klog                       AFS Commands                    klog


NAME

   klog -- authenticate  with  Authentication Server to obtain

                       token.


   klog [-x]  [-principal <user name>]  [-password <user's
   password>]
   [-tmp]  [-cell <cell name>]  [-servers <explicit list of
           +
   servers> ]
   [-pipe]  [-lifetime <ticket lifetime in hh[:mm[:ss]]>]
   [-help]

ACCEPTABLE ABBREVIATIONS/ALIASES

   klog [-x]  [-pr <user name>]  [-pa <user's password>] [-t]
   [-c <cell name>]
                                 +
   [-s <explicit list of servers> ]  [-pi]
   [-l <ticket lifetime in hh[:mm[:ss]]>]  [-h]

DESCRIPTION

   Authenticates the issuer in the indicated cell.  The  issuer
   obtains a token accepted by the AFS server processes in that
   cell.  The Cache Manager stores the token  in  a  credential
   structure associated with the issuer.  If the issuer already
   has a token for the cell,  the  token  resulting  from  this
   command replaces it in the credential structure.

   By default, the token generated is appropriate for the local
   cell (the one to  which  the  local  machine  belongs):  the
   command interpreter contacts an Authentication Server in the
   local  cell,   chosen   at   random   from   the   list   in
   /usr/vice/etc/CellServDB,  and  requests  a  token  for  the
   issuer logged into the local machine.  Use  the  -principal,
   -cell  and/or  -servers  arguments  to  specify  a different
   identity,   cell   or   set   of   Authentication    Servers
   respectively.     See  the  ARGUMENTS  section  for  further
   explanation.

   This command does not change the identity  under  which  the
   issuer is logged into the local UNIX file system.

   The issuer (or user indicated with -principal) does not have
   to  appear  in  the  local  password  file  (/etc/passwd  or
   equivalent)  to  issue this command; in previous versions of
   this command, users had to add the -x flag if they  did  not
   appear in that file.

   During  a  single  login  on  a given machine, a user can be
   authenticated in multiple cells simultaneously, but can have
   only  one  token  at  a  time  for each cell (i.e., can only
   authenticate under one identity per cell).

   The lifetime of the token resulting from this command is the
   smallest of the following:

      - the  lifetime  requested  by  the  issuer with the



        -lifetime  argument.    If  the  issuer  does  not
        include  this  argument, the value defaults to 720
        hours (30 days).

      - the "maximum  ticket  lifetime"  recorded  in  the
        "afs"  entry  in the Authentication Database.  The
        default is 100 hours.  Administrators can  inspect
        this  value using kas examine, and change it using
        kas setfields.

      - the "maximum  ticket  lifetime"  recorded  in  the
        issuer's   Authentication  Database  entry.    The
        default is 25 hours for user  entries  created  by
        the AFS 3.1 or later version of the Authentication
        Server, and 100 hours for user entries created  by
        the  AFS 3.0 version of the Authentication Server.
        Administrators and the  user  himself/herself  can
        inspect   this   value   using   kas examine,  and
        administrators can change it using kas setfields.

      - the "maximum  ticket  lifetime"  recorded  in  the
        "krbtgt.CELLNAME"   entry  in  the  Authentication
        Database; this entry corresponds  to  the  ticket-
        granting  ticket used internally in generating the
        token.  The default is 720 hours (30 days).

   If none of  these  defaults  have  been  changed,  then  the
   standard   token  lifetime  is  25  hours  for  users  whose
   Authentication Database entries were created by the AFS  3.1
   or later version of the Authentication Server, and 100 hours
   for users whose Authentication Database entries were created
   by  the  AFS  3.0 version of the Authentication Server.  The
   user can issue klog to request  a  token  with  a  different
   lifetime.

   The  maximum  lifetime for any token is 720 hours (30 days),
   and the minimum is 5 minutes.  Between these  values,  token
   lifetimes  are  not  granted on a linear scale; only certain
   values are possible.

   Lifetimes between 5 minutes and  10  hours  40  minutes  are
   granted  at 5 minute intervals, rounding up. For example, if
   the issuer requests a lifetime of 12  minutes,  the  token's
   actual lifetime is 15 minutes.

