1 <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 4//EN">
3 <TITLE>Administration Guide</TITLE>
4 <!-- Begin Header Records ========================================== -->
5 <!-- /tmp/idwt3570/auagd000.scr converted by idb2h R4.2 (359) ID -->
6 <!-- Workbench Version (AIX) on 2 Oct 2000 at 11:42:14 -->
7 <META HTTP-EQUIV="updated" CONTENT="Mon, 02 Oct 2000 11:42:13">
8 <META HTTP-EQUIV="review" CONTENT="Tue, 02 Oct 2001 11:42:13">
9 <META HTTP-EQUIV="expires" CONTENT="Wed, 02 Oct 2002 11:42:13">
11 <!-- (C) IBM Corporation 2000. All Rights Reserved -->
12 <BODY bgcolor="ffffff">
13 <!-- End Header Records ============================================ -->
14 <A NAME="Top_Of_Page"></A>
15 <H1>Administration Guide</H1>
16 <HR><P ALIGN="center"> <A HREF="../index.htm"><IMG SRC="../books.gif" BORDER="0" ALT="[Return to Library]"></A> <A HREF="auagd002.htm#ToC"><IMG SRC="../toc.gif" BORDER="0" ALT="[Contents]"></A> <A HREF="auagd017.htm"><IMG SRC="../prev.gif" BORDER="0" ALT="[Previous Topic]"></A> <A HREF="#Bot_Of_Page"><IMG SRC="../bot.gif" BORDER="0" ALT="[Bottom of Topic]"></A> <A HREF="auagd019.htm"><IMG SRC="../next.gif" BORDER="0" ALT="[Next Topic]"></A> <A HREF="auagd026.htm#HDRINDEX"><IMG SRC="../index.gif" BORDER="0" ALT="[Index]"></A> <P>
18 <A NAME="IDX7736"></A>
19 <HR><H1><A NAME="HDRWQ491" HREF="auagd002.htm#ToC_572">Administering User Accounts</A></H1>
20 <P>This chapter explains how to create and maintain user
21 accounts in your cell.
22 <P>The preferred method for creating user accounts is the <B>uss</B>
23 program, which enables you to create multiple accounts with a single
24 command. See <A HREF="auagd017.htm#HDRWQ449">Creating and Deleting User Accounts with the uss Command Suite</A>. If you prefer to create each account
25 component individually, follow the instructions in <A HREF="#HDRWQ502">Creating AFS User Accounts</A>.
26 <HR><H2><A NAME="HDRWQ492" HREF="auagd002.htm#ToC_573">Summary of Instructions</A></H2>
27 <P>This chapter explains how to perform the following tasks by
28 using the indicated commands:
32 <TD ALIGN="LEFT" VALIGN="TOP" WIDTH="57%">Create Protection Database entry
33 </TD><TD ALIGN="LEFT" VALIGN="TOP" WIDTH="43%"><B>pts createuser</B>
35 <TD ALIGN="LEFT" VALIGN="TOP" WIDTH="57%">Create Authentication Database entry
36 </TD><TD ALIGN="LEFT" VALIGN="TOP" WIDTH="43%"><B>kas create</B>
38 <TD ALIGN="LEFT" VALIGN="TOP" WIDTH="57%">Create volume
39 </TD><TD ALIGN="LEFT" VALIGN="TOP" WIDTH="43%"><B>vos create</B>
41 <TD ALIGN="LEFT" VALIGN="TOP" WIDTH="57%">Mount volume
42 </TD><TD ALIGN="LEFT" VALIGN="TOP" WIDTH="43%"><B>fs mkmount</B>
44 <TD ALIGN="LEFT" VALIGN="TOP" WIDTH="57%">Create entry on ACL
45 </TD><TD ALIGN="LEFT" VALIGN="TOP" WIDTH="43%"><B>fs setacl</B>
47 <TD ALIGN="LEFT" VALIGN="TOP" WIDTH="57%">Examine Protection Database entry
48 </TD><TD ALIGN="LEFT" VALIGN="TOP" WIDTH="43%"><B>pts examine</B>
50 <TD ALIGN="LEFT" VALIGN="TOP" WIDTH="57%">Change directory ownership
51 </TD><TD ALIGN="LEFT" VALIGN="TOP" WIDTH="43%"><B>/etc/chown</B>
53 <TD ALIGN="LEFT" VALIGN="TOP" WIDTH="57%">Limit failed authentication attempts
54 </TD><TD ALIGN="LEFT" VALIGN="TOP" WIDTH="43%"><B>kas setfields</B> with <B>-attempts</B> and
57 <TD ALIGN="LEFT" VALIGN="TOP" WIDTH="57%">Unlock Authentication Database entry
58 </TD><TD ALIGN="LEFT" VALIGN="TOP" WIDTH="43%"><B>kas unlock</B>
60 <TD ALIGN="LEFT" VALIGN="TOP" WIDTH="57%">Set password lifetime
61 </TD><TD ALIGN="LEFT" VALIGN="TOP" WIDTH="43%"><B>kas setfields</B> with <B>-pwexpires</B>
63 <TD ALIGN="LEFT" VALIGN="TOP" WIDTH="57%">Prohibit password reuse
64 </TD><TD ALIGN="LEFT" VALIGN="TOP" WIDTH="43%"><B>kas setfields</B> with <B>-reuse</B>
66 <TD ALIGN="LEFT" VALIGN="TOP" WIDTH="57%">Change AFS password
67 </TD><TD ALIGN="LEFT" VALIGN="TOP" WIDTH="43%"><B>kas setpassword</B>
69 <TD ALIGN="LEFT" VALIGN="TOP" WIDTH="57%">List groups owned by user
70 </TD><TD ALIGN="LEFT" VALIGN="TOP" WIDTH="43%"><B>pts listowned</B>
72 <TD ALIGN="LEFT" VALIGN="TOP" WIDTH="57%">Rename Protection Database entry
73 </TD><TD ALIGN="LEFT" VALIGN="TOP" WIDTH="43%"><B>pts rename</B>
75 <TD ALIGN="LEFT" VALIGN="TOP" WIDTH="57%">Delete Authentication Database entry
76 </TD><TD ALIGN="LEFT" VALIGN="TOP" WIDTH="43%"><B>kas delete</B>
78 <TD ALIGN="LEFT" VALIGN="TOP" WIDTH="57%">Rename volume
79 </TD><TD ALIGN="LEFT" VALIGN="TOP" WIDTH="43%"><B>vos rename</B>
81 <TD ALIGN="LEFT" VALIGN="TOP" WIDTH="57%">Remove mount point
82 </TD><TD ALIGN="LEFT" VALIGN="TOP" WIDTH="43%"><B>fs rmmount</B>
84 <TD ALIGN="LEFT" VALIGN="TOP" WIDTH="57%">Delete Protection Database entry
85 </TD><TD ALIGN="LEFT" VALIGN="TOP" WIDTH="43%"><B>pts delete</B>
87 <TD ALIGN="LEFT" VALIGN="TOP" WIDTH="57%">List volume location
88 </TD><TD ALIGN="LEFT" VALIGN="TOP" WIDTH="43%"><B>vos listvldb</B>
90 <TD ALIGN="LEFT" VALIGN="TOP" WIDTH="57%">Remove volume
91 </TD><TD ALIGN="LEFT" VALIGN="TOP" WIDTH="43%"><B>vos remove</B>
94 <A NAME="IDX7737"></A>
95 <HR><H2><A NAME="HDRWQ494" HREF="auagd002.htm#ToC_574">The Components of an AFS User Account</A></H2>
96 <P>The differences between AFS and the UNIX file system imply
97 that a complete AFS user account is not the same as a UNIX user
98 account. The following list describes the components of an AFS
99 account. The same information appears in a corresponding section of <A HREF="auagd017.htm#HDRWQ449">Creating and Deleting User Accounts with the uss Command Suite</A>, but is repeated here for your convenience.
