=head1 NAME

bos removekey - Removes a server encryption key from the B</usr/afs/etc/KeyFile> file

=head1 SYNOPSIS

bos removekey B<-server> I<machine name>  B<-kvno> I<key version number> [I<key version number> ...]
[B<-cell> I<cell name>]  [B<-noauth>]  [B<-localauth>]  [B<-help>]

bos removek B<-s> I<machine name>  B<-k> I<key version number> [I<key version number> ...]
[B<-c> I<cell name>]  [B<-n>]  [B<-l>]  [B<-h>]

=head1 DESCRIPTION

The C<bos removekey> command removes each specified encryption key from
the B</usr/afs/etc/KeyFile> file on the machine named by the B<-server>
argument. Use the B<-kvno> argument to identify each key by its key
version number; use the C<bos listkeys> command to display the key
version numbers.

=head1 OPTIONS

=over 4

=item B<-server> I<machine name>

Indicates the server machine on which to change the
B</usr/afs/etc/KeyFile> file. Identify the machine by IP address
or its host name (either fully-qualified or abbreviated
unambiguously). For details, see the introductory reference
page for the C<bos> command suite.

In cells that run the United States edition of AFS and use the
Update Server to distribute the contents of the B</usr/afs/etc>
directory, it is conventional to specify only the system
control machine as a value for the B<-server> argument. In cells
that run the international version of AFS, repeat the command
for each file server machine. For further discussion, see the
introductory reference page for the C<bos> command suite.

=item B<-kvno> I<key version number> [I<key version number> ...]

Specifies the key version number of each key to remove.

=item B<-cell> I<cell name>

Names the cell in which to run the command. Do not combine this
argument with the B<-localauth> flag. For more details, see the
introductory L<bos(1)> reference page.

=item B<-noauth>

Assigns the unprivileged identity B<anonymous> to the issuer. Do
not combine this flag with the B<-localauth> flag. For more
details, see the introductory L<bos(1)> reference page.

=item B<-localauth>

Constructs a server ticket using a key from the local
B</usr/afs/etc/KeyFile> file. The C<bos> command interpreter presents
the ticket to the BOS Server during mutual authentication. Do
not combine this flag with the B<-cell> or B<-noauth> options. For
more details, see the introductory L<bos(1)> reference page.

=item B<-help>

Prints the online help for this command. All other valid
options are ignored.

=back

=head1 EXAMPLES

The following command removes the keys with key version numbers 5 and
6 from the B<KeyFile> file on the system control machine B<fs1.abc.com>.

    bos removekey -server fs1.abc.com -kvno 5 6

=head1 PRIVILEGE REQUIRED

The issuer must be listed in the B</usr/afs/etc/UserList> file on the
machine named by the B<-server> argument, or must be logged onto a server
machine as the local superuser B<root> if the B<-localauth> flag is
included.

=head1 CAVEATS

Before removing a obsolete key, verify that the cell's maximum ticket
lifetime has passed since the current key was defined using the C<kas
setpassword> and C<bos addkey> commands. This ensures that no clients
still possess tickets encrypted with the obsolete key.

=head1 COPYRIGHT

IBM Corporation 2000. <http://www.ibm.com/> All Rights Reserved.

Converted from html to pod by Alf Wachsmann <alfw@slac.stanford.edu>, 2003,
and Elizabeth Cassell <e_a_c@mailsnare.net>, 2004,
Stanford Linear Accelerator Center, a department of Stanford University.

=head1 SEE ALSO

L<KeyFile(1)>,
L<UserList(1)>,
L<bos(1)>,
L<bos_addkey(1)>,
L<bos_listkeys(1)>

=cut
