3 bos_setrestricted - place a server in restricted mode
10 B<bos setrestricted> S<<< B<-server> <I<machine name>> >>> S<<< B<-mode> 1 >>>
11 S<<< [B<-cell> <I<cell name>>] >>> [B<-noauth>] [B<-localauth>] [B<-help>]
18 The B<bos restricted> command places the server in restricted mode. This
19 mode increases the security of the bos server by removing access to a
20 number of bos commands that are only used whilst configuring a system.
22 When a server is in restricted mode, access to B<bos_exec>, B<bos uninstall>,
23 B<bos install>, B<bos create>, B<bos install>, B<bos delete>, B<bos prune>
24 is denied, and the use of B<bos getlog> is limited.
28 Once a server has been placed in restricted mode, it may not be opened up
29 again using a remote command. That is, B<bos setrestricted> has no method
30 of setting an unrestricted mode. Once a server is restricted, it can only
31 be opened up again by sending it a SIGFPE, which must be done as root on
38 =item B<-server> <I<machine name>>
40 Indicates the server machine to restrict.
42 =item B<-cell> <I<cell name>>
44 Names the cell in which to run the command. Do not combine this argument
45 with the B<-localauth> flag. For more details, see L<bos(8)>.
49 Assigns the unprivileged identity C<anonymous> to the issuer. Do not
50 combine this flag with the B<-localauth> flag. For more details, see
55 Constructs a server ticket using a key from the local
56 F</usr/afs/etc/KeyFile> file. The B<bos> command interpreter presents the
57 ticket to the BOS Server during mutual authentication. Do not combine this
58 flag with the B<-cell> or B<-noauth> options. For more details, see
63 Prints the online help for this command. All other valid options are
68 =head1 PRIVILEGE REQUIRED
70 The issuer must be listed in the F</usr/afs/etc/UserList> file on the
71 machine named by the B<-server> argument, or must be logged in as the
72 local superuser C<root> if the B<-localauth> flag is included.
74 As noted above, this command cannot be run against servers which are
75 already in restricted mode.
83 Copyright 2009 Simon Wilkinson <simon@sxw.org.uk>
85 This documentation is covered by the BSD License as written in the
86 doc/LICENSE file. This man page was written by Simon Wilkinson for