101 <P><LI>A <I>Protection Database entry</I> defines the username (the name
102 provided when authenticating with AFS), and maps it to an AFS user ID (AFS
103 UID), a number that the AFS servers use internally when referencing
104 users. The Protection Database also tracks the groups to which the user
105 belongs. For details, see <A HREF="auagd019.htm#HDRWQ531">Administering the Protection Database</A>.
106 <P><LI>An <I>Authentication Database entry</I> records the user's AFS
107 password in a scrambled form suitable for use as an encryption key.
108 <P><LI>A home <I>volume</I> stores all the files in the user's home
109 directory together on a single partition of a file server machine. The
110 volume has an associated <VAR>quota</VAR> that limits its size. For a
111 complete discussion of volumes, see <A HREF="auagd010.htm#HDRWQ174">Managing Volumes</A>.
112 <P><LI>A <I>mount point</I> makes the contents of the user's volume
113 visible and accessible in the AFS filespace, and acts as the user's home
114 directory. For more details about mount points, see <A HREF="auagd010.htm#HDRWQ183">About Mounting Volumes</A>.
115 <P><LI>Full access permissions on the home directory's <I>access control
116 list (ACL)</I> and ownership of the directory (as displayed by the UNIX
117 <B>ls -ld</B> command) enable the user to manage his or her files.
118 For details on AFS file protection, see <A HREF="auagd020.htm#HDRWQ562">Managing Access Control Lists</A>.
119 <P><LI>A <I>local password file entry</I> (in the <B>/etc/passwd</B> file
120 or equivalent) of each AFS client machine enables the user to log in and
121 access AFS files through the Cache Manager. A subsequent section in
122 this chapter further discusses local password file entries.
123 <P><LI>Other optional <I>configuration files</I> make the account more
124 convenient to use. Such files help the user log in and log out more
125 easily, receive electronic mail, print, and so on.
127 <A NAME="IDX7738"></A>
128 <A NAME="IDX7739"></A>
129 <HR><H2><A NAME="HDRWQ495" HREF="auagd002.htm#ToC_575">Creating Local Password File Entries</A></H2>
130 <P>To obtain authenticated access to a cell's AFS
131 filespace, a user must not only have a valid AFS token, but also an entry in
132 the local password file (<B>/etc/passwd</B> or equivalent) of the machine
133 whose Cache Manager is representing the user. This section discusses
134 why it is important for the user's AFS UID to match to the UNIX UID
135 listed in the local password file, and describes the appropriate value to put
136 in the file's password field.
137 <P>One reason to use <B>uss</B> commands is that they enable you to
138 generate local password file entries automatically as part of account
139 creation. See <A HREF="auagd017.htm#HDRWQ458">Creating a Common Source Password File</A>.
140 <P>Information similar to the information in this section appears in a
141 corresponding section of <A HREF="auagd017.htm#HDRWQ449">Creating and Deleting User Accounts with the uss Command Suite</A>, but is repeated here for your convenience
142 <P><H3><A NAME="HDRWQ496" HREF="auagd002.htm#ToC_576">Assigning AFS and UNIX UIDs that Match</A></H3>
143 <P>A user account is easiest to administer and use if the AFS
144 user ID number (AFS UID) and UNIX UID match. All instructions in the
145 AFS documentation assume that they do.
146 <P>The most basic reason to make AFS and UNIX UIDs the same is so that the
147 owner name reported by the UNIX <B>ls -l</B> and <B>ls -ld</B>
148 commands makes sense for AFS files and directories. Following standard
149 UNIX practice, the File Server records a number rather than a username in an
150 AFS file or directory's owner field: the owner's AFS
151 UID. When you issue the <B>ls -l</B> command, it translates the UID
152 to a username according to the mapping in the local password file, not the AFS
153 Protection Database. If the AFS and UNIX UIDs do not match, the <B>ls
154 -l</B> command reports an unexpected (and incorrect) owner. The
155 output can even vary on different client machines if their local password
156 files map the same UNIX UID to different names.
157 <P>Follow the recommendations in the indicated sections to make AFS and UNIX
158 UIDs match when creating accounts for various types of users:
160 <P><LI>If creating an AFS account for a user who already has a UNIX UID, see <A HREF="#HDRWQ499">Making UNIX and AFS UIDs Match</A>.
161 <P><LI>If some users in your cell have existing UNIX accounts but the user for
162 whom you are creating an AFS account does not, then it is best to allow the
163 Protection Server to allocate an AFS UID automatically. To avoid
164 overlap of AFS UIDs with existing UNIX UIDs, set the Protection
165 Database's <TT>max user id</TT> counter higher than the largest UNIX
166 UID, using the instructions in <A HREF="auagd019.htm#HDRWQ560">Displaying and Setting the AFS UID and GID Counters</A>.
167 <P><LI>If none of your users have existing UNIX accounts, allow the Protection
168 Server to allocate AFS UIDs automatically, starting either at its default or
169 at the value you have set for the <TT>max user id</TT> counter.
171 <A NAME="IDX7740"></A>
172 <A NAME="IDX7741"></A>
173 <P><H3><A NAME="HDRWQ497" HREF="auagd002.htm#ToC_577">Specifying Passwords in the Local Password File</A></H3>
174 <P>Authenticating with AFS is easiest for your users if you
175 install and configure an AFS-modified login utility, which logs a user into
176 the local file system and obtains an AFS token in one step. In this
177 case, the local password file no longer controls a user's ability to
178 login in most circumstances, because the AFS-modified login utility does not
179 consult the local password file if the user provides the correct AFS
180 password. You can nonetheless use a password file entry's password
181 field (usually, the second field) in the following ways to control login and
184 <P><LI>To prevent both local login and AFS authentication, place an asterisk ( *
185 ) in the field. This is useful mainly in emergencies, when you want to
186 prevent a certain user from logging into the machine.
187 <P><LI>To prevent login to the local file system if the user does not provide the
188 correct AFS password, place a character string of any length other than the
189 standard thirteen characters in the field. This is appropriate if you
190 want to allow only people with local AFS accounts to log into to your
191 machines. A single <B>X</B> or other character is the most easily
192 recognizable way to do this.
193 <P><LI>To enable a user to log into the local file system even after providing an
194 incorrect AFS password, record a standard UNIX encrypted password in the field
195 by issuing the standard UNIX password-setting command (<B>passwd</B> or
198 <P>If you do not use an AFS-modified login utility, you must place a standard
199 UNIX password in the local password file of every client machine the user will
200 use. The user logs into the local file system only, and then must issue
201 the <B>klog</B> command to authenticate with AFS. It is simplest if
202 the passwords in the local password file and the Authentication Database are
203 the same, but this is not required.