   For  token  lifetimes  greater  than  10  hours  40 minutes,
   consult the following table,  which  presents  the  possible
   times  in  units  of  hours:minutes:seconds.  The  number in
   parentheses is a translation to daysd  hoursh;  the  minutes
   and  seconds  are  the  same  as in the corresponding hourly
   time.  For example, 282:22:17 means 282  hours,  22  minutes
   and  17 seconds, which translates to 11d 18h (11 days and 18
   hours, etc.).  If the issuer requests a lifetime between two
   values,  the  token's  lifetime  is rounded up to the higher
   value.

      11:24:15 (0d 11h)             33:14:21 (1d 09h)          
      12:11:34 (0d 12h)             35:32:15 (1d 11h)          
      13:02:09 (0d 13h)             37:59:41 (1d 13h)          
      13:56:14 (0d 13h)             40:37:19 (1d 16h)          
      14:54:03 (0d 14h)             43:25:50 (1d 19h)          



      15:55:52 (0d 15h)             46:26:01 (1d 22h)          
      17:01:58 (0d 17h)             49:38:40 (2d 01h)          
      18:12:38 (0d 18h)             53:04:37 (2d 05h)          
      19:28:11 (0d 19h)             56:44:49 (2d 08h)          
      20:48:57 (0d 20h)             60:40:15 (2d 12h)          
      22:15:19 (0d 22h)             64:51:57 (2d 16h)          
      23:47:38 (0d 23h)             69:21:04 (2d 21h)          
      25:26:21 (1d 01h)             74:08:46 (3d 02h)          
      27:11:54 (1d 03h)             79:16:23 (3d 07h)          
      29:04:44 (1d 05h)             84:45:16 (3d 12h)          
      31:05:22 (1d 07h)             90:36:53 (3d 18h)          

WARNING

   This command does not create a new  "process  authentication
   group" (commonly abbreviated PAG; see the description of the
   pagsh command in this chapter to learn about PAGs).    Users
   in  cells  not  using  the AFS version of login should issue
   pagsh before issuing this command, so that  the  tokens  get
   stored  in  a credential structure that is identified by PAG
   rather than UNIX UID.  The potential security problem with a
   credential  structure  identified  by  UID  is  that  anyone
   already logged in as "root"  on  a  machine  is  allowed  to
   assume  any other identity by issuing su.  If the credential
   structure is identified by UID rather than  PAG,  then  when
   "root"  assumes  another UID it can use the token, too.  Use
   of a PAG as an identifier eliminates that possibility.

   If the issuer entered the current session by issuing the AFS
   login  command,  his  or her credential structure is already
   identified by a PAG.  Issuing klog during the  same  session
   creates a new token associated with the existing PAG.

ARGUMENTS

   -x        appears  only  for  backwards  compatibility.  Its
             former function is now  the  default  behavior  of
             this  command,  as  mentioned  in  the DESCRIPTION
             section.

   -principal
             is  the user name under which the issuer wishes to
             authenticate.    By  default,  the  Authentication
             Server  attempts  to  authenticate the user logged
             into the local machine's UNIX file system.    This
             argument  allows the issuer to specify a different
             user name.

   -password specifies the issuer's password (or that  of  user
             name  if  principal  is  provided).    Use of this
             argument is STRONGLY DISCOURAGED, as it makes  the
             password  visible  on  the  command  line.  If the
             issuer omits this argument, klog prompts  for  the
             password and does not echo it visibly:

             Password: <user's password>

   -tmp      indicates  that  a  copy  of  the "ticket-granting
             ticket" should be placed in a file  on  the  local
             machine's  /tmp  directory.    The  file is called
             /tmp/tktUnix_UID (example for user with  UNIX  UID



             1000: /tmp/tkt1000).

             The  ticket-granting  ticket  is  an  intermediate
             ticket that the Ticket Granting  Service  requires
             of  clients  who  desire server tickets (the extra
             level of indirection increases security).  Putting
             the   ticket-granting   ticket  into  /tmp  allows
             standard Kerberos applications to  access  it  and
             use it for obtaining server tickets.  If this flag
             is  omitted,  the  Cache  Manager   discards   the
             ticket-granting  ticket  after  it obtains the AFS
             server ticket.

