mirror of
https://git.openafs.org/openafs.git
synced 2025-01-19 07:20:11 +00:00
af1dbcf0c9
For each command only useful with the Authentication Server, add warnings that the Authentication Server is obsolete and will be removed in a future version of OpenAFS. Encourage people who care to update uss to work with a modern Kerberos KDC, recommend kinit and aklog or klog.krb5 over klog, and warn that klog will be of limited use without an Authentication Server. Change-Id: Idc78ba548134b83ac1eea0fb81a5bc38a431bb38 Reviewed-on: http://gerrit.openafs.org/2052 Reviewed-by: Derrick Brashear <shadow@dementia.org> Tested-by: Derrick Brashear <shadow@dementia.org>
206 lines
7.3 KiB
Plaintext
206 lines
7.3 KiB
Plaintext
=head1 NAME
|
|
|
|
kaserver - Initializes the Authentication Server
|
|
|
|
=head1 SYNOPSIS
|
|
|
|
=for html
|
|
<div class="synopsis">
|
|
|
|
B<kaserver> [B<-noAuth>] [B<-database> <I<dbpath>>]
|
|
S<<< [B<-auditlog> <I<log path>>] >>> [B<-audit-interface> (file | sysvmq)]
|
|
S<<< [B<-localfiles> <I<lclpath>>] >>> S<<< [B<-minhours> <I<n>>] >>>
|
|
S<<< [B<-servers> <I<serverlist>>] >>> [B<-enable_peer_stats>]
|
|
[B<-enable_process_stats>] [B<-help>]
|
|
|
|
=for html
|
|
</div>
|
|
|
|
=head1 DESCRIPTION
|
|
|
|
The B<kaserver> command initializes the Authentication Server, an obsolete
|
|
way of providing authentication services to an AFS cell. It should no
|
|
longer be used; instead, it should be replaced with a Kerberos version 5
|
|
KDC. It is provided only for support of sites already running the
|
|
Authentication Server and that have not yet migrated to Kerberos version
|
|
5.
|
|
|
|
For a cell using the Authentication Server, it runs on every database
|
|
server machine. In the conventional configuration, its binary file is
|
|
located in the F</usr/afs/bin> directory on a file server machine.
|
|
|
|
The B<kaserver> command is not normally issued at the command shell prompt
|
|
but rather placed into a file server machine's F</usr/afs/local/BosConfig>
|
|
file with the B<bos create> command. If it is ever issued at the command
|
|
shell prompt, the issuer must be logged onto a database server machine as
|
|
the local superuser C<root>.
|
|
|
|
As it initializes, the Authentication Server process creates the two files
|
|
that constitute the Authentication Database, F<kaserver.DB0> and
|
|
F<kaserver.DBSYS1>, in the F</usr/afs/db> directory if they do not already
|
|
exist. Use the commands in the B<kas> suite to administer the database.
|
|
|
|
The Authentication Server is responsible for several aspects of AFS
|
|
security, including:
|
|
|
|
=over 4
|
|
|
|
=item *
|
|
|
|
Maintenance of all AFS server encryption keys and user passwords in the
|
|
Authentication Database.
|
|
|
|
=item *
|
|
|
|
Creation of the tickets and tokens that users and servers use to establish
|
|
secure connections. Its Ticket Granting Service (TGS) component performs
|
|
this function.
|
|
|
|
=back
|
|
|
|
The Authentication Server records a trace of its activity in the
|
|
F</usr/afs/logs/AuthLog> file. Use the B<bos getlog> command to display
|
|
the contents of the file. Use the B<kdb> command to read the protected
|
|
files associated with the F<AuthLog> file, F<AuthLog.dir> and
|
|
F<AuthLog.pag>.
|
|
|
|
This command does not use the syntax conventions of the AFS command
|
|
suites. Provide the command name and all option names in full.
|
|
|
|
=head1 CAUTIONS
|
|
|
|
The Authentication Server provides only Kerberos version 4, which is no
|
|
longer considered sufficiently secure. It can only use DES encryption for
|
|
user keys, is vulnerable to known flaws in the Kerberos version 4
|
|
protocol, and is based on protocols that are obsolete and no longer
|
|
developed. The Authentication Server is also not widely tested and is
|
|
known to have problems on some platforms OpenAFS otherwise supports.
|
|
|
|
The Authentication Server should not be used for any new deployment. It is
|
|
provided only for sites that need to use it while preparing for a
|
|
migration to Kerberos KDC. No significant updates to the Authentication
|
|
Server will be developed, and it will be removed from a future version of
|
|
OpenAFS.
|
|
|
|
=head1 OPTIONS
|
|
|
|
=over 4
|
|
|
|
=item B<-noAuth>
|
|
|
|
Assigns the unprivileged identity C<anonymous> to the issuer. Thus, it
|
|
establishes an unauthenticated connection between the issuer and the
|
|
Authentication Server. It is useful only when authorization checking is
|
|
disabled on the database server machine. In normal circumstances, the
|
|
Authentication Server allows only authorized (privileged) users to issue
|
|
commands that affect or contact the Authentication Database and will
|
|
refuse to perform such an action even if the B<-noAuth> flag is used.
