kas setpassword            AFS Commands         kas setpassword


NAME

   kas setpassword -- change key field in Database entry.


   kas setpassword  -name <name of user>
   [-new_password <new password>]
   [-kvno <key version number>]
   [-admin_username <admin principal to use for
   authentication>]
   [-password_for_admin <admin password>]  [-cell <cell name>]
            [-servers <explicit list of authentication
           +
   servers> ]
   [-noauth]  [-help]

ACCEPTABLE ABBREVIATIONS/ALIASES

   kas sp  -na <name of user> [-ne <new password>]
   [-k <key version number>]
   [-a <admin principal to use for authentication>]
   [-p <admin password>]  [-c <cell name>]
                                                +
   [-s <explicit list of authentication servers> ]  [-no]  [-h]

DESCRIPTION

   Accepts a character string new password of unlimited length,
   scrambles it into a form suitable for use as  an  encryption
   key, and places it in the key field of name's Authentication
   Database entry.

   There is little reason to type new password on  the  command
   line,  where  it is visible.  If the issuer does not provide
   the password on the command line, a

   new_password:

   prompt appears, followed by a  second  prompt  requesting  a
   repetition  of the new password.  In both cases the password
   does not echo visibly.  The second  prompt  guarantees  that
   the  issuer did not make a typing mistake when responding to
   the first prompt.

   When adding server keys (such as "afs"), remember to add the
   new  key  to  the  /usr/afs/etc/KeyFile using the bos addkey
   command and to use the same  key  version  number  there  as
   here.     See  the  AFS  System  Administrator's  Guide  for
   instructions.



ARGUMENTS

   -name             specifies the entry for which  to  replace
                     the key field.

   -new_password     is the character string the user will type
                     when  logging  in.    It   should   be   8
                     characters   or   less,  as  some  non-AFS
                     programs cannot handle  longer  passwords.
                     The  Authentication  Server  scrambles  it
                     into a  string  of  octal  numbers  before
                     storing it in the key field.

   -kvno             specifies    the    key   version   number
                     associated with the new key.  It  must  be
                     an   integer   between  0  and  255.    In
                     addition, 999 is reserved for the "bcrypt"
                     key  used  in  AFS 2.0 authentication.  If
                     the issuer does not provide this argument,
                     it  defaults  to  0, which is probably not
                     desirable for server keys.

   -admin_username   specifies the user name  under  which  the
                     issuer  wishes to perform the command.  If
                     the  issuer  does  not  provide  it,   the
                     current identity is used.  See section 4.3
                     in the Reference Manual for more  details.
                     -password_for_admin
                     specifies  the  issuer's  password.     If
                     provided  here, the password is visible on
                     the  screen.    If  the  issuer  does  not
                     provide  it,  it  will be prompted for and
                     not be visible on the screen.  See section
                     4.3  in  the  Reference  Manual  for  more
                     details.  -cell
                     specifies  the  cell  in  which to run the
                     command, if  not  the  local  cell.    See
                     section  4.3  in  the Reference Manual for
                     more details.  -servers
                     specifies  the  database server machine(s)
                     with which to establish a connection.  See
                     section  4.3  in  the Reference Manual for
                     more details.  -noauth
                     establishes  an unauthenticated connection
                     between  the  Authentication  Servers  and
                     issuer,  whom they assign the unprivileged
                     identity anonymous rather than  attempting
                     mutual authentication.  See section 4.3 in
                     the Reference  Manual  for  more  details.
                     -help
                     prints the online help for  this  command.
                     Do  not  provide  any  other  arguments or
                     flags with this one.  See section  4.3  in
                     the Reference Manual for more details.

EXAMPLE

   The  following  shows  privileged  user admin changing pat's
   password (presumably because pat forgot the former  password
   or got locked out of his account in some other way.



       % kas sp pat
       Password for admin:
       new_password:
       Verifying, please re-enter new_password:



PRIVILEGE REQUIRED

   An  individual  user  may  change  his  or her own password,
   although use of the kpasswd command is recommended  instead.
   To  change  another  user's password or the password (server
   encryption key) for server processes such as  "afs",  issuer
   must  have  the  ADMIN flag set in his or her Authentication
   Database entry.

MORE INFORMATION

   bos addkey kas setkey
