kas examine                AFS Commands             kas examine


NAME

   kas  examine -- display  information from an Authentication

                       Database entry.


   kas examine  -name <name of user>
   [-admin_username <admin principal to use for
   authentication>]
   [-password_for_admin <admin password>]  [-cell <cell name>]
           [-servers <explicit list of authentication
           +
   servers> ]  [-noauth]
   [-help]

ACCEPTABLE ABBREVIATIONS/ALIASES

   kas e  -na <name of user>  [-a <admin principal to use for
   authentication>]
   [-p <admin password>]  [-c <cell name>]
                                                +
   [-s <explicit list of authentication servers> ]  [-no]  [-h]

DESCRIPTION

   Formats and displays  information  from  the  Authentication
   Database  entry  for  name.    See  the  OUTPUT  section for
   details.

ARGUMENTS

   -name             specifies the Database entry from which to
                     display information.

   -admin_username   specifies  the  user  name under which the
                     issuer wishes to perform the command.   If
                     the   issuer  does  not  provide  it,  the
                     current identity is used.  See section 4.3
                     in  the Reference Manual for more details.
                     -password_for_admin
                     specifies   the  issuer's  password.    If
                     provided here, the password is visible  on
                     the  screen.    If  the  issuer  does  not
                     provide it, it will be  prompted  for  and
                     not be visible on the screen.  See section
                     4.3  in  the  Reference  Manual  for  more
                     details.  -cell
                     specifies the cell in  which  to  run  the
                     command,  if  not  the  local  cell.   See
                     section 4.3 in the  Reference  Manual  for
                     more details.  -servers
                     specifies the database  server  machine(s)
                     with which to establish a connection.  See
                     section 4.3 in the  Reference  Manual  for
                     more details.  -noauth
                     establishes an unauthenticated  connection
                     between  the  Authentication  Servers  and
                     issuer, whom they assign the  unprivileged
                     identity  anonymous rather than attempting
                     mutual authentication.  See section 4.3 in



                     the  Reference  Manual  for  more details.
                     -help
                     prints  the  online help for this command.
                     Do not  provide  any  other  arguments  or
                     flags  with  this one.  See section 4.3 in
                     the Reference Manual for more details.



OUTPUT

   The output reports, in this order:

      - the name of the entry

      - one or more status flags, which will  only  appear
        if   a   system   administrator   has   used   the
        kas setfields command to change a  flag  from  its
        default  value.  A plus sign (+) will separate the
        flags if more than one appears.   The  non-default
        values which may appear, and their meanings, are:

           * ADMIN.      the  user  is  allowed  to  issue
             privileged kas commands (Default: NOADMIN.)

           * NOTGS.   the  Ticket  Granting  Service  will
             refuse to issue tickets to the user (Default:
             TGS.)

           * NOSEAL. the Ticket  Granting  Service  cannot
             use the contents of this entry's key field as
             an encryption key (Default: SEAL.)

           * NOCPW.  the  user  or  server  cannot  change
             his/her/its  own  password  or  key (Default:
             CPW.)

      - the word "key" followed by the key version  number
        in parentheses.

        The octal key itself appears only if authorization
        checking  is  disabled  on  the  database   server
        machine   to  which  the  kas examine  command  is
        directed  with  the  -servers  argument  (see  the
        EXAMPLES  section).    The  reasoning  behind this
        requirement is two-fold.  First, it  implies  that
        only  someone  authorized to issue the bos setauth
        command or with  "root"  access  to  the  database
        server  machine's local disk is able to see actual
        keys from the Authentication Database.  Second, it
        makes it clear that the system is in a compromised
        state of security while keys are  being  displayed
        on  the  screen.    Both turning off authorization
        checking and  displaying  keys  on  a  screen  are
        serious security risks.

        In the normal cases when authorization checking is
        enabled  on  the  database   server   machine,   a
        "checksum"  appears instead of the key.  This is a
        decimal number derived by  encrypting  a  constant
        with  the key.  In the case of the "afs" key, this
        number can be compared to the  checksum  with  the
        corresponding  key version number in the output of
        the bos listkeys command.

      - the  date  that  the  user  changed  his/her   own
        password,  indicated  as  "last cpw" (which stands
        for "last change of password")

      - the date on which the entry expires.  If this is a



        user   entry,   the   user   will   be  unable  to
        authenticate with the Authentication Server  after
        this date.

      - the maximum length of time that tickets issued for
        this entry may be valid

      - the date of the last modification  to  the  entry,
        indicated  as "last mod," and the user name of the
        person who issued the modifying command.  Password
        changes  made  by  the  user  himself/herself  are
        recorded as "last cpw" instead.

EXAMPLES

   In each of the examples, the password typed  at  the  prompt
   does not echo visibly.

   The  following shows the privileged user smith examining her
   own Authentication Database entry.   Note  the  ADMIN  flag,
   which shows that smith is privileged.

   % kas e smith
   Password for smith:
   User data for smith (ADMIN)
    key (0) cksum is 3414844392,  last cpw: Wed Jan 3 16:05:44
    entry expires on never. Max ticket lifetime 100.00 hours.
    last mod on Thu Dec 21 08:22:29 1989 by admin

   In  the  following  the  regular user terry examines her own
   entry and tries to examine pat's.

       % kas
       Password for terry:
       ka> ex terry
       User data for terry
        key (0) cksum is 529538018,  last cpw: Fri Jan 19 9
        entry expires on never. Max ticket lifetime 100.00
        last mod on Thu Dec 21 08:43:29 1989 by admin
       ka> ex pat
       kas:examine: caller not authorized getting informati


   In  the  following  an  administrator  logged  in   as   the
   privileged   user   admin   uses  bos setauth  to  turn  off
   authorization  checking  on  the  database  server   machine
   db1.transarc.com  so  that he can look at the key in the afs
   entry.  He enters interactive mode to open a connection with
   the  Authentication Server on db1.transarc.com only and uses
   the -noauth flag to prevent that server from  attempting  to
   authenticate him.

       % bos setauth db1.transarc.com off
       % kas i -servers db1.transarc.com -noauth
       ka> examine afs -servers db1.transarc.com
       User data for afs
        key (12): \357\253\304\352a\236\253\352, last cpw:
        entry expires on never. Max ticket lifetime 100.00
        last mod on Thu Jan 11 14:53:29 1990 by admin

PRIVILEGE REQUIRED



   A user may examine his or her own entry.  To examine others'
   entries, the issuer must have the ADMIN flag set in  his  or
   her Authentication Database entry.

   To  look  at  actual  keys,  authorization  checking must be
   disabled on the database server  machine  with  bos setauth,
   which  implies  being listed in /usr/afs/etc/UserList; it is
   not necessary to have the ADMIN flag in addition.

MORE INFORMATION

   bos listkeys

   bos setauth

   kas setfields
