knfs                       AFS Commands                    knfs


NAME

   knfs -- enable   authenticated  access  to  AFS  from  non-

                       supported  NFS  client   using   NFS/AFS
                       Translator.


   knfs -host <host name>  [-id <user ID (decimal)>]
   [-unlog]  [-help]

ACCEPTABLE ABBREVIATIONS/ALIASES

   knfs  [-ho <host name>]  [-i <user ID (decimal)>] [-u]
   [-he]

DESCRIPTION

   When  issued on an NFS/AFS Translator machine, creates a PAG
   associated with  the  indicated  NFS  client  machine  (host
   name), and optionally, the user ID (user ID) that the issuer
   is using on host name.  It associates the issuer's  existing
   AFS  token(s)  with a new credential structure identified by
   the new PAG.

   Issue  this  command  only  over   a   connection   (perhaps
   established  at the console or via telnet) to the AFS client
   machine serving as the NFS/AFS translator machine  for  host
   name,  never  on  the  NFS  client  machine  itself.  Before
   issuing it, obtain AFS tokens on the translator machine  for
   every  cell to be contacted during the login session on host
   name.  The Cache Manager on the translator machine then uses
   the  credential  structure  identified  by  the new PAG when
   accessing AFS on behalf of the issuer  working  on  the  NFS
   client  machine.    (If  the  issuer  dos  not  use  the -id
   argument, he or she may actually be sharing  the  credential
   structure  with  other  users on the NFS client machine; see
   the WARNINGS section for details.)

   This command  allows  the  issuer  to  obtain  authenticated
   access  to AFS (via the NFS/AFS Translator) while working on
   an NFS client machine (host name) of a system type for which
   AFS  is not available.  Users working on NFS client machines
   of system types for which AFS is available  (and  for  which
   the  cell has purchased a license) do not need this command,
   because the klog command  is  available  for  those  machine
   types.

   The  -unlog  flag  discards  the  tokens  in  the credential
   structure identified by the PAG, but does  not  destroy  the
   credential  structure  itself.    The  Cache  Manager on the
   translator machine retains the  credential  structure  until
   the  next  reboot, and uses it each time the issuer accesses
   AFS  through  the  translator  machine.     The   credential
   structure only has tokens in it if the issuer re-issues knfs
   on the translator machine each time he or she logs into  the
   NFS client machine.

WARNINGS

   Although  the  -id  argument  is  optional, not using it can



   create potential security problems and confusion about which
   users are using which tokens, as described in the following.

   The  security  problems arise because if the issuer does not
   use -id, then his  or  her  tokens  are  associated  with  a
   "generic"  credential  structure identified by a PAG that is
   associated only  with  host  name,  not  with  the  specific
   issuer.    Every user working on host name who also does not
   use the -id argument  shares  the  same  generic  credential
   structure  and  so  uses the issuer's tokens.  This includes
   users on host name who do not issue knfs at all.  If another
   user subsequently issues knfs without -id, his or her tokens
   replace the  previous  issuer's  tokens  in  the  credential
   structure,  and  everyone  shares  the  new  tokens instead.
   Similarly, when an issuer discards tokens  with  the  -unlog
   flag  and  does not use -id, then everyone using the generic
   credential structure becomes  unauthenticated  at  the  same
   time.

   The  sharing  of  tokens  that  result from not using -id is
   acceptable from a security standpoint only if

      - host name is used by only one person

      - it is acceptable that all of host name's users who
        do not have their own credential structure (do not
        use -id) have the same access to AFS files.   They
        should  be  aware  that  they are subject to token
        sharing.

   The DESCRIPTION section mentioned that using the -unlog flag
   does not destroy the credential structure, but only discards
   the tokens associated with it.  The  Cache  Manager  on  the
   translator  machine  retains  the credential structure until
   the next reboot and uses it whenever the issuer accesses AFS
   through  the  translator  machine.   One implication is that
   once the issuer issues knfs using the -id  argument,  he  or
   she  cannot  use  the generic credential structure until the
   machine is rebooted.

   This command does not make it possible for users working  on
   non-supported  machine types to issue AFS commands.  This is
   possible only on NFS clients of a system type for which  AFS
   is available (and for which the cell has purchased AFS).

ARGUMENTS

   -host           names  the  NFS client machine the issuer is
                   working on.  A  full  name  is  safest,  but
                   abbreviated  forms  are acceptable depending
                   on the state of the cell's  name  server  at
                   the time the command is issued.

   -id             specifies  the  issuer's  user ID on the NFS
                   client (a UNIX UID or equivalent), which NFS
                   passes to the translator machine to identify
                   the user.

   -unlog          discards  the  tokens  in   the   credential
                   structure  identified  by the PAG associated
                   with -host and, optionally, -id.



   -help           prints the online help for this command.  Do
                   not  provide  any  other  arguments or flags
                   with this one.

EXAMPLE

   The following shows a typical use  of  this  command.    The
   issuer  smith is working on nfs-client1.transarc.com and has
   user ID 1020 on that machine.  He is accessing  AFS  through
   the  translator machine called translator4.transarc.com.  He
   telnets to translator4 and uses AFS login as  smith  in  the
   Transarc  cell.    He  the uses klog to obtain tokens in the
   Transarc test cell (test.transarc.com) as admin.   The  knfs
   command  instructs  the  Cache  Manager  on  translator4  to
   associate both tokens with the PAG identified by nfs-client1
   and  user ID 1020.  He exits the telnet connection and works
   normally on nfs-client1.

       % telnet translator4.transarc.com
       . . .
       login: smith
       Password:
       AFS 3.2 (R) login
       % klog admin -c test.transarc.com
       Password:
       % knfs nfs-client1.transarc.com 1020
       % exit

   The following shows smith telnetting  again  to  translator4
   and discarding his tokens.

       % telnet translator4.transarc.com
       . . .
       login: smith
       Password:
       AFS 3.2 (R) login
       % knfs nfs-client1.transarc.com 1020 -unlog
       % exit

PRIVILEGE REQUIRED

   None,  but  issuer  must  provide  correct  password(s) when
   obtaining tokens on translator machine.

MORE INFORMATION

   klog      login (AFS version) pagsh
