=head1 NAME

kaserver - Initializes the Authentication Server

=head1 SYNOPSIS

kaserver [B<-noAuth>]  [B<-fastKeys>]  [B<-database> I<dbpath>]
[B<-localfiles> I<lclpath>]  [B<-minhours> I<n>]
[B<-servers> I<serverlist>]  [B<-enable_peer_stats>]
[B<-enable_process_stats>]  [B<-help>]

This command does not use the syntax conventions of the AFS command
suites. Provide the command name and all option names in full.

=head1 DESCRIPTION

The C<kaserver> command initializes the Authentication Server, which runs
on every database server machine. In the conventional configuration,
its binary file is located in the B</usr/afs/bin> directory on a file
server machine.

The C<kaserver> command is not normally issued at the command shell
prompt but rather placed into a file server machine's
B</usr/afs/local/BosConfig> file with the C<bos create> command. If it is
ever issued at the command shell prompt, the issuer must be logged
onto a database server machine as the local superuser B<root>.

As it initializes, the Authentication Server process creates the two
files that constitute the Authentication Database, B<kaserver.DB0> and
B<kaserver.DBSYS1>, in the B</usr/afs/db> directory if they do not already
exist. Use the commands in the C<kas> suite to administer the database.

The Authentication Server is responsible for several aspects of AFS
security, including:

=over

=item *

Maintenance of all AFS server encryption keys and user passwords
in the Authentication Database.

=item *

Creation of the tickets and tokens that users and servers use to
establish secure connections. Its Ticket Granting Service (TGS)
component performs this function.

=back

The Authentication Server records a trace of its activity in the
B</usr/afs/logs/AuthLog> file. Use the C<bos getlog> command to display the
contents of the file. Use the C<kdb> command to read the protected files
associated with the B<AuthLog> file, B<AuthLog.dir> and B<AuthLog.pag>.

=head1 OPTIONS

=over 4

=item B<-noAuth>

Assigns the unprivileged identity B<anonymous> to the issuer.
Thus, it establishes an unauthenticated connection between the
issuer and the Authentication Server. It is useful only when
authorization checking is disabled on the database server
machine. In normal circumstances, the Authentication Server
allows only authorized (privileged) users to issue commands
that affect or contact the Authentication Database and will
refuse to perform such an action even if the B<-noAuth> flag is
used.

=item B<-fastKeys>

Is a test flag for use by the AFS Development staff; it serves
no functional purpose.

=item B<-database> I<dbpath>

Specifies the pathname of an alternate directory in which the
Authentication Database files reside. Provide the complete
pathname, ending in the base filename to which the B<.DB0> and
B<.DBSYS1> extensions are appended. For example, the appropriate
value for the default database files is B</usr/afs/db/kaserver>.

Provide the B<-localfiles> argument along with this one;
otherwise, the B<-localfiles> argument is also set to the value of
this argument, which is probably inappropriate.

=item B<-localfiles> I<lclpath>

Specifies the pathname of an alternate directory in which the
auxiliary Authentication Database file resides. Provide the
complete pathname, ending in the base filename to which the
B<auxdb> suffix is appended. For example, the appropriate value
for the default auxiliary database file is
B</usr/afs/local/C><kaserver>.

=item B<-minhours> I<n>

Specifies the minimum number of hours that must pass between
password changes made by any regular user. System
administrators (with the C<ADMIN> flag in their Authentication
Database entry) can change passwords as often as desired.
Setting a minimum time between password changes is not
recommended.

=item B<-servers> I<serverlist>

Names each database server machine running an Authentication
Server with which the local Authentication Server is to
synchronize its copy of the Authentication Database , rather
than with the machines listed in the local
B</usr/afs/etc/CellServDB> file.

=item B<-enable_peer_stats>

Activates the collection of Rx statistics and allocates memory
for their storage. For each connection with a specific UDP port
on another machine, a separate record is kept for each type of
RPC (FetchFile, GetStatus, and so on) sent or received. To
display or otherwise access the records, use the Rx Monitoring
API.

=item B<-enable_process_stats>

Activates the collection of Rx statistics and allocates memory
for their storage. A separate record is kept for each type of
RPC (FetchFile, GetStatus, and so on) sent or received,
aggregated over all connections to other machines. To display
or otherwise access the records, use the Rx Monitoring API.

=item B<-help>

Prints the online help for this command. All other valid
options are ignored.

=back

=head1 EXAMPLES

The following C<bos create> command creates a B<kaserver> process on
B<fs3.abc.com>:

B<    bos create S<-server fs3.abc.com> S<-instance kaserver>>
B<S<-type simple> S<-cmd /usr/afs/bin/kaserver>>

=head1 PRIVILEGE REQUIRED

The issuer must be logged in as the superuser B<root> on a file server
machine to issue the command at a command shell prompt. It is
conventional instead to create and start the process by issuing the
C<bos create> command.

=head1 COPYRIGHT

IBM Corporation 2000. <http://www.ibm.com/> All Rights Reserved.

Converted from html to pod by Alf Wachsmann <alfw@slac.stanford.edu>, 2003,
and Elizabeth Cassell <e_a_c@mailsnare.net>, 2004,
Stanford Linear Accelerator Center, a department of Stanford University.

=head1 SEE ALSO

L<AuthLog(1)>,
L<BosConfig(1)>,
L<CellServDB_server_version(1)>,
L<kaserver.DB0> and L<kaserver.DBSYS1>,
L<kaserverauxdb(1)>,
L<bos(1)>,
L<bos_create(1)>,
L<bos_getlog(1)>,
L<kas(1)>,
L<kdb(1)>

=cut
