
|
|
<B>su</B> command to assume any other identity and automatically inherit
|
|
the tokens associated with that UID. Identifying the credential
|
|
structure by PAG eliminates this exposure.
|
|
<P>If the <B>-password</B> argument is used, the specified password cannot
|
|
begin with a hyphen, because it is interpreted as another option name.
|
|
Use of the <B>-password</B> argument is not recommended in any
|
|
case.
|
|
<P>By default, it is possible to issue this command on a properly configured
|
|
NFS client machine that is accessing AFS via the NFS/AFS Translator, assuming
|
|
that the NFS client machine is a supported system type. However, if the
|
|
translator machine's administrator has enabled UID checking by including
|
|
the <B>-uidcheck on</B> argument to the <B>fs exportafs</B> command,
|
|
the command fails with an error message similar to the following:
|
|
<PRE>
|
|
Warning: Remote pioctl to <VAR>translator_machine</VAR> has failed (err=8). . .
|
|
Unable to authenticate to AFS because a pioctl failed.
|
|
</PRE>
|
|
<P>Enabling UID checking means that the credential structure in which tokens
|
|
are stored on the translator machine must be identified by a UID that matches
|
|
the local UID of the process that is placing the tokens in the credential
|
|
structure. After the <B>klog</B> command interpreter obtains the
|
|
token on the NFS client, it passes it to the remote executor daemon on the
|
|
translator machine, which makes the system call that stores the token in a
|
|
credential structure on the translator machine. The remote executor
|
|
generally runs as the local superuser <B>root</B>, so in most cases its
|
|
local UID (normally zero) does not match the local UID of the user who issued
|
|
the <B>klog</B> command on the NFS client machine.
|
|
<P>Issuing the <B>klog</B> command on an NFS client machine creates a
|
|
security exposure: the command interpreter passes the token across the
|
|
network to the remote executor daemon in clear text mode.
|
|
<P><STRONG>Options</STRONG>
|
|
<DL>
|
|
<P><DT><B>-x
|
|
</B><DD>Appears only for backwards compatibility. Its former function is
|
|
now the default behavior of this command.
|
|
<P><DT><B>-principal
|
|
</B><DD>Specifies the user name to authenticate. If this argument is
|
|
omitted, the Authentication Server attempts to authenticate the user logged
|
|
into the local file system.
|
|
<P><DT><B>-password
|
|
</B><DD>Specifies the issuer's password (or that of the alternate user
|
|
identified by the <B>-principal</B> argument). Omit this argument
|
|
to have the command interpreter prompt for the password, in which case it does
|
|
not echo visibly in the command shell.
|
|
<P><DT><B>-cell
|
|
</B><DD>Specifies the cell for which to obtain a token. The command is
|
|
directed to that cell's Authentication Servers. During a single
|
|
login session on a given machine, a user can be authenticated in multiple
|
|
cells simultaneously, but can have only one token at a time for each of them
|
|
(that is, can only authenticate under one identity per cell per session on a
|
|
machine). It is acceptable to abbreviate the cell name to the shortest
|
|
form that distinguishes it from the other cells listed in the
|
|
<B>/usr/vice/etc/CellServDB</B> file on the client machine on which the
|
|
command is issued.
|
|
<P>If this argument is omitted, the command is executed in the local cell, as
|
|
defined
|
|
<UL>
|
|
<P><LI>First, by the value of the environment variable AFSCELL
|
|
<P><LI>Second, in the <B>/usr/vice/etc/ThisCell</B> file on the client
|
|
machine on which the command is issued
|
|
</UL>
|
|
<P><DT><B>-servers
|
|
</B><DD>Establishes a connection with the Authentication Server running on each
|
|
specified database server machine. The command interpreter then chooses
|
|
one of these at random to execute the command. It is best to provide
|
|
fully-qualified hostnames, but abbreviated forms are possibly acceptable
|
|
depending on the state of the cell's name server at the time the command
|
|
is issued. This option is useful for testing specific servers if
|
|
problems are encountered.
|
|
<P>If this argument is omitted, the command interpreter establishes a
|
|
connection with each machine listed for the indicated cell in the local copy
|
|
of the <B>/usr/vice/etc/CellServDB</B> file, and then chooses one of them
|
|
at random for command execution.
|
|
<P><DT><B>-pipe
|
|
</B><DD>Suppresses all output to the standard output stream, including prompts and
|
|
error messages. The <B>klog</B> command interpreter expects to
|
|
receive the password from the standard input stream. Do not use this
|
|
argument; it is designed for use by application programs rather than
|
|
human users.
|
|
<P><DT><B>-silent
|
|
</B><DD>Suppresses some of the trace messages that the <B>klog</B> command
|
|
produces on the standard output stream by default. It still reports on
|
|
major problems encountered.
|
|
<P><DT><B>-lifetime
|
|
</B><DD>Requests a specific lifetime for the token. Provide a number of
|
|
hours and optionally minutes and seconds in the format
|
|
<VAR>hh</VAR>[<B>:</B><VAR>mm</VAR>[<B>:</B><VAR>ss</VAR>]].
