mirror of
https://git.openafs.org/openafs.git
synced 2025-01-31 13:38:01 +00:00
20d5760fe9
Add a manual page for the KeyFileExt file. Add cross-references from all places which currently reference KeyFile(5), and update their body text accordingly. Change-Id: Iab56847fcb59dda0c8a344a626ddb0ff35b98b26 Reviewed-on: http://gerrit.openafs.org/11770 Tested-by: BuildBot <buildbot@rampaginggeek.com> Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
83 lines
2.8 KiB
Plaintext
83 lines
2.8 KiB
Plaintext
=head1 NAME
|
|
|
|
KeyFileExt - Defines extended AFS server encryption keys
|
|
|
|
=head1 DESCRIPTION
|
|
|
|
The F<KeyFileExt> file defines some of the server encryption keys
|
|
that the AFS server
|
|
processes running on the machine use to decrypt the tickets presented by
|
|
clients during the mutual authentication process. AFS server processes
|
|
perform privileged actions only for clients that possess a ticket
|
|
encrypted with one of the keys from the F<KeyFile> or F<KeyFileExt>.
|
|
The file must reside in the
|
|
F</usr/afs/etc> directory on every server machine. For more detailed
|
|
information on mutual authentication and server encryption keys, see the
|
|
I<OpenAFS Administration Guide>.
|
|
|
|
Each key has a corresponding key version number and encryption
|
|
type that distinguishes it
|
|
from the other keys. The tickets that clients present are also marked with
|
|
a key version number and encryption type
|
|
to tell the server process which key to use to
|
|
decrypt it. The F<KeyFileExt> file must always include a key with the same
|
|
key version number and encryption type
|
|
and contents as the key currently listed for the
|
|
C<afs/I<cell>> principal in the associated Kerberos v5 realm.
|
|
(The principal C<afs> may be used if the cell and
|
|
realm names are the same, but adding the cell name to the principal is
|
|
recommended even in this case.)
|
|
Keys in the F<KeyFile> must be DES keys; keys of stronger
|
|
encryption types (such as those used by the rxkad-k5 extension) are
|
|
contained in the F<KeyFileExt>.
|
|
|
|
The F<KeyFileExt> file is in binary format, so always use the
|
|
B<asetkey> command to administer it:
|
|
|
|
=over 4
|
|
|
|
=item *
|
|
|
|
The B<asetkey add> command to add a new key.
|
|
|
|
=item *
|
|
|
|
The B<asetkey list> command to display the keys.
|
|
|
|
=item *
|
|
|
|
The B<asetkey delete> command to remove a key from the file.
|
|
|
|
=back
|
|
|
|
The B<asetkey> commands must be run on the same server as the F<KeyFileExt>
|
|
file to update. Normally, new
|
|
keys should be added from a Kerberos v5 keytab using B<asetkey add>.
|
|
|
|
The file should be edited on each server machine.
|
|
|
|
=head1 CAUTIONS
|
|
|
|
The most common error caused by changes to F<KeyFileExt> is to add a key that
|
|
does not match the corresponding key for the Kerberos v5 principal or
|
|
Authentication Server database entry. Both the key and the key version
|
|
number must match the key for the corresponding principal, either
|
|
C<afs/I<cell>> or C<afs>, in the Kerberos v5 realm. Using L<asetkey(8)>
|
|
to add rxkad-k5 keys to the F<KeyFileExt> also requires specifying a krb5
|
|
encryption type number. Since the encryption type must be specified
|
|
by its number (not a symbolic or string name), care must be taken to
|
|
determine the correct encryption type to add.
|
|
|
|
=head1 SEE ALSO
|
|
|
|
L<KeyFile(5)>,
|
|
L<asetkey(8)>,
|
|
|
|
The I<OpenAFS Administration Guide> at
|
|
L<http://docs.openafs.org/AdminGuide/>.
|
|
|
|
=head1 COPYRIGHT
|
|
|
|
IBM Corporation, 2000. <http://www.ibm.com/> All Rights Reserved.
|
|
Massachusetts Institute of Technology, 2015.
|