   -cell     specifies the cell in which the issuer  wishes  to
             authenticate,  by  directing  the  command to that
             cell's Authentication Servers.   During  a  single
             login   on   a   given  machine,  a  user  may  be
             authenticated in  multiple  cells  simultaneously,
             but  can have only one token at a time for each of
             them  (i.e.,  can  only  authenticate  under   one
             identity per cell per machine).

             If  this  argument  is  omitted,  the  command  is
             executed  in  the  local  cell,  as   defined   in
             /usr/vice/etc/ThisCell  on  the  client machine on
             which the command  is  issued.    The  issuer  may
             abbreviate  cell  name  to  the shortest form that
             distinguishes it from the other  cells  listed  in
             /usr/vice/etc/CellServDB  on the client machine on
             which the command is issued.

   -servers  causes the  command  interpreter  to  establish  a
             connection  with the Authentication Server running
             on each specified database  server  machine.    It
             then chooses one of these at random to execute the
             command.  The command  accepts  shortened  machine
             names,   but   exactly   which  abbreviations  are
             acceptable depends on the state of the cell's name
             server at the time the command is issued.

             If   this   argument   is   omitted,  the  command
             interpreter establishes  a  connection  with  each
             machine listed for the indicated cell in the local
             workstation's  copy  of  /usr/vice/etc/CellServDB,
             and  then  chooses  one  of  those  at  random for
             command execution.

             This option is useful for testing specific servers
             if problems are encountered.

   -pipe     indicates  that  the  command  should  run without
             printing anything on the screen, including prompts
             or  error  messages.  The klog command interpreter
             Server  expects  to  receive  the  password   from
             standard input (stdin).  The issuer is discouraged
             from  using  this  argument;  it  is  for  use  by
             application programs rather than human users.

   -lifetime indicates  the lifetime that the issuer wishes the
             token to have.  The value provided  is  considered
             in  the  lifetime  calculation  described  in  the



             DESCRIPTION section above, along with the  maximum
             ticket lifetimes mentioned there.  The DESCRIPTION
             section also explains how the actual  lifetime  of
             the  token  is determined, since not all times are
             possible.  If this argument is  not  provided,  it
             defaults  to 720 hours.  The format for specifying
             the lifetime is

                hh[:mm[:ss]]

             Legal values for hh (hours) range from 00  through
             720.    Legal  values  for  mm and ss (minutes and
             seconds) range from 00 through 59.

   -help     prints the online help for this command.   Do  not
             provide  any  other  arguments  or flags with this
             one.

EXAMPLES

   Most often, this command is issued without arguments.    The
   appropriate password is for the person currently logged into
   the local UNIX  file  system.    The  ticket's  lifetime  is
   calculated as described in the DESCRIPTION section above (if
   no defaults have been changed, it is 25  hours  for  a  user
   whose  Authentication  Database entry was created by the AFS
   3.1 or later version of the Authentication Server, 100 hours
   for  a  user whose Authentication Database entry was created
   with the AFS 3.0 version).

   % klog  Password:

   The following allows the issuer working on a machine in  the
   Transarc  cell to authenticate as admin in the Transarc test
   cell, even though he or she  is  logged  into  the  Transarc
   machine under a different name.

   % klog admin -c test.transarc.com  Password: <admin's
   password>

   In  the  following, the issuer requests a ticket lifetime of
   104 hours 30 minutes (4 days 8 hours 30 minutes).  Presuming
   that   this  lifetime  is  allowed  by  the  maximum  ticket
   lifetimes and other factors  described  in  the  DESCRIPTION
   section,   the   token  will  have  an  actual  lifetime  of
   110:44:28, which the next largest possible value.

   % klog -life 104:30  Password:



PRIVILEGE REQUIRED

   None.    An  entry  for  the  issuer  must  exist   in   the
   Authentication  Database,  and  the  issuer  must supply the
   correct password.

MORE INFORMATION

   pagsh