204 <A NAME="IDX7742"></A>
205 <A NAME="IDX7743"></A>
206 <HR><H2><A NAME="HDRWQ498" HREF="auagd002.htm#ToC_578">Converting Existing UNIX Accounts</A></H2>
207 <P>This section discusses the three main issues you need to
208 consider if your cell has existing UNIX accounts that you wish to convert to
210 <P><H3><A NAME="HDRWQ499" HREF="auagd002.htm#ToC_579">Making UNIX and AFS UIDs Match</A></H3>
211 <P>As previously mentioned, AFS users must have an entry in the
212 local password file on every client machine from which they access the AFS
213 filespace as an authenticated user. Both administration and use are
214 much simpler if the UNIX UID and AFS UID match. When converting
215 existing UNIX accounts, you have two alternatives:
217 <P><LI>Make the AFS UIDs match the existing UNIX UIDs. In this case, you
218 need to assign the AFS UID yourself by including the <B>-id</B> argument
219 to the <B>pts createuser</B> command as you create the AFS account.
221 <P>Because you are retaining the user's UNIX UID, you do not need to
222 alter the UID in the local password file entry. However, if you are
223 using an AFS-modified login utility, you possibly need to change the password
224 field in the entry. For a discussion of how the value in the password
225 field affects login with an AFS-modified login utility, see <A HREF="#HDRWQ497">Specifying Passwords in the Local Password File</A>.
226 <P>If now or in the future you need to create AFS accounts for users who do
227 not have an existing UNIX UID, then you must guarantee that new AFS UIDs do
228 not conflict with any existing UNIX UIDs. The simplest way is to set
229 the <TT>max user id</TT> counter in the Protection Database to a value
230 higher than the largest existing UNIX UID. See <A HREF="auagd019.htm#HDRWQ560">Displaying and Setting the AFS UID and GID Counters</A>.
231 <P><LI>Change the existing UNIX UIDs to match the new AFS UIDs that the
232 Protection Server assigns automatically.
233 <P>Allow the Protection Server to allocate the AFS UIDs automatically as you
234 create AFS accounts. You must then alter the user's entry in the
235 local password file on every client machine to include the new UID.
236 <P>There is one drawback to changing the UNIX UID: any files and
237 directories that the user owned in the local file system before becoming an
238 AFS user still have the former UID in their owner field. If you want
239 the <B>ls -l</B> and <B>ls -ld</B> commands to display the correct
240 owner, you must use the <B>chown</B> command to change the value to the
241 user's new UID, whether you are leaving the file in the local file system
242 or moving it to AFS. See <A HREF="#HDRWQ501">Moving Local Files into AFS</A>.
244 <P><H3><A NAME="HDRWQ500" HREF="auagd002.htm#ToC_580">Setting the Password Field Appropriately</A></H3>
245 <P>Existing UNIX accounts already have an entry in the local
246 password file, probably with a (scrambled) password in the password
247 field. You possibly need to change the value in the field, depending on
248 the type of login utility you use:
250 <P><LI>If the login utility is not modified for use with AFS, the actual password
251 must appear (in scrambled form) in the local password file entry.
252 <P><LI>If the login utility is modified for use with AFS, choose one of the
253 values discussed in <A HREF="#HDRWQ497">Specifying Passwords in the Local Password File</A>.
255 <P><H3><A NAME="HDRWQ501" HREF="auagd002.htm#ToC_581">Moving Local Files into AFS</A></H3>
256 <P>New AFS users with existing UNIX accounts probably already
257 own files and directories stored in a machine's local file system, and it
258 usually makes sense to transfer them into the new home volume. The
259 easiest method is to move them onto the local disk of an AFS client machine,
260 and then use the UNIX <B>mv</B> command to transfer them into the
261 user's new AFS home directory.
262 <P>As you move files and directories into AFS, keep in mind that the meaning
263 of their mode bits changes. AFS ignores the second and third sets of
264 mode bits (group and other), and does not use the first set (the owner bits)
265 directly, but only in conjunction with entries on the ACL (for details, see <A HREF="auagd020.htm#HDRWQ580">How AFS Interprets the UNIX Mode Bits</A>). Be sure that the ACL protects the file or directory
266 at least as securely as the mode bits.
267 <P>If you have chosen to change a user's UNIX UID to match a new AFS UID,
268 you must change the ownership of UNIX files and directories as well.
269 Only members of the <B>system:administrators</B> group can issue the
270 <B>chown</B> command on files and directories once they reside in
272 <HR><H2><A NAME="HDRWQ502" HREF="auagd002.htm#ToC_582">Creating AFS User Accounts</A></H2>
273 <P>There are two methods for creating user accounts. The
274 preferred method--using the <B>uss</B> commands--enables you to
275 create multiple accounts with a single command. It uses a template to
276 define standard values for the account components that are the same for each
277 user (such as quota), but provide differing values for more variable
278 components (such as username). See <A HREF="auagd017.htm#HDRWQ449">Creating and Deleting User Accounts with the uss Command Suite</A>.
279 <P>The second method involves issuing a separate command to create each
280 component of the account. It is best suited to creation of one account
281 at a time, since some of the commands can create only one instance of the
282 relevant component. To review the function of each component, see <A HREF="#HDRWQ494">The Components of an AFS User Account</A>.
283 <P>Use the following instructions to create any of the three types of user
284 account, which differ in their levels of functionality. For a
285 description of the types, see <A HREF="auagd007.htm#HDRWQ57">Configuring AFS User Accounts</A>.
287 <P><LI>To create an authentication-only account, perform Step <A HREF="#LIWQ504">1</A> through Step <A HREF="#LIWQ507">4</A> and also Step <A HREF="#LIWQ514">14</A>. This type of
288 account consists only of entries in the Authentication Database and Protection
290 <P><LI>To create a basic account, perform Step <A HREF="#LIWQ504">1</A> through Step <A HREF="#LIWQ510">8</A> and Step <A HREF="#LIWQ512">11</A> through Step <A HREF="#LIWQ514">14</A>.
291 In addition to Authentication Database and Protection Database entries, this
292 type of account includes a volume mounted at the home directory with owner and
293 ACL set appropriately.
294 <P><LI>To create a full account, perform all steps in the following
295 instructions. This type of account includes configuration files for
296 basic functions such as logging in, printing, and mail delivery, making it
297 more convenient and useful. For a discussion of some useful types of
298 configuration files, see <A HREF="auagd007.htm#HDRWQ60">Creating Standard Files in New AFS Accounts</A>.
300 <A NAME="IDX7744"></A>
301 <A NAME="IDX7745"></A>
302 <A NAME="IDX7746"></A>
303 <A NAME="IDX7747"></A>
304 <A NAME="IDX7748"></A>
305 <A NAME="IDX7749"></A>
306 <A NAME="IDX7750"></A>
307 <A NAME="IDX7751"></A>
308 <A NAME="IDX7752"></A>
309 <A NAME="IDX7753"></A>
310 <P><H3><A NAME="HDRWQ503" HREF="auagd002.htm#ToC_583">To create one user account with individual commands</A></H3>
312 <P><LI><A NAME="LIWQ504"></A>Decide on the value to assign to each of the following account
313 components. If you are creating an authentication-only account, you
314 need to pick only a username, AFS UID, and initial password.
316 <P><LI>The username. By convention, the names of many components of the
317 user account incorporate this name. For a discussion of restrictions
318 and suggested naming schemes, see <A HREF="auagd007.htm#HDRWQ58">Choosing Usernames and Naming Other Account Components</A>.
319 <P><LI>The AFS UID, if you want to assign a specific one. It is generally
320 best to have the Protection Server allocate one instead, except when you are
321 creating an AFS account for a user who already has an existing UNIX
322 account. In that case, migrating the user's files into AFS is
323 simplest if you set the AFS UID to match the existing UNIX UID. See <A HREF="#HDRWQ498">Converting Existing UNIX Accounts</A>.
