OPENAFS-SA-2018-001 backup: use authenticated connection to butc

[openafs.git] / doc / man-pages / pod8 / backup.pod

diff --git a/doc/man-pages/pod8/backup.pod b/doc/man-pages/pod8/backup.pod
index 139ff23..0900fe6 100644 (file)
--- a/doc/man-pages/pod8/backup.pod
+++ b/doc/man-pages/pod8/backup.pod
@@ -72,6 +72,10 @@ Commands to obtain help:
 L<B<backup apropos>|backup_apropos(8)>
 and L<B<backup help>|backup_help(8)>.
 
+=item *
+
+A command to display the OpenAFS command suite version: B<backup version>.
+
 =back
 
 The backup command interpreter interacts with two other processes:
@@ -190,6 +194,18 @@ interactive mode. The local identity and AFS tokens with which the
 B<backup> command interpreter enters interactive mode apply to all
 commands issued during the interactive session.
 
+=item B<-nobutcauth>
+
+Prior to the fix for OPENAFS-SA-2018-001, B<butc> did not allow incoming
+connections to be authenticated.  As part of that fix, B<backup> was modified
+to authenticate to the B<butc> services when possible, but a B<backup> utility
+with the security fix will not interoperate with a B<butc> that lacks the fix
+unless this option is passed, which forces the use of unauthenticated
+connections to the B<butc>.  Use of this option is strongly disrecommended,
+and it is provided only for backwards compatibility in environments where
+B<backup> and B<butc> communicate over a secure network environment that denies
+access to untrusted parties.
+
 =item B<-portoffset> <I<TC port offset>>
 
 Specifies the port offset number of the Tape Coordinator that is to