kas interactive            AFS Commands         kas interactive


NAME

   kas     interactive -- enter     interactive    mode    for

                       Authentication Server.


   kas interactive
   [-admin_username <admin principal to use for
   authentication>]
   [-password_for_admin <admin password>]  [-cell <cell name>]
            [-servers <explicit list of authentication
           +
   servers> ]  [-noauth]
   [-help]

ACCEPTABLE ABBREVIATIONS/ALIASES

   kas i  [-a <admin principal to use for authentication>]  [-p
   <admin password>]
   [-c <cell name>]  [-s <explicit list of authentication
           +
   servers> ]
   [-n]  [-h]

DESCRIPTION

   Enters interactive mode.  By establishing  an  authenticated
   connection in this way, the issuer will not have to type his
   or her password at each command as  would  be  necessary  in
   regular  mode.    The authenticated connection lasts for one
   hour unless the maximum ticket lifetime for  the  issuer  or
   the Authentication Server is shorter.

   It   is   also  possible  to  establish  an  unauthenticated
   connection under the identity anonymous by using the -noauth
   flag.    During normal operation, there is no point to doing
   so,   because   the   Authentication   Server   still   does
   authorization  checking and will not allow anonymous, who is
   unprivileged by definition, to perform privileged commands.

   A possible situation in which an issuer might wish to  enter
   interactive  mode unauthenticated is if he or she knows that
   attempting to authenticate will cause a problem,  but  wants
   to  list  some  unprivileged  information.    Attempting  to
   authenticate could cause a problem,  for  instance,  if  the
   Authentication  Server  no longer knows the key used to seal
   the ticket  the  user  has  (perhaps  it  is  no  longer  in
   /usr/afs/etc/KeyFile).

   The other repercussions of entering interactive mode are:

      - A  "ka>"  prompt  replaces  the  issuer's  regular
        prompt

      - It is no longer necessary or legal to type kas  at
        the  beginning  of  a command.  Type the operation
        code as the first part of the command

      - It is not useful to include the  common  arguments
        described in section 4.3 in the Reference Manual :



        -admin_username,    -password_for_admin,    -cell,
        -servers.  They are ignored, because the variables
        corresponding to them are set as the issuer enters
        interactive  mode,  and  cannot be changed without
        leaving interactive mode.  It is legal to  provide
        the -help flag.

   There are two additional ways to enter interactive mode:

      1. Type kas without any operation code.  By default,
         the command interpreter establishes a  connection
         with  all  of  the  Authentication Servers in the
         local cell.  They  attempt  to  authenticate  the
         user  logged  into  the  machine  from  which the
         command is issued,  based  on  the  password  the
         issuer  provides  at  the  prompt. The issuer may
         specify an  alternate  identity,  password,  cell
         name  and/or  list  of  Authentication Servers by
         using the first four common  arguments  described
         in  section  4.3  in the Reference Manual .  Type
         kas followed  by  a  user  name  and  cell  name,
         separated   by   an   "@"   sign   (example:  kas
         smith@transarc.com).  The  Authentication  Server
         attempts  to  authenticate  the specified user in
         the specified cell, and prompts for  his  or  her
         password  in  the specified cell.  This method is
         most useful  when  the  issuer  wishes  to  enter
         interactive  mode  with a different identity than
         the one under which he or she is currently logged
         on.

ARGUMENTS

   -admin_username   specifies  the  user  name under which the
                     issuer wishes to perform the command.   If
                     the   issuer  does  not  provide  it,  the
                     current identity is used.  See section 4.3
                     in  the Reference Manual for more details.
                     -password_for_admin
                     specifies   the  issuer's  password.    If
                     provided here, the password is visible  on
                     the  screen.    If  the  issuer  does  not
                     provide it, it will be  prompted  for  and
                     not be visible on the screen.  See section
                     4.3  in  the  Reference  Manual  for  more
                     details.  -cell
                     specifies the cell in  which  to  run  the
                     command,  if  not  the  local  cell.   See
                     section 4.3 in the  Reference  Manual  for
                     more details.  -servers
                     specifies the database  server  machine(s)
                     with which to establish a connection.  See
                     section 4.3 in the  Reference  Manual  for
                     more details.  -noauth
                     establishes an unauthenticated  connection
                     between  the  Authentication  Servers  and
                     issuer, whom they assign the  unprivileged
                     identity  anonymous rather than attempting
                     mutual   authentication.      Using   this
                     argument  on  this  command is useful only
                     when authorization checking is disabled on



                     the   file   server  machine  (during  the
                     installation of a file server  machine  or
                     when  bos setauth  has  been  used  during
                     other  unusual  circumstances).      Under
                     normal        authorization       checking
                     circumstances, the Authentication  Servers
                     will  allow  only  authorized (privileged)
                     users to issue commands  that  change  the
                     status  of a server or configuration file,
                     even if the -noauth  flag  was  used  when
                     entering  interactive  mode.   See section
                     4.3  in  the  Reference  Manual  for  more
                     details.  -help
                     prints the online help for  this  command.
                     Do  not  provide  any  other  arguments or
                     flags with this one.  See section  4.3  in
                     the Reference Manual for more details.

EXAMPLE

   The  following shows a user entering interactive mode as the
   privileged user admin.

   % kas i admin  Password for admin:  ka>

PRIVILEGE REQUIRED

   None.  A password will be prompted for, and  something  must
   be  typed  in  response, but the issuer needs to provide the
   correct  password  only  if  he  or  she  wishes  to   issue
   privileged commands while in interactive mode.  If he or she
   provides  an  wrong  character  string,  the  Authentication
   Server assigns the unprivileged identity anonymous.

MORE INFORMATION

   (kas) noauthentication (kas) quit