324 <P><LI>The initial password. Advise the user to change this at the first
325 login, using the password changing instructions in the <I>IBM AFS User
327 <P><LI>The name of the user's home volume. The conventional name is
328 <B>user.</B><VAR>username</VAR> (for example,
330 <P><LI>The volume's site (disk partition on a file server machine).
331 Some cells designate certain machines or partitions for user volumes only, or
332 it possibly makes sense to place the volume on the emptiest partition that
333 meets your other criteria. To display the size and available space on a
334 partition, use the <B>vos partinfo</B> command, which is fully described
335 in <A HREF="auagd010.htm#HDRWQ185">Creating Read/write Volumes</A>.
336 <P><LI>The name of the user's home directory (the mount point for the home
337 volume). The conventional location is a directory (or one of a set of
338 directories) directly under the cell directory, such as
339 <B>/afs/</B><VAR>cellname</VAR><B>/usr</B>. For suggestions on
340 how to avoid the slowed directory lookup that can result from having large
341 numbers of user home directories in a single <B>usr</B> directory, see <A HREF="auagd017.htm#HDRWQ472">Evenly Distributing User Home Directories with the G Instruction</A>.
342 <P><LI>The volume's space quota. Include the <B>-maxquota</B>
343 argument to the <B>vos create</B> command, or accept the default quota of
345 <P><LI>The ACL on the home directory. By default, the ACL on every new
346 volume grants all seven permissions to the
347 <B>system:administrators</B> group. After volume creation,
348 use the <B>fs setacl</B> command to remove the entry if desired, and to
349 grant all seven permissions to the user.
351 <P><LI><A NAME="LIWQ505"></A>Authenticate as an AFS identity with all of the following
352 privileges. In the conventional configuration, the <B>admin</B>
353 user account has them, or you possibly have a personal administrative
354 account. (To increase cell security, it is best to create special
355 privileged accounts for use only while performing administrative
356 procedures; for further discussion, see <A HREF="auagd021.htm#HDRWQ584">An Overview of Administrative Privilege</A>.) If necessary, issue the <B>klog</B>
357 command to authenticate.
358 <PRE> % <B>klog</B> <VAR>admin_user</VAR>
359 Password: <VAR>admin_password</VAR>
361 <P>The following list specifies the necessary privileges and indicates how to
362 check that you have them.
364 <P><LI>Membership in the <B>system:administrators</B> group. If
365 necessary, issue the <B>pts membership</B> command, which is fully
366 described in <A HREF="auagd021.htm#HDRWQ587">To display the members of the system:administrators group</A>.
367 <PRE> % <B>pts membership system:administrators</B>
370 <P><LI>Inclusion in the <B>/usr/afs/etc/UserList</B> file. If
371 necessary, issue the <B>bos listusers</B> command, which is fully
372 described in <A HREF="auagd021.htm#HDRWQ593">To display the users in the UserList file</A>.
373 <PRE> % <B>bos listusers</B> <<VAR>machine name</VAR>>
375 <P><LI>The <TT>ADMIN</TT> flag on your Authentication Database entry.
376 However, the Authentication Server performs its own authentication, so in Step
377 <A HREF="#LIWQ507">4</A> you specify an administrative identity on the <B>kas</B>
379 <P><LI>The <B>i</B> (<B>insert</B>) and <B>a</B>
380 (<B>administer</B>) permissions on the ACL of the directory where you are
381 mounting the user's volume. If necessary, issue the <B>fs
382 listacl</B> command, which is fully described in <A HREF="auagd020.htm#HDRWQ572">Displaying ACLs</A>.
383 <PRE> % <B>fs listacl</B> [<<VAR>dir/file path</VAR>>]
385 <P>Members of the <B>system:administrators</B> group always
386 implicitly have the <B>a</B> (<B>administer</B>) and by default also
387 the <B>l</B> (<B>lookup</B>) permission on every ACL and can use the
388 <B>fs setacl</B> command to grant other rights as necessary.
389 <P><LI>Knowledge of the password for the local superuser <B>root</B>.
391 <A NAME="IDX7754"></A>
392 <A NAME="IDX7755"></A>
393 <P><LI><A NAME="LIWQ506"></A>Issue the <B>pts createuser</B> command to create an entry
394 in the Protection Database. For a discussion of setting AFS UIDs, see <A HREF="#HDRWQ496">Assigning AFS and UNIX UIDs that Match</A>. If you are converting an existing UNIX account into
395 an AFS account, also see <A HREF="#HDRWQ498">Converting Existing UNIX Accounts</A>.
396 <PRE> % <B>pts createuser</B> <<VAR>user name</VAR>> [<<VAR>user id</VAR>>]
401 </B><DD>Is an acceptable alias for <B>createuser</B> (and <B>createu</B>
402 is the shortest acceptable abbreviation).
403 <P><DT><B><VAR>user name</VAR>
404 </B><DD>Specifies the user's username (the character string typed at
405 login). It is best to limit the name to eight or fewer lowercase
406 letters, because many application programs impose that limit. The AFS
407 servers themselves accept names of up to 63 lowercase letters. Also
408 avoid the following characters: colon (<B>:</B>), semicolon
409 (<B>;</B>), comma (<B>,</B>), at sign (<B>@</B>), space,
410 newline, and the period (<B>.</B>), which is conventionally used
411 only in special administrative names.
412 <P><DT><B><VAR>user id</VAR>
413 </B><DD>Is optional and appropriate only if the user already has a UNIX UID that
414 the AFS UID must match. If you do not provide this argument, the
415 Protection Server assigns one automatically based on the counter described in <A HREF="auagd019.htm#HDRWQ560">Displaying and Setting the AFS UID and GID Counters</A>. If the ID you specify is less than <B>1</B>
416 (one) or is already in use, an error results.
418 <A NAME="IDX7756"></A>
419 <A NAME="IDX7757"></A>
420 <P><LI><A NAME="LIWQ507"></A>Issue the <B>kas create</B> command to create an entry in
421 the Authentication Database. To avoid having the user's temporary
422 initial password echo visibly on the screen, omit the
423 <B>-initial_password</B> argument; instead enter the password at the
424 prompts that appear when you omit the argument, as shown in the following
425 syntax specification.
426 <P>The Authentication Server performs its own authentication rather than
427 accepting your existing AFS token. By default, it authenticates your
428 local (UNIX) identity, which possibly does not correspond to an AFS-privileged
429 administrator. Include the <B>-admin</B> argument to name an
430 identity that has the <TT>ADMIN</TT> flag on its Authentication Database
431 entry. To verify that an entry has the flag, issue the <B>kas
432 examine</B> command as described in <A HREF="auagd021.htm#HDRWQ590">To check if the ADMIN flag is set</A>.
433 <PRE> % <B>kas create</B> <<VAR>name of user</VAR>> \
434 <B>-admin</B> <<VAR>admin principal to use for authentication</VAR>>
435 Administrator's (<VAR>admin_user</VAR>) password: <VAR>admin_password</VAR>
436 initial_password: <VAR>initial_password</VAR>
437 Verifying, please re-enter initial_password: <VAR>initial_password</VAR>
442 </B><DD>Is the shortest acceptable abbreviation for <B>create</B>.
443 <P><DT><B><VAR>name of user</VAR>
444 </B><DD>Specifies the same username as in Step <A HREF="#LIWQ506">3</A>.