|
|
The value is used in calculating the token lifetime as described in the
|
|
<B>Description</B> section.
|
|
<P><DT><B>-setpag
|
|
</B><DD>Creates a process authentication group (PAG) prior to requesting
|
|
authentication. The token is associated with the newly created
|
|
PAG.
|
|
<P><DT><B>-tmp
|
|
</B><DD>Creates a Kerberos-style ticket file in the <B>/tmp</B> directory of
|
|
the local machine. The file is called
|
|
<B>tkt.</B><VAR>AFS_UID</VAR> where <VAR>AFS_UID</VAR> is the AFS UID
|
|
of the issuer.
|
|
<P><DT><B>-help
|
|
</B><DD>Prints the online help for this command. All other valid options
|
|
are ignored.
|
|
</DL>
|
|
<P><STRONG>Cautions</STRONG>
|
|
<P><STRONG>Output</STRONG>
|
|
<P>The following message indicates that the limit on consecutive
|
|
authentication failures has been exceeded. An administrator can use the
|
|
<B>kas unlock</B> command to unlock the account, or the issuer can wait
|
|
until the lockout time for the account has passed. (The time is set
|
|
with the <B>-locktime</B> argument to the <B>kas setfields</B> command
|
|
and displayed in the output from the <B>kas examine</B> command).
|
|
<PRE>
|
|
Unable to authenticate to AFS because ID is locked - see your system admin
|
|
|
|
</PRE>
|
|
<P>If the <B>-tmp</B> flag is included, the following message confirms
|
|
that a Kerberos-style ticket file was created:
|
|
<PRE>
|
|
Wrote ticket file to /tmp
|
|
|
|
</PRE>
|
|
<P><STRONG>Examples</STRONG>
|
|
<P>Most often, this command is issued without arguments. The
|
|
appropriate password is for the person currently logged into the local file
|
|
system. The ticket's lifetime is calculated as described in the
|
|
<B>Description</B> section (if no defaults have been changed, it is 25
|
|
hours for a user whose Authentication Database entry was created in AFS
|
|
3.1 or later).
|
|
<PRE>
|
|
% <B>klog</B>
|
|
Password:
|
|
|
|
</PRE>
|
|
<P>The following example authenticates the user as <B>admin</B> in the ABC
|
|
Corporation's test cell:
|
|
<PRE>
|
|
% <B>klog -principal admin -cell test.abc.com</B>
|
|
Password:
|
|
|
|
</PRE>
|
|
<P>In the following, the issuer requests a ticket lifetime of 104 hours 30
|
|
minutes (4 days 8 hours 30 minutes). Presuming that this lifetime is
|
|
allowed by the maximum ticket lifetimes and other factors described in the
|
|
<B>Description</B> section, the token's lifetime is
|
|
110:44:28, which is the next largest possible value.
|
|
<PRE> % <B>klog -lifetime 104:30</B>
|
|
Password:
|
|
|
|
</PRE>
|
|
<P><STRONG>Privilege Required</STRONG>
|
|
<P>None
|
|
<P><STRONG>Related Information</STRONG>
|
|
<P><A HREF="auarf139.htm#HDRFS_EXPORTAFS">fs exportafs</A>
|
|
<P><A HREF="auarf185.htm#HDRKAS_EXAMINE">kas examine</A>
|
|
<P><A HREF="auarf193.htm#HDRKAS_SETFIELDS">kas setfields</A>
|
|
<P><A HREF="auarf197.htm#HDRKAS_UNLOCK">kas unlock</A>
|
|
<P><A HREF="auarf198.htm#HDRKASERVER">kaserver</A>
|
|
<P><A HREF="auarf208.htm#HDRPAGSH">pagsh</A>
|
|
<P><A HREF="auarf235.htm#HDRTOKENS">tokens</A>
|
|
<P>
|
|
<HR><P ALIGN="center"> <A HREF="../index.htm"><IMG SRC="../books.gif" BORDER="0" ALT="[Return to Library]"></A> <A HREF="auarf002.htm#ToC"><IMG SRC="../toc.gif" BORDER="0" ALT="[Contents]"></A> <A HREF="auarf199.htm"><IMG SRC="../prev.gif" BORDER="0" ALT="[Previous Topic]"></A> <A HREF="#Top_Of_Page"><IMG SRC="../top.gif" BORDER="0" ALT="[Top of Topic]"></A> <A HREF="auarf201.htm"><IMG SRC="../next.gif" BORDER="0" ALT="[Next Topic]"></A> <A HREF="auarf284.htm#HDRINDEX"><IMG SRC="../index.gif" BORDER="0" ALT="[Index]"></A> <P>
|
|
<!-- Begin Footer Records ========================================== -->
|
|
<P><HR><B>
|
|
<br>© <A HREF="http://www.ibm.com/">IBM Corporation 2000.</A> All Rights Reserved
|
|
</B>
|
|
<!-- End Footer Records ============================================ -->
|
|
<A NAME="Bot_Of_Page"></A>
|
|
</BODY></HTML>
|