bos listkeys - Displays the server encryption keys from the KeyFile file

bos listkeys << -server <machine name >>> [-showkey] << [-cell <cell name] >>> [-noauth] [-localauth] [-help]

bos listk << -se <machine name >>> [-sh] << [-c <cell name] >>> [-n] [-l] [-h]

The bos listkeys command formats and displays the list of server encryption keys from the /etc/openafs/server/KeyFile file on the server machine named by the -server argument.

To edit the list of keys, use the bos addkey and bos removekey commands.

Displaying actual keys on the standard output stream (by including the -showkey flag) is a security exposure. Displaying a checksum is sufficient for most purposes.

Indicates the server machine from which to display the KeyFile file. Identify the machine by IP address or its host name (either fully-qualified or abbreviated unambiguously). For details, see the bos(8) manpage. For consistent performance in the cell, the output must be the same on every server machine. The bos addkey reference page explains how to keep the machines synchronized. Displays the octal digits that constitute each key. Names the cell in which to run the command. Do not combine this argument with the -localauth flag. For more details, see the bos(8) manpage. Assigns the unprivileged identity CWanonymous to the issuer. Do not combine this flag with the -localauth flag. For more details, see the bos(8) manpage. Constructs a server ticket using a key from the local /etc/openafs/server/KeyFile file. The bos command interpreter presents the ticket to the BOS Server during mutual authentication. Do not combine this flag with the -cell or -noauth options. For more details, see the bos(8) manpage. Prints the online help for this command. All other valid options are ignored.

The output includes one line for each server encryption key listed in the KeyFile file, identified by its key version number.

If the -showkey flag is included, the output displays the actual string of eight octal numbers that constitute the key. Each octal number is a backslash and three decimal digits.

If the -showkey flag is not included, the output represents each key as a checksum, which is a decimal number derived by encrypting a constant with the key.

Following the list of keys or checksums, the string CWKeys last changed indicates when a key was last added to the KeyFile file. The words CWAll done indicate the end of the output.

For mutual authentication to work properly, the output from the command CWkas examine afs must match the key or checksum with the same key version number in the output from this command.

The following example shows the checksums for the keys stored in the KeyFile file on the machine CWfs3.abc.com.

   % bos listkeys fs3.abc.com
   key 1 has cksum 972037177
   key 3 has cksum 2825175022
   key 4 has cksum 260617746
   key 6 has cksum 4178774593
   Keys last changed on Mon Apr 12 11:24:46 1999.
   All done.

   % bos listkeys fs6.abc.com -showkey
   key 0 is '\040\205\211\241\345\002\023\211'
   key 1 is '\343\315\307\227\255\320\135\244'
   key 2 is '\310\310\255\253\326\236\261\211'
   Keys last changed on Wed Mar 31 11:24:46 1999.
   All done.

The issuer must be listed in the /etc/openafs/server/UserList file on the machine named by the -server argument, or must be logged onto a server machine as the local superuser CWroot if the -localauth flag is included.

the KeyFile(5) manpage, the UserList(5) manpage, the bos_addkey(8) manpage, the bos_removekey(8) manpage, the bos_setauth(8) manpage, the kas_examine(8) manpage

IBM Corporation 2000. <http://www.ibm.com/> All Rights Reserved.

This documentation is covered by the IBM Public License Version 1.0. It was converted from HTML to POD by software written by Chas Williams and Russ Allbery, based on work by Alf Wachsmann and Elizabeth Cassell.