446 </B><DD>Names an administrative account that has the <TT>ADMIN</TT> flag on its
447 Authentication Database entry, such as <B>admin</B>. The password
448 prompt echoes it as <VAR>admin_user</VAR>. Enter the appropriate password
449 as <VAR>admin_password</VAR>.
450 <P><DT><B><VAR>initial_password</VAR>
451 </B><DD>Specifies the initial password as a string of eight characters or less, to
452 comply with the length restriction that some applications impose.
453 Possible choices for an initial password include the username, a string of
454 digits from a personal identification number such as the Social Security
455 number, or a standard string such as <B>changeme</B>. Instruct the
456 user to change the string to a truly secret password as soon as possible by
457 using the <B>kpasswd</B> command as described in the <I>IBM AFS User
460 <A NAME="IDX7758"></A>
461 <A NAME="IDX7759"></A>
462 <P><LI><A NAME="LIWQ508"></A>Issue the <B>vos create</B> command to create the
464 <PRE> % <B>vos create</B> <<VAR>machine name</VAR>> <<VAR>partition name</VAR>> <<VAR>volume name</VAR>> \
465 [<B>-maxquota</B> <<VAR>initial quota (KB)</VAR>>]
470 </B><DD>Is the shortest acceptable abbreviation of <B>create</B>.
471 <P><DT><B><VAR>machine name</VAR>
472 </B><DD>Names the file server machine on which to place the new volume.
473 <P><DT><B><VAR>partition name</VAR>
474 </B><DD>Names the partition on which to place the new volume.
475 <P><DT><B><VAR>volume name</VAR>
476 </B><DD>Names the new volume. The name can include up to 22
477 characters. By convention, user volume names have the form
478 <B>user.</B><VAR>username</VAR>, where <VAR>username</VAR> is the name
479 assigned in Step <A HREF="#LIWQ506">3</A>.
481 </B><DD>Sets the volume's quota, as a number of kilobyte blocks. If
482 you omit this argument, the default is 5000 KB.
484 <A NAME="IDX7760"></A>
485 <A NAME="IDX7761"></A>
486 <P><LI><A NAME="LIWQ509"></A>Issue the <B>fs mkmount</B> command to mount the volume in
487 the filespace and create the user's home directory.
488 <PRE> % <B>fs mkmount</B> <<VAR>directory</VAR>> <<VAR>volume name</VAR>>
493 </B><DD>Is the shortest acceptable abbreviation for <B>mkmount</B>.
494 <P><DT><B><VAR>directory</VAR>
495 </B><DD>Names the mount point to create. A directory of the same name must
496 not already exist. Partial pathnames are interpreted relative to the
497 current working directory. By convention, user home directories are
498 mounted in a directory called something like
499 <B>/afs/.</B><VAR>cellname</VAR><B>/usr</B>, and the home
500 directory name matches the username assigned in Step <A HREF="#LIWQ506">3</A>.
501 <P>Specify the read/write path to the mount point, to avoid the failure that
502 results when you attempt to create the new mount point in a read-only
503 volume. By convention, you indicate the read/write path by placing a
504 period before the cell name at the pathname's second level (for example,
505 <B>/afs/.abc.com</B>). For further discussion of the
506 concept of read/write and read-only paths through the filespace, see <A HREF="auagd010.htm#HDRWQ209">The Rules of Mount Point Traversal</A>.
507 <P><DT><B><VAR>volume name</VAR>
508 </B><DD>Is the name of the volume created in Step <A HREF="#LIWQ508">5</A>.
510 <P><LI><B>(Optional)</B> Issue the <B>fs setvol</B> command with the
511 <B>-offlinemsg</B> argument to record auxiliary information about the
512 volume in its volume header. For example, you can record who owns the
513 volume or where you have mounted it in the filespace. To display the
514 information, use the <B>fs examine</B> command.
515 <PRE> % <B>fs setvol</B> <<VAR>dir/file path</VAR>> <B>-offlinemsg</B> <<VAR>offline message</VAR>>
520 </B><DD>Is an acceptable alias for <B>setvol</B> (and <B>setv</B> the
521 shortest acceptable abbreviation).
522 <P><DT><B><VAR>dir/file path</VAR>
523 </B><DD>Names the mount point of the volume with which to associate the
524 message. Partial pathnames are interpreted relative to the current
526 <P>Specify the read/write path to the mount point, to avoid the failure that
527 results when you attempt to change a read-only volume. By convention,
528 you indicate the read/write path by placing a period before the cell name at
529 the pathname's second level (for example,
530 <B>/afs/.abc.com</B>). For further discussion of the
531 concept of read/write and read-only paths through the filespace, see <A HREF="auagd010.htm#HDRWQ209">The Rules of Mount Point Traversal</A>.
532 <P><DT><B>-offlinemsg
533 </B><DD>Specifies up to 128 characters of auxiliary information to record in the
536 <P><LI><A NAME="LIWQ510"></A>Issue the <B>fs setacl</B> command to set the ACL on the
537 new home directory. At the least, create an entry that grants all
538 permissions to the user, as shown.
539 <P>You can also use the command to edit or remove the entry that the <B>vos
540 create</B> command automatically places on the ACL for a new volume's
541 root directory, which grants all permissions to the
542 <B>system:administrators</B> group. Keep in mind that even if
543 you remove the entry, the members of the group by default have implicit
544 <B>a</B> (<B>administer</B>) and by default <B>l</B>
545 (<B>lookup</B>) permissions on every ACL, and can grant themselves other
546 permissions as required.
547 <P>For detailed instructions for the <B>fs setacl</B> command, see <A HREF="auagd020.htm#HDRWQ573">Setting ACL Entries</A>.
548 <PRE> % <B>fs setacl</B> <<VAR>directory</VAR>> <B>-acl</B> <<VAR>user name</VAR>> <B>all</B> \
549 [<B>system:administrators</B> <VAR>desired_permissions</VAR>]
551 <P><LI><A NAME="LIWQ511"></A><B>(Optional)</B> Create configuration files and
552 subdirectories in the new home directory. Possibilities include
553 <B>.login</B> and <B>.logout</B> files, a
554 shell-initialization file such as <B>.cshrc</B>, files to help with
555 printing and mail delivery, and so on.
556 <P>If you are converting an existing UNIX account into an AFS account, you
557 possibly wish to move some files and directories into the user's new AFS
558 home directory. See <A HREF="#HDRWQ498">Converting Existing UNIX Accounts</A>.
559 <P><LI><B>(Optional)</B> In the new <B>.login</B> or shell
560 initialization file, define the user's $PATH environment variable to
561 include the directories where AFS binaries are kept (for example, the
562 <B>/usr/afsws/bin</B> and <B>/usr/afsws/etc</B> directories).
563 <P><LI><A NAME="LIWQ512"></A>In Step <A HREF="#LIWQ513">12</A> and Step <A HREF="#LIWQ514">14</A>, you must know the user's AFS
564 UID. If you had the Protection Server assign it in Step <A HREF="#LIWQ506">3</A>, you probably do not know it. If necessary, issue
565 the <B>pts examine</B> command to display it.
566 <PRE> % <B>pts examine</B> <<VAR>user or group name or id</VAR>>
571 </B><DD>Is the shortest acceptable abbreviation of <B>examine</B>.
572 <P><DT><B><VAR>user or group name or id</VAR>
573 </B><DD>Is the username that you assigned in Step <A HREF="#LIWQ506">3</A>.
