=head1 NAME

pts - Interface to the AFS Protection Server

=head1 SYNOPSIS

pts I<command> [I<options> ...]

=head1 DESCRIPTION

The commands in the pts command suite are the administrative interface to
the Protection Server, which runs on each database server machine in a
cell and maintains the Protection Database.  The database stores the
information that AFS uses to augment and refine the standard UNIX scheme
for controlling access to files and directories.

Instead of relying only on the mode bits that define access rights for
individual files, AFS associates an access control list (ACL) with each
directory.  The ACL lists users and groups and specifies which of seven
possible access permissions they have for the directory and the files it
contains.  (It is still possible to set a directory or file's mode bits,
but AFS interprets them in its own way; see the chapter on protection in
the AFS Administration Guide for details.)

AFS enables users to define groups in the Protection Database and place
them on ACLs to extend a set of rights to multiple users simultaneously.
Groups simplify administration by making it possible to add someone to
many ACLs by adding them to a group that already exists on those ACLs.
Machines can also be members of a group, so that users logged into the
machine automatically inherit the permissions granted to the group.

There are several categories of commands in the pts command suite:

=over 4

=item *

Commands to create and remove Protection Database entries:  C<pts
creategroup>, C<pts createuser>, and C<pts delete>

=item *

Commands to administer and display group membership:  C<pts adduser>,
C<pts listowned>, C<pts membership>, and C<pts removeuser>.

=item *

Commands to administer and display properties of user and group entries
other than membership:  C<pts chown>, C<pts examine>, C<pts listentries>,
C<pts rename>, and C<pts setfields>.

=item *

Commands to set and examine the counters used when assigning IDs to users
and groups:  C<pts listmax> and C<pts setmax>.

=item *

Commands to obtain help:  C<pts apropos> and C<pts help>.

=back

All of these commands are described in separate manual pages.

=head1 OPTIONS

The following arguments and flags are available on many commands in the
pts suite.  The reference page for each command also lists them, but they
are described here in greater detail.

=over 4

=item B<-cell> I<cell-name>

Names the cell in which to run the command.  It is acceptable to
abbreviate the cell name to the shortest form that distinguishes it from
the other entries in the F</usr/vice/etc/CellServDB> file on the local
machine.  If the B<-cell> argument is omitted, the command interpreter
determines the name of the local cell by reading the following in order:

=over 4

=item 1.

The value of the AFSCELL environment variable.

=item 2.

The local F</usr/vice/etc/ThisCell> file.

=back

=item B<-force>

Enables the command to continue executing as far as possible when errors
or other problems occur, rather than halting execution immediately.
Without it, the command halts as soon as the first error is encountered.
In either case, the pts command interpreter reports errors at the command
shell.  This flag is especially useful if the issuer provides many values
for a command line argument; if one of them is invalid, the command
interpreter continues on to process the remaining arguments.

=item B<-help>

Prints a command's online help message to standard output.  Do not combine
this flag with any of the command's other options; when it is provided,
the command interpreter ignores all other options, and only prints the
help message.

=item B<-noauth>

Establishes an unauthenticated connection to the Protection Server, in
which the server treats the issuer as the unprivileged user anonymous.  It
is useful only when authorization checking is disabled on the server
machine (during the installation of a file server machine or when the bos
setauth command has been used during other unusual circumstances).  In
normal circumstances, the Protection Server allows only privileged users
to issue commands that change the Protection Database, and refuses to
perform such an action even if the B<-noauth> flag is provided.

=back

The individual pts subcommands take many other flags which vary from
command to command.  See their individual documentation for details.

=head1 PRIVILEGE REQUIRED

Members of the system:administrators group can issue all pts commands on
any entry in the Protection Database.

Users who do not belong to the system:administrators group can list
information about their own entry and any group entries they own.  The
privacy flags set with the C<pts setfields> command control access to
entries owned by other users.

=head1 SEE ALSO

L<pts_adduser(1)>,
L<pts_apropos(1)>,
L<pts_chown(1)>,
L<pts_creategroup(1)>,
L<pts_createuser(1)>,
L<pts_delete(1)>,
L<pts_examine(1)>,
L<pts_help(1)>,
L<pts_listentries(1)>,
L<pts_listmax(1)>,
L<pts_listowned(1)>,
L<pts_membership(1)>,
L<pts_removeuser(1)>,
L<pts_rename(1)>,
L<pts_setfields(1)>,
L<pts_setmax(1)>

=cut
