kas setkey                 AFS Commands              kas setkey


NAME

   kas  setkey -- insert  octal key directly into key field of

                       Database entry.


   kas setkey  -name <name of user>  -new_key <eight byte new
   key>    [-kvno <keyversion number>]
   [-admin_username <admin principal to use for
   authentication>]
   [-password_for_admin <admin password>]  [-cell <cell name>]
                                                             +
          [-servers <explicit list of authentication servers> ]
          [-noauth]  [-help]

ACCEPTABLE ABBREVIATIONS/ALIASES

   kas setk -na <name of user> -ne <eight byte new key>
   [-k <key version number>]
   [-a <admin principal to use for authentication>]  [-p <admin
   password>]
   [-c <cell name>]  [-s <explicit list of authentication
           +
   servers> ]  [-no]  [-h]

DESCRIPTION

   Accepts the octal number string eight byte new  key,  places
   it  in  the key field of the Database entry for name of user
   and marks it with key version  number  key  version  number.
   This  command makes most sense when name of user is a server
   process (such as "afs") rather than an individual  user,  as
   discussed in the Warning section.  For individual users, use
   the kas setpassword command instead.

   When changing the key in a server entry, remember  to  alter
   the /usr/afs/etc/KeyFile with the bos addkey command and use
   the same key version number in both places.

WARNING

   Using this command to change user  passwords  is  needlessly
   complicating,  for the following reason.  The Authentication
   Database stores both user passwords and server keys as octal
   strings,  never  as  character  strings.    When a character
   string is provided in  the  kas   setpassword  command  (see
   above),  the  Authentication  Server  calls  an algorithm to
   convert the string into an octal-form encryption  key,  then
   stores  the  key  in the key field of the appropriate entry.
   The kas setkey command (this one)  bypasses  the  conversion
   algorithm, entering eight byte new key directly into the key
   field.  If an octal string is simply invented, there  is  no
   way  to  discover  which character string it corresponds to.
   To use this command to change a user  password,  the  issuer
   would  need  to translate the password character string into
   an  octal  key  using  kas   stringtokey  and  specify   the
   resulting string as eight byte new key here.  Otherwise, the
   user would not know what password to type at login.

   The main use for this command is to  set  server  encryption



   keys,  if  the  system  administrator first executes the bos
   addkey command to add a  new  key  to  /usr/afs/etc/KeyFile.
   That  command  accepts  only  strings and converts them into
   octal keys, just like kas setpassword, but the  output  from
   the  bos  listkeys  command  will  then reveal the converted
   octal form of the string, which is the eight  byte  new  key
   that should be specified here.

ARGUMENTS

   -name             specifies  the  entry for which to replace
                     the key field.

   -new_key          specifies a string of  eight  bytes,  each
                     consisting  of  EITHER a three-digit octal
                     number preceded by a backslash OR a single
                     ASCII  character.  The issuer must provide
                     it  on  the  command  line  where  it   is
                     visible, as there is no prompt for it.

                     Outside    interactive    mode,   surround
                     octalkey with single quotes, or the  shell
                     will  throw away the backslashes.  When in
                     interactive  mode,  do  not  include   the
                     single quotes.

   -kvno             specifies    the    key   version   number
                     associated with the new key.  It  must  be
                     an integer in the range 0 through 255.  In
                     addition, 999 is reserved for the "bcrypt"
                     key  used  in  AFS 2.0 authentication.  If
                     the issuer does not provide this argument,
                     it  defaults  to  0, which is probably not
                     desirable for server keys.

   -admin_username   specifies the user name  under  which  the
                     issuer  wishes to perform the command.  If
                     the  issuer  does  not  provide  it,   the
                     current identity is used.  See section 4.3
                     in the Reference Manual for more  details.
                     -password_for_admin
                     specifies  the  issuer's  password.     If
                     provided  here, the password is visible on
                     the  screen.    If  the  issuer  does  not
                     provide  it,  it  will be prompted for and
                     not be visible on the screen.  See section
                     4.3  in  the  Reference  Manual  for  more
                     details.  -cell
                     specifies  the  cell  in  which to run the
                     command, if  not  the  local  cell.    See
                     section  4.3  in  the Reference Manual for
                     more details.  -servers
                     specifies  the  database server machine(s)
                     with which to establish a connection.  See
                     section  4.3  in  the Reference Manual for
                     more details.  -noauth
                     establishes  an unauthenticated connection
                     between  the  Authentication  Servers  and
                     issuer,  whom they assign the unprivileged
                     identity anonymous rather than  attempting
                     mutual authentication.  See section 4.3 in



                     the Reference  Manual  for  more  details.
                     -help
                     prints the online help for  this  command.
                     Do  not  provide  any  other  arguments or
                     flags with this one.  See section  4.3  in
                     the Reference Manual for more details.



EXAMPLE

   The  following  shows  admin  setting the "afs" key with key
   version number 15.

   % kas setk afs \222\260\334\241c\212\274W 15  Password for
   admin:

PRIVILEGE REQUIRED

   Individual users may use this command to  change  their  own
   keys,  though  this is not advised for the reasons stated in
   the WARNING section.  To change server  encryption  keys  or
   the  key field in another user's entry, issuer must have the
   ADMIN flag set in his or her Authentication Database entry.

MORE INFORMATION

   bos addkey bos listkeys kas setpassword