575 <P>The first line of the output displays the username and AFS UID. For
576 further discussion and an example of the output, see <A HREF="auagd019.htm#HDRWQ536">Displaying Information from the Protection Database</A>.
577 <P><LI><A NAME="LIWQ513"></A>Designate the user as the owner of the home directory and any
578 files and subdirectories created or moved in Step <A HREF="#LIWQ511">9</A>. Specify the owner by the AFS UID you learned in Step
579 <A HREF="#LIWQ512">11</A> rather than by username. This is necessary for new
580 accounts because the user does not yet have an entry in your local
581 machine's password file (<B>/etc/passwd</B> or equivalent). If
582 you are converting an existing UNIX account, an entry possibly already exists,
583 but the UID is possibly incorrect. In that case, specifying a username
584 means that the corresponding (possibly incorrect) UID is recorded as the
586 <P>Some operating systems allow only the local superuser <B>root</B> to
587 issue the <B>chown</B> command. If necessary, issuing the
588 <B>su</B> command before the <B>chown</B> command.
589 <PRE> % <B>chown</B> <VAR>new_owner_ID</VAR> <VAR>directory</VAR>
593 <P><DT><B><VAR>new_owner_ID</VAR>
594 </B><DD>Is the user's AFS UID, which you learned in Step <A HREF="#LIWQ512">11</A>.
595 <P><DT><B><VAR>directory</VAR>
596 </B><DD>Names the home directory you created in Step <A HREF="#LIWQ509">6</A>, plus each subdirectory or file you created in Step <A HREF="#LIWQ511">9</A>.
598 <P><LI>If the new user home directory resides in a replicated volume, use the
599 <B>vos release</B> command to release the volume, as described in <A HREF="auagd010.htm#HDRWQ194">To replicate a read/write volume (create a read-only volume)</A>.
601 % <B>vos release</B> <<VAR>volume name or ID</VAR>>
604 <TABLE><TR><TD ALIGN="LEFT" VALIGN="TOP"><B>Note:</B></TD><TD ALIGN="LEFT" VALIGN="TOP">This step can be necessary even if the home directory's parent directory
605 is not itself a mount point for a replicated volume (and is easier to overlook
606 in that case). Suppose, for example, that the ABC Corporation puts the
607 mount points for user volumes in the <B>/afs/abc.com/usr</B>
608 directory. Because that is a regular directory rather than a mount
609 point, it resides in the <B>root.cell</B> volume mounted at the
610 <B>/afs/abc.com</B> directory. That volume is replicated, so
611 after changing it by creating a new mount point the administrator must issue
612 the <B>vos release</B> command.
614 <P><LI><A NAME="LIWQ514"></A>Create or modify an entry for the new user in the local
615 password file (<B>/etc/passwd</B> or equivalent) of each machine the user
616 can log onto. Remember to make the UNIX UID the same as the AFS UID you
617 learned in Step <A HREF="#LIWQ512">11</A>, and to fill the password field appropriately (for
618 instructions, see <A HREF="#HDRWQ497">Specifying Passwords in the Local Password File</A>).
619 <P>If you use the <B>package</B> utility to distribute a common version of
620 the password file to all client machines, then you need to make the change
621 only in the common version. See <A HREF="auagd016.htm#HDRWQ419">Configuring Client Machines with the package Program</A>.
623 <A NAME="IDX7762"></A>
624 <A NAME="IDX7763"></A>
625 <A NAME="IDX7764"></A>
626 <A NAME="IDX7765"></A>
627 <HR><H2><A NAME="HDRWQ515" HREF="auagd002.htm#ToC_584">Improving Password and Authentication Security</A></H2>
628 <P>AFS provides several optional features than can help to
629 protect your cell's filespace against unauthorized access. The
630 following list summarizes them, and instructions follow.
632 <P><LI>Limit the number of consecutive failed login attempts.
633 <P>One of the most common ways for an unauthorized user to access your
634 filespace is to guess an authorized user's password. This method
635 of attack is most dangerous if the attacker can use many login processes in
636 parallel or use the RPC interfaces directly.
637 <P>To protect against this type of attack, use the <B>-attempts</B>
638 argument to the <B>kas setfields</B> command to limit the number of times
639 that a user can consecutively fail to enter the correct password when using
640 either an AFS-modified login utility or the <B>klog</B> command.
641 When the limit is exceeded, the Authentication Server locks the user's
642 Authentication Database entry (disallows authentication attempts) for a period
643 of time that you define with the <B>-locktime</B> argument to the <B>kas
644 setfields</B> command. If desired, system administrators can use the
645 <B>kas unlock</B> command to unlock the entry before the complete lockout
647 <P>In certain circumstances, the mechanism used to enforce the number of
648 failed authentication attempts can cause a lockout even though the number of
649 failed attempts is less than the limit set by the <B>-attempts</B>
650 argument. Client-side authentication programs such as <B>klog</B>
651 and an AFS-modified login utility normally choose an Authentication Server at
652 random for each authentication attempt, and in case of a failure are likely to
653 choose a different Authentication Server for the next attempt. The
654 Authentication Servers running on the various database server machines do not
655 communicate with each other about how many times a user has failed to provide
656 the correct password to them. Instead, each Authentication Server
657 maintains its own separate copy of the auxiliary database file
658 <B>kaserverauxdb</B> (located in the <B>/usr/afs/local</B> directory
659 by default), which records the number of consecutive authentication failures
660 for each user account and the time of the most recent failure. This
661 implementation means that on average each Authentication Server knows about
662 only a fraction of the total number of failed attempts. The only way to
663 avoid allowing more than the number of attempts set by the
664 <B>-attempts</B> argument is to have each Authentication Server allow only
665 some fraction of the total. More specifically, if the limit on failed
666 attempts is <I>f</I>, and the number of Authentication Servers is
667 <I>S</I>, then each Authentication Server can only permit a number of
668 attempts equal to <I>f</I> divided by <I>S</I> (the Ubik
669 synchronization site for the Authentication Server tracks any remainder,
671 <P>Normally, this implementation does not reduce the number of allowed
672 attempts to less than the configured limit (<I>f</I>). If one
673 Authentication Server refuses an attempt, the client contacts another instance
674 of the server, continuing until either it successfully authenticates or has
675 contacted all of the servers. However, if one or more of the
676 Authentication Server processes is unavailable, the limit is effectively
677 reduced by a percentage equal to the quantity <I>U</I> divided by
678 <I>S</I>, where <I>U</I> is the number of unavailable servers and
679 <I>S</I> is the number normally available.
680 <P>To avoid the undesirable consequences of setting a limit on failed
681 authentication attempts, note the following recommendations:
683 <P><LI>Do not set the <B>-attempts</B> argument (the limit on failed
684 authentication attempts) too low. A limit of nine failed attempts is
685 recommended for regular user accounts, to allow three failed attempts per
686 Authentication Server in a cell with three database server machines.
687 <P><LI>Set fairly short lockout times when including the <B>-locktime</B>
688 argument. Although guessing passwords is a common method of attack, it
689 is not a very sophisticated one. Setting a lockout time can help
690 discourage attackers, but excessively long times are likely to be more of a
691 burden to authorized users than to potential attackers. A lockout time
692 of 25 minutes is recommended for regular user accounts.
