                           AFS Commands


NAME
                             AFS Commands


   1. The kas Commands

   ------------------------------------------------------------

   This   chapter   defines   the   kas  commands  that  system
   administrators use to contact the Authentication Server.  It
   assumes  the  reader is familiar with the concepts described
   in the AFS System Administrator's Guide.

   The kas command interface allows  system  administrators  to
   create,   modify,   examine   and   delete  entries  in  the
   Authentication Database  maintained  by  the  Authentication
   Server.    Individual  users  may  use  the  kas setpassword
   command to change their own password (as well  as  the  more
   standard, non-kas command, kpasswd).

   Refer to the Command Summary at the end of this document for
   a complete list of kas commands and their syntax.
   AFS Command Reference Manual             The kas Commands  2


   1.1 The kas Interface
   The kas command interface differs slightly from  the  others
   described   in  this  manual.    The  Authentication  Server
   authenticates issuers of kas commands directly  rather  than
   accepting  a ticket from the Ticket Granting Service as most
   other servers do.   Thus  most  commands  require  that  the
   issuer provide his or her password at the time of issue.



   1.1.1 Interactive Mode
   Providing  the  password  each time could get tedious if the
   user needed to execute a  whole  set  of  commands,  so  kas
   provides  an "interactive" mode in which it is not necessary
   to provide a password repeatedly.


   1.1.1.1 Entering Interactive Mode
   There are several ways to enter interactive mode:

      - Use the kas interactive command.

      - Type kas without any operation code.  By  default,
        the  command  interpreter establishes a connection
        with each Authentication Server in the local cell.
        They  attempt to authenticate the user logged into
        the machine from  which  the  command  is  issued,
        based  on  the password the issuer provides at the
        prompt.  The  issuer  may  specify  an   alternate
        identity,  password,  cell  name  and/or  list  of
        Authentication Servers by  using  the  first  four
        common  arguments  described in section 4.3 in the
        Reference Manual .  Type kas followed  by  a  user
        name  and  cell  name,  separated  by  an "@" sign
        (example:   kas    smith@transarc.com).        The
        Authentication Server attempts to authenticate the
        specified user in the specified cell, and  prompts
        for  his  or  her  password in the specified cell.
        This method is most useful when the issuer  wishes
        to   enter   interactive  mode  with  a  different
        identity in a different cell.


   1.1.1.2 Effects of Entering Interactive Mode
   While in interactive mode:


      - The "ka>" prompt  replaces  the  issuer's  regular
        prompt.

      - It  is no longer necessary or legal to type kas at
        the beginning of a command.   Type  the  operation
        code as the first part of the command.

      - The  Authentication Server does not prompt for the
        issuer's password at each command.   This  is  the
        mode's main advantage.

      - The  issuer's identity and cell are set and cannot
        be changed without leaving interactive mode, so it
        is   not  legal  to  provide  any  of  the  common
   AFS Command Reference Manual             The kas Commands  3


        arguments described fully in section  4.3  in  the
        Reference Manual , except for -help.

   1.2 Information in the Authentication Database
   Both  individual  users  and  servers  have  entries  in the
   Authentication Database.  The two most important  fields  in
   an entry are:

      - the name

      - the  key  (a  scrambled  form  of name's password,
        suitable for use as an encryption key)

   For individual users, the name field holds the user name  as
   typed  at  login,  and  key  holds  a  scrambled form of the
   password the user has created.

   Server entries are the same as user entries.  The entry name
   for the AFS server processes is "afs".  A server entry's key
   field contains the server encryption  key  that  the  Ticket
   Granting  Service (TGS) uses to seal the tickets it gives to
   clients so that they may contact the server processes.

   1.3 Common Arguments and Flags
   When not in interactive mode, most kas commands  accept  the
   following  optional  arguments and flags.  Some of these are
   unavailable in interactive mode because the information they
   provide  is established while entering interactive mode, and
   cannot be changed from within interactive mode.    They  are
   listed in the command descriptions where they apply, and are
   described in detail below:

   [-admin_username <admin principal to use for
   authentication>]

   This argument allows the issuer to assume  the  identity  of
   the  specified  user name (which is referred to as an "admin
   principal").  By default, the Authentication Server attempts
   to authenticate the user logged into the local workstation.

   [-password_for_admin <admin password>]

   This  argument  provides  the Authentication Server with the
   password needed to prove that the issuer of the command (the
   admin  principal) is legitimate (which it will if it matches
   the password stored in the Authentication Database  for  the
   issuer).    Note that providing this argument on the command
   line reveals the password on the screen.  Issuers may prefer
   to  respond  to the prompt that will appear if this argument
   is not provided, as the password does not  echo  visibly  in
   that case.

   [-cell <cell name>]

   This  argument specifies that the command should be run in a
   different  cell,  specified  by  cell  name.    By  default,
   commands  are  executed  in  the  local  cell, as defined in
   /usr/vice/etc/ThisCell on the client machine  on  which  the
   command  is  issued.  The issuer may abbreviate cell name to
   the shortest form that distinguishes it from the other cells
   listed  in /usr/vice/etc/CellServDB on the client machine on
   AFS Command Reference Manual             The kas Commands  4


   which the command is issued.

                                                      +
   [-servers <explicit list of authentication servers> ]

   This  argument  causes  the  kas  command   interpreter   to
   establish   a  connection  with  the  Authentication  Server
   running on each specified database server machine.  It  then
   chooses  one  of  these at random to execute each subsequent
   command.  The issuer may abbreviate the machine name to  the
   extent the cell's name server will accept.

   By  default,  the  kas  command  interpreter  establishes  a
   connection  with  each   machine   listed   in   the   local
   workstation's  copy  of  /usr/vice/etc/CellServDB,  and then
   chooses one of those at random for command execution.

   This option  is  useful  for  testing  specific  servers  if
   problems are encountered.

   [-noauth]

   This  flag  instructs indicated Authentication Server(s) not
   to  authenticate  the  issuer  of  the  command,  and   thus
   establishes an unauthenticated connection between the issuer
   and the Authentication Server (he or she  is  recognized  as
   the  unprivileged  user  anonymous).  It is useful only when
   authorization  checking  is  disabled  on  the  file  server
   machine (during the installation of a file server machine or
   when  bos setauth  has  been  used  during   other   unusual
   circumstances).  In normal circumstances, the Authentication
   Server allows only authorized (privileged)  users  to  issue
   most  kas commands, and will refuse to execute the requested
   actions even if the -noauth flag is used.

   [-help]

   This flag has the same function as the kas help command:  it
   prints  the command's online help message on the screen.  No
   other arguments or flags should  be  provided  at  the  same
   time.    Even if they are, this flag overrides them, and the
   only effect of issuing the command is that the help  message
   appears.

   1.4 The Privilege Required for kas Commands
   The  Authentication  Server considers privileged those users
   who have the ADMIN flag turned on  in  their  Authentication
   Database  entry.  See the kas setfields command to learn how
   to turn on the ADMIN flag.  Most kas commands  require  that
   the  issuer  be  privileged.  All commands will prompt for a
   password, unless the issuer has entered interactive mode.