|
|
|
|
=item B<-database> <I<dbpath>>
|
|
|
|
Specifies the pathname of an alternate directory in which the
|
|
Authentication Database files reside. Provide the complete pathname,
|
|
ending in the base filename to which the C<.DB0> and C<.DBSYS1> extensions
|
|
are appended. For example, the appropriate value for the default database
|
|
files is F</usr/afs/db/kaserver>.
|
|
|
|
Provide the B<-localfiles> argument along with this one; otherwise, the
|
|
B<-localfiles> argument is also set to the value of this argument, which
|
|
is probably inappropriate.
|
|
|
|
=item B<-auditlog> <I<log path>>
|
|
|
|
Turns on audit logging, and sets the path for the audit log. The audit
|
|
log records information about RPC calls, including the name of the RPC
|
|
call, the host that submitted the call, the authenticated entity (user)
|
|
that issued the call, the parameters for the call, and if the call
|
|
succeeded or failed.
|
|
|
|
=item B<-audit-interface> (file | sysvmq)
|
|
|
|
Specifies what audit interface to use. Defaults to C<file>. See
|
|
L<fileserver(8)> for an explanation of each interface.
|
|
|
|
=item B<-localfiles> <I<lclpath>>
|
|
|
|
Specifies the pathname of an alternate directory in which the auxiliary
|
|
Authentication Database file resides. Provide the complete pathname,
|
|
ending in the base filename to which the C<auxdb> suffix is appended. For
|
|
example, the appropriate value for the default auxiliary database file is
|
|
F</usr/afs/local/kaserver>.
|
|
|
|
=item B<-minhours> <I<n>>
|
|
|
|
Specifies the minimum number of hours that must pass between password
|
|
changes made by any regular user. System administrators (with the C<ADMIN>
|
|
flag in their Authentication Database entry) can change passwords as often
|
|
as desired. Setting a minimum time between password changes is not
|
|
recommended.
|
|
|
|
=item B<-servers> <I<authentication servers>>+
|
|
|
|
Names each database server machine running an Authentication Server with
|
|
which the local Authentication Server is to synchronize its copy of the
|
|
Authentication Database, rather than with the machines listed in the local
|
|
F</usr/afs/etc/CellServDB> file.
|
|
|
|
=item B<-enable_peer_stats>
|
|
|
|
Activates the collection of Rx statistics and allocates memory for their
|
|
storage. For each connection with a specific UDP port on another machine,
|
|
a separate record is kept for each type of RPC (FetchFile, GetStatus, and
|
|
so on) sent or received. To display or otherwise access the records, use
|
|
the Rx Monitoring API.
|
|
|
|
=item B<-enable_process_stats>
|
|
|
|
Activates the collection of Rx statistics and allocates memory for their
|
|
storage. A separate record is kept for each type of RPC (FetchFile,
|
|
GetStatus, and so on) sent or received, aggregated over all connections to
|
|
other machines. To display or otherwise access the records, use the Rx
|
|
Monitoring API.
|
|
|
|
=item B<-help>
|
|
|
|
Prints the online help for this command. All other valid options are
|
|
ignored.
|
|
|
|
=back
|
|
|
|
=head1 EXAMPLES
|
|
|
|
The following B<bos create> command creates a C<kaserver> process on
|
|
C<fs3.abc.com> (the command appears on two lines here only for
|
|
legibility):
|
|
|
|
% bos create -server fs3.abc.com -instance kaserver \
|
|
-type simple -cmd /usr/afs/bin/kaserver
|
|
|
|
=head1 PRIVILEGE REQUIRED
|
|
|
|
The issuer must be logged in as the superuser C<root> on a file server
|
|
machine to issue the command at a command shell prompt. It is conventional
|
|
instead to create and start the process by issuing the B<bos create>
|
|
command.
|
|
|
|
=head1 SEE ALSO
|
|
|
|
L<AuthLog(5)>,
|
|
L<BosConfig(5)>,
|
|
L<CellServDB(5)>,
|
|
L<kaserver.DB0(5)>,
|
|
L<kaserverauxdb(5)>,
|
|
L<bos(8)>,
|
|
L<bos_create(8)>,
|
|
L<bos_getlog(8)>,
|
|
L<kas(8)>,
|
|
L<kdb(8)>
|
|
|
|
=head1 COPYRIGHT
|
|
|
|
IBM Corporation 2000. <http://www.ibm.com/> All Rights Reserved.
|
|
|
|
This documentation is covered by the IBM Public License Version 1.0. It was
|
|
converted from HTML to POD by software written by Chas Williams and Russ
|
|
Allbery, based on work by Alf Wachsmann and Elizabeth Cassell.
|