693 <P><LI>Do not assign an infinite lockout time on an account (by setting the
694 <B>-locktime</B> argument to <B>0</B> [zero]) unless there is a highly
695 compelling reason. Such accounts almost inevitably become locked at
696 some point, because each Authentication Server never resets the account's
697 failure counter in its copy of the <B>kaauxdb</B> file (in contrast, when
698 the lockout time is not infinite, the counter resets after the specified
699 amount of time has passed since the last failed attempt to that Authentication
700 Server). Furthermore, the only way to unlock an account with an
701 infinite lockout time is for an administrator to issue the <B>kas
702 unlock</B> command. It is especially dangerous to set an infinite
703 lockout time on an administrative account; if all administrative accounts
704 become locked, the only way to unlock them is to shut down all instances of
705 the Authentication Server and remove the <B>kaauxdb</B> file on
708 <P>In summary, the recommended limit on authentication attempts is nine and
709 lockout time 25 minutes.
710 <P><LI>Limit password lifetime.
711 <P>The longer a password is in use, the more time an attacker has to try to
712 learn it. To protect against this type of attack, use the
713 <B>-pwexpires</B> argument to the <B>kas setfields</B> command to
714 limit how many days a user's password is valid. The user becomes
715 unable to authenticate with AFS after the password expires, but has up to 30
716 days to use the <B>kpasswd</B> command to set a new password. After
717 the 30 days pass, only an administrator who has the <TT>ADMIN</TT> flag on
718 the Authentication Database entry can change the password.
719 <P>If you set a password lifetime, many AFS-modified login utilities (but not
720 the <B>klog</B> command) set the PASSWORD_EXPIRES environment variable to
721 the number of days remaining until the password expires. A setting of
722 zero means that the password expires today. If desired, you can
723 customize your users' login scripts to display the number of days
724 remaining before expiration and even prompt for a password change when a small
725 number of days remain before expiration.
726 <P><LI>Prohibit reuse of passwords.
727 <P>Forcing users to select new passwords periodically is not effective if they
728 simply set the new password to the current value. To prevent a user
729 from setting a new password to a string similar to any of the last 20
730 passwords, use the <B>-reuse</B> argument to the <B>kas setfields</B>
732 <P>If you prohibit password reuse and the user specifies an excessively
733 similar password, the Authentication Server generates the following message to
735 <PRE> Password was not changed because it seems like a reused password
737 <P>A persistent user can try to bypass this restriction by changing the
738 password 20 times in quick succession (or running a script to do so).
739 If you believe this is likely to be a problem, you can include the
740 <B>-minhours</B> argument to the <B>kaserver</B> initialization
741 command (for details, see the command's reference page in the <I>IBM
742 AFS Administration Reference</I>. If the user attempts to change
743 passwords too frequently, the following message appears.
744 <PRE> Password was not changed because you changed it too recently; see
745 your systems administrator
747 <P><LI>Check the quality of new passwords.
748 <P>You can impose a minimum quality standard on passwords by writing a script
749 or program called <B>kpwvalid</B>. If the <B>kpwvalid</B> file
750 exists, the <B>kpasswd</B> and <B>kas setpassword</B> command
751 interpreters invoke it to check a new password. If the password does
752 not comply with the quality standard, the <B>kpwvalid</B> program returns
753 an appropriate code and the command interpreter rejects the password.
754 <P>The <B>kpwvalid</B> file must be executable, must reside in the same
755 AFS directory as the <B>kpasswd</B> and <B>kas</B> binaries, and its
756 directory's ACL must grant the <B>w</B> (<B>write</B>) permission
757 only to the <B>system:administrators</B> group.
758 <P>If you choose to write a <B>kpwvalid</B> program, consider imposing
759 standards such as the following.
761 <P><LI>A minimum length
762 <P><LI>Words found in the dictionary are prohibited
763 <P><LI>Numbers, punctuation, or both must appear along with letters
765 <P>The AFS distribution includes an example <B>kpwvalid</B>
766 program. See the <B>kpwvalid</B> reference page in the <I>IBM AFS
767 Administration Reference</I>.
769 <A NAME="IDX7766"></A>
770 <A NAME="IDX7767"></A>
771 <P><H3><A NAME="Header_585" HREF="auagd002.htm#ToC_585">To limit the number of consecutive failed authentication attempts</A></H3>
773 <P><LI>Issue the <B>kas setfields</B> command with the <B>-attempts</B>
774 and <B>-locktime</B> arguments.
775 <P>The Authentication Server performs its own authentication rather than
776 accepting your existing AFS token. By default, it authenticates your
777 local (UNIX) identity, which possibly does not correspond to an AFS-privileged
778 administrator. Include the <B>-admin</B> argument to name an
779 identity that has the <TT>ADMIN</TT> flag on its Authentication Database
780 entry. To verify that an entry has the flag, issue the <B>kas
781 examine</B> command as described in <A HREF="auagd021.htm#HDRWQ590">To check if the ADMIN flag is set</A>.
782 <PRE> % <B>kas setfields</B> <<VAR>name of user</VAR>> \
783 <B>-admin</B> <<VAR>admin principal to use for authentication</VAR>> \
784 <B>-attempts</B> <<VAR>maximum successive failed login tries ([0..254])</VAR>> \
785 <B>-locktime</B> <<VAR>failure penalty [hh:mm or minutes]</VAR>>
786 Administrator's (<VAR>admin_user</VAR>) password: <VAR>admin_password</VAR>
790 <P><DT><B><VAR>name of user</VAR>
791 </B><DD>Names the Authentication Database entry to edit.
793 </B><DD>Names an administrative account that has the <TT>ADMIN</TT> flag on its
794 Authentication Database entry, such as the <B>admin</B> account.
795 The password prompt echoes it as <VAR>admin_user</VAR>. Enter the
796 appropriate password as <VAR>admin_password</VAR>.
798 </B><DD>Specifies the maximum consecutive number of times that a user can fail to
799 provide the correct password during authentication (via the <B>klog</B>
800 command or an AFS-modified login utility) before the Authentication Server
801 refuses further attempts for the amount of time specified by the
802 <B>-locktime</B> argument. The range of valid values is
803 <B>0</B> (zero) through <B>254</B>. If you omit this argument
804 or specify <B>0</B>, the Authentication Server allows an unlimited number
806 <P><DT><B><B>-locktime</B>
807 </B><DD>Specifies how long the Authentication Server refuses authentication
808 attempts after the user exceeds the failure limit specified by the
809 <B>-attempts</B> argument.
810 <P>Specify a time in either hours and minutes (<VAR>hh</VAR>:<VAR>mm</VAR>)
811 or minutes only (<VAR>mm</VAR>), from the range <B>01</B> (one minute)
812 through <B>36:00</B> (36 hours). The <B>kas</B> command
813 interpreter automatically reduces any larger value to 36:00 and also
814 rounds up each nonzero value to the next-higher multiple of 8.5
816 <P>It is best not to provide a value of <B>0</B> (zero), especially on
817 administrative accounts, because it sets an infinite lockout time. An
818 administrator must always issue the <B>kas unlock</B> command to unlock
822 <P><H3><A NAME="Header_586" HREF="auagd002.htm#ToC_586">To unlock a locked user account</A></H3>
824 <P><LI>Issue the <B>kas</B> command to enter interactive mode.
825 <P>The Authentication Server performs its own authentication rather than
826 accepting your existing AFS token. By default, it authenticates your
827 local (UNIX) identity, which possibly does not correspond to an AFS-privileged
828 administrator. Include the <B>-admin</B> argument to name an
829 identity that has the <TT>ADMIN</TT> flag on its Authentication Database
830 entry. To verify that an entry has the flag, issue the <B>kas
831 examine</B> command as described in <A HREF="auagd021.htm#HDRWQ590">To check if the ADMIN flag is set</A>.
