.\" Automatically generated by Pod::Man 4.09 (Pod::Simple 3.35) .\" .\" Standard preamble: .\" ======================================================================== .de Sp \" Vertical space (when we can't use .PP) .if t .sp .5v .if n .sp .. .de Vb \" Begin verbatim text .ft CW .nf .ne \\$1 .. .de Ve \" End verbatim text .ft R .fi .. .\" Set up some character translations and predefined strings. \*(-- will .\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left .\" double quote, and \*(R" will give a right double quote. \*(C+ will .\" give a nicer C++. Capital omega is used to do unbreakable dashes and .\" therefore won't be available. \*(C` and \*(C' expand to `' in nroff, .\" nothing in troff, for use with C<>. .tr \(*W- .ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p' .ie n \{\ . ds -- \(*W- . ds PI pi . if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch . if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\" diablo 12 pitch . ds L" "" . ds R" "" . ds C` "" . ds C' "" 'br\} .el\{\ . ds -- \|\(em\| . ds PI \(*p . ds L" `` . ds R" '' . ds C` . ds C' 'br\} .\" .\" Escape single quotes in literal strings from groff's Unicode transform. .ie \n(.g .ds Aq \(aq .el .ds Aq ' .\" .\" If the F register is >0, we'll generate index entries on stderr for .\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index .\" entries marked with X<> in POD. Of course, you'll have to process the .\" output yourself in some meaningful fashion. .\" .\" Avoid warning from groff about undefined register 'F'. .de IX .. .if !\nF .nr F 0 .if \nF>0 \{\ . de IX . tm Index:\\$1\t\\n%\t"\\$2" .. . if !\nF==2 \{\ . nr % 0 . nr F 2 . \} .\} .\" .\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2). .\" Fear. Run. Save yourself. No user-serviceable parts. . \" fudge factors for nroff and troff .if n \{\ . ds #H 0 . ds #V .8m . ds #F .3m . ds #[ \f1 . ds #] \fP .\} .if t \{\ . ds #H ((1u-(\\\\n(.fu%2u))*.13m) . ds #V .6m . ds #F 0 . ds #[ \& . ds #] \& .\} . \" simple accents for nroff and troff .if n \{\ . ds ' \& . ds ` \& . ds ^ \& . ds , \& . ds ~ ~ . ds / .\} .if t \{\ . ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u" . ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u' . ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u' . ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u' . ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u' . ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u' .\} . \" troff and (daisy-wheel) nroff accents .ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V' .ds 8 \h'\*(#H'\(*b\h'-\*(#H' .ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#] .ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H' .ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u' .ds th \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#] .ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#] .ds ae a\h'-(\w'a'u*4/10)'e .ds Ae A\h'-(\w'A'u*4/10)'E . \" corrections for vroff .if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u' .if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u' . \" for low resolution devices (crt and lpr) .if \n(.H>23 .if \n(.V>19 \ \{\ . ds : e . ds 8 ss . ds o a . ds d- d\h'-1'\(ga . ds D- D\h'-1'\(hy . ds th \o'bp' . ds Th \o'LP' . ds ae ae . ds Ae AE .\} .rm #[ #] #H #V #F C .\" ======================================================================== .\" .IX Title "KAS_SETPASSWORD 8" .TH KAS_SETPASSWORD 8 "2017-12-15" "OpenAFS" "AFS Command Reference" .\" For nroff, turn off justification. Always turn off hyphenation; it makes .\" way too many mistakes in technical documents. .if n .ad l .nh .SH "NAME" kas_setpassword \- Changes the key field in an Authentication Database entry .SH "SYNOPSIS" .IX Header "SYNOPSIS" \&\fBkas setpassword\fR \fB\-name\fR\ <\fIname\ of\ user\fR> [\fB\-new_password\fR\ <\fInew\ password\fR>] [\fB\-kvno\fR\ <\fIkey\ version\ number\fR>] [\fB\-admin_username\fR\ <\fIadmin\ principal\ to\ use\ for\ authentication\fR>] [\fB\-password_for_admin\fR\ <\fIadmin\ password\fR>] [\fB\-cell\fR\ <\fIcell\ name\fR>] [\fB\-servers\fR\ <\fIexplicit\ list\ of\ authentication\ servers\fR>+] [\fB\-noauth\fR] [\fB\-help\fR] .PP \&\fBkas setpasswd\fR \fB\-na\fR\ <\fIname\ of\ user\fR> [\fB\-ne\fR\ <\fInew\ password\fR>] [\fB\-k\fR\ <\fIkey\ version\ number\fR>] [\fB\-a\fR\ <\fIadmin\ principal\ to\ use\ for\ authentication\fR>] [\fB\-p\fR\ <\fIadmin\ password\fR>] [\fB\-c\fR\ <\fIcell\ name\fR>] [\fB\-s\fR\ <\fIexplicit\ list\ of\ authentication\ servers\fR>+] [\fB\-no\fR] [\fB\-h\fR] .PP \&\fBkas setp\fR \fB\-na\fR\ <\fIname\ of\ user\fR> [\fB\-ne\fR\ <\fInew\ password\fR>] [\fB\-k\fR\ <\fIkey\ version\ number\fR>] [\fB\-a\fR\ <\fIadmin\ principal\ to\ use\ for\ authentication\fR>] [\fB\-p\fR\ <\fIadmin\ password\fR>] [\fB\-c\fR\ <\fIcell\ name\fR>] [\fB\-s\fR\ <\fIexplicit\ list\ of\ authentication\ servers\fR>+] [\fB\-no\fR] [\fB\-h\fR] .PP \&\fBkas sp\fR \fB\-na\fR\ <\fIname\ of\ user\fR> [\fB\-ne\fR\ <\fInew\ password\fR>] [\fB\-k\fR\ <\fIkey\ version\ number\fR>] [\fB\-a\fR\ <\fIadmin\ principal\ to\ use\ for\ authentication\fR>] [\fB\-p\fR\ <\fIadmin\ password\fR>] [\fB\-c\fR\ <\fIcell\ name\fR>] [\fB\-s\fR\ <\fIexplicit\ list\ of\ authentication\ servers\fR>+] [\fB\-no\fR] [\fB\-h\fR] .SH "DESCRIPTION" .IX Header "DESCRIPTION" The \fBkas setpassword\fR command accepts a character string of unlimited length, scrambles it into a form suitable for use as an encryption key, places it in the key field of the Authentication Database entry named by the \fB\-name\fR argument, and assigns it the key version number specified by the \fB\-kvno\fR argument. .PP To avoid making the password string visible at the shell prompt, omit the \&\fB\-new_password\fR argument. Prompts then appear at the shell which do not echo the password visibly. .PP When changing the \fBafs\fR server key, also issue \fBbos addkey\fR command to add the key (with the same key version number) to the \&\fI/etc/openafs/server/KeyFile\fR file. See the \fIOpenAFS Administration Guide\fR for instructions. .PP The command interpreter checks the password string subject to the following conditions: .IP "\(bu" 4 If there is a program called kpwvalid in the same directory as the \fBkas\fR binary, the command interpreter invokes it to process the password. For details, see \fIkpwvalid\fR\|(8). .IP "\(bu" 4 If the \fB\-reuse\fR argument to the \fBkas setfields\fR command has been used to prohibit reuse of previous passwords, the command interpreter verifies that the password is not too similar too any of the user's previous 20 passwords. It generates the following error message at the shell: .Sp .Vb 1 \& Password was not changed because it seems like a reused password .Ve .Sp To prevent a user from subverting this restriction by changing the password twenty times in quick succession (manually or by running a script), use the \fB\-minhours\fR argument on the \fBkaserver\fR initialization command. The following error message appears if a user attempts to change a password before the minimum time has passed: .Sp .Vb 2 \& Password was not changed because you changed it too \& recently; see your systems administrator .Ve .SH "OPTIONS" .IX Header "OPTIONS" .IP "\fB\-name\fR <\fIname of user\fR>" 4 .IX Item "-name " Names the entry in which to record the new key. .IP "\fB\-new_password\fR <\fInew password\fR>" 4 .IX Item "-new_password " Specifies the character string the user types when authenticating to \&\s-1AFS.\s0 Omit this argument and type the string at the resulting prompts so that the password does not echo visibly. Note that some non-AFS programs cannot handle passwords longer than eight characters. .IP "\fB\-kvno\fR <\fIkey version number\fR>" 4 .IX Item "-kvno " Specifies the key version number associated with the new key. Provide an integer in the range from \f(CW0\fR through \f(CW255\fR. If omitted, the default is \&\f(CW0\fR (zero), which is probably not desirable for server keys. .IP "\fB\-admin_username\fR <\fIadmin principal\fR>" 4 .IX Item "-admin_username " Specifies the user identity under which to authenticate with the Authentication Server for execution of the command. For more details, see \&\fIkas\fR\|(8). .IP "\fB\-password_for_admin\fR <\fIadmin password\fR>" 4 .IX Item "-password_for_admin " Specifies the password of the command's issuer. If it is omitted (as recommended), the \fBkas\fR command interpreter prompts for it and does not echo it visibly. For more details, see \fIkas\fR\|(8). .IP "\fB\-cell\fR <\fIcell name\fR>" 4 .IX Item "-cell " Names the cell in which to run the command. For more details, see \&\fIkas\fR\|(8). .IP "\fB\-servers\fR <\fIauthentication servers\fR>+" 4 .IX Item "-servers +" Names each machine running an Authentication Server with which to establish a connection. For more details, see \fIkas\fR\|(8). .IP "\fB\-noauth\fR" 4 .IX Item "-noauth" Assigns the unprivileged identity \f(CW\*(C`anonymous\*(C'\fR to the issuer. For more details, see \fIkas\fR\|(8). .IP "\fB\-help\fR" 4 .IX Item "-help" Prints the online help for this command. All other valid options are ignored. .SH "EXAMPLES" .IX Header "EXAMPLES" In the following example, an administrator using the \f(CW\*(C`admin\*(C'\fR account changes the password for \f(CW\*(C`pat\*(C'\fR (presumably because \f(CW\*(C`pat\*(C'\fR forgot the former password or got locked out of his account in some other way). .PP .Vb 4 \& % kas setpassword pat \& Password for admin: \& new_password: \& Verifying, please re\-enter new_password: .Ve .SH "PRIVILEGE REQUIRED" .IX Header "PRIVILEGE REQUIRED" Individual users can change their own passwords. To change another user's password or the password (server encryption key) for server entries such as \f(CW\*(C`afs\*(C'\fR, the issuer must have the \f(CW\*(C`ADMIN\*(C'\fR flag set in his or her Authentication Database entry. .SH "SEE ALSO" .IX Header "SEE ALSO" \&\fIbos_addkey\fR\|(8), \&\fIkas\fR\|(8), \&\fIkaserver\fR\|(8), \&\fIkpwvalid\fR\|(8) .SH "COPYRIGHT" .IX Header "COPYRIGHT" \&\s-1IBM\s0 Corporation 2000. All Rights Reserved. .PP This documentation is covered by the \s-1IBM\s0 Public License Version 1.0. It was converted from \s-1HTML\s0 to \s-1POD\s0 by software written by Chas Williams and Russ Allbery, based on work by Alf Wachsmann and Elizabeth Cassell.