832 <PRE> % <B>kas -admin</B> <<VAR>admin principal to use for authentication</VAR>>
833 Administrator's (<VAR>admin_user</VAR>) password: <VAR>admin_password</VAR>
836 <P>where <B>-admin</B> names an administrative account that has the
837 <TT>ADMIN</TT> flag on its Authentication Database entry, such as
838 <B>admin</B>. The password prompt echoes it as
839 <VAR>admin_user</VAR>. Enter the appropriate password as
840 <VAR>admin_password</VAR>.
841 <P><LI>Issue the <B>(kas) examine</B> command to verify that the user's
842 account is in fact locked, as indicated by the message shown:
843 <PRE> ka> <B>examine</B> <<VAR>name of user</VAR>>
844 User is locked until <VAR>time</VAR>
846 <A NAME="IDX7768"></A>
847 <A NAME="IDX7769"></A>
848 <P><LI>Issue the <B>(kas) unlock</B> command to unlock the account.
849 <PRE> ka> <B>unlock</B> <<VAR>authentication ID</VAR>>
854 </B><DD>Is the shortest acceptable abbreviation of <B>unlock</B>.
855 <P><DT><B><VAR>authentication ID</VAR>
856 </B><DD>Names the Authentication Database entry to unlock.
859 <A NAME="IDX7770"></A>
860 <A NAME="IDX7771"></A>
861 <A NAME="IDX7772"></A>
862 <P><H3><A NAME="Header_587" HREF="auagd002.htm#ToC_587">To set password lifetime</A></H3>
864 <P><LI>Issue the <B>kas setfields</B> command with the <B>-pwexpires</B>
866 <P>The Authentication Server performs its own authentication rather than
867 accepting your existing AFS token. By default, it authenticates your
868 local (UNIX) identity, which possibly does not correspond to an AFS-privileged
869 administrator. Include the <B>-admin</B> argument to name an
870 identity that has the <TT>ADMIN</TT> flag on its Authentication Database
871 entry. To verify that an entry has the flag, issue the <B>kas
872 examine</B> command as described in <A HREF="auagd021.htm#HDRWQ590">To check if the ADMIN flag is set</A>.
873 <PRE> % <B>kas setfields</B> <<VAR>name of user</VAR>> \
874 <B>-pwexpires</B> <<VAR>number days password is valid [0..254])</VAR>> \
875 <B>-admin</B> <<VAR>admin principal to use for authentication</VAR>>
876 Administrator's (<VAR>admin_user</VAR>) password: <VAR>admin_password</VAR>
880 <P><DT><B><VAR>name of user</VAR>
881 </B><DD>Specifies the Authentication Database entry on which to impose a password
884 </B><DD>Sets the number of days after the user's password was last changed
885 that it remains valid. Provide an integer from the range <B>1</B>
886 through <B>254</B> to specify the number of days until expiration.
887 <P>When the password becomes invalid (expires), the user is unable to
888 authenticate, but has 30 more days in which to issue the <B>kpasswd</B> or
889 <B>kas setpassword</B> command to change the password (after that, only an
890 administrator can change it). Note that the clock starts at the time
891 the password was last changed, not when the <B>kas setfields</B> command
892 is issued. To avoid retroactive expiration, have the user change the
893 password just before issuing the command.
895 </B><DD>Names an administrative account that has the <TT>ADMIN</TT> flag on its
896 Authentication Database entry, such as <B>admin</B>. The password
897 prompt echoes it as <VAR>admin_user</VAR>. Enter the appropriate password
898 as <VAR>admin_password</VAR>.
901 <A NAME="IDX7773"></A>
902 <A NAME="IDX7774"></A>
903 <P><H3><A NAME="Header_588" HREF="auagd002.htm#ToC_588">To prohibit reuse of passwords</A></H3>
905 <P><LI>Issue the <B>kas setfields</B> command with the <B>-reuse</B>
907 <P>The Authentication Server performs its own authentication rather than
908 accepting your existing AFS token. By default, it authenticates your
909 local (UNIX) identity, which possibly does not correspond to an AFS-privileged
910 administrator. Include the <B>-admin</B> argument to name an
911 identity that has the <TT>ADMIN</TT> flag on its Authentication Database
912 entry. To verify that an entry has the flag, issue the <B>kas
913 examine</B> command as described in <A HREF="auagd021.htm#HDRWQ590">To check if the ADMIN flag is set</A>.
914 <PRE> % <B>kas setfields</B> <<VAR>name of user</VAR>> <B>-reuse</B> <<VAR> permit password reuse (yes/no)</VAR>> \
915 <B>-admin</B> <<VAR>admin principal to use for authentication</VAR>>
916 Administrator's (<VAR>admin_user</VAR>) password: <VAR>admin_password</VAR>
920 <P><DT><B><VAR>name of user</VAR>
921 </B><DD>Names the Authentication Database entry for which to set the password
924 </B><DD>Specifies whether the Authentication Server allows reuse of passwords
925 similar to any of the user's last 20 passwords. Specify the value
926 <B>no</B> to prohibit reuse, or the value <B>yes</B> to reinstate the
927 default of allowing password reuse.
929 </B><DD>Names an administrative account that has the <TT>ADMIN</TT> flag on its
930 Authentication Database entry, such as <B>admin</B>. The password
931 prompt echoes it as <VAR>admin_user</VAR>. Enter the appropriate password
932 as <VAR>admin_password</VAR>.
935 <A NAME="IDX7775"></A>
936 <A NAME="IDX7776"></A>
937 <A NAME="IDX7777"></A>
938 <HR><H2><A NAME="HDRWQ516" HREF="auagd002.htm#ToC_589">Changing AFS Passwords</A></H2>
939 <P>After setting an initial password during account creation,
940 you normally do not need to change user passwords, since they can use the
941 <B>kpasswd</B> command themselves by following the instructions in the
942 <I>IBM AFS User Guide</I>. In the rare event that a user forgets
943 the password or otherwise cannot log in, you can use the <B>kas
944 setpassword</B> command to set a new password.
945 <P>If entries in the local password file (<B>/etc/passwd</B> or
946 equivalent) have actual scrambled passwords in their password field, remember
947 to change the password there also. For further discussion, see <A HREF="#HDRWQ497">Specifying Passwords in the Local Password File</A>.
948 <A NAME="IDX7778"></A>
949 <A NAME="IDX7779"></A>
950 <P><H3><A NAME="Header_590" HREF="auagd002.htm#ToC_590">To change an AFS password</A></H3>
952 <P><LI>Issue the <B>kas setpassword</B> command to change the
953 password. To avoid having the new password echo visibly on the screen,
954 omit the <B>-new_password</B> argument; instead enter the password at
955 the prompts that appear when you omit the argument, as shown.
956 <P>The Authentication Server performs its own authentication rather than
957 accepting your existing AFS token. By default, it authenticates your
958 local (UNIX) identity, which possibly does not correspond to an AFS-privileged
959 administrator. Include the <B>-admin</B> argument to name an
960 identity that has the <TT>ADMIN</TT> flag on its Authentication Database
961 entry. To verify that an entry has the flag, issue the <B>kas
962 examine</B> command as described in <A HREF="auagd021.htm#HDRWQ590">To check if the ADMIN flag is set</A>.
963 <PRE> % <B>kas setpassword</B> <<VAR>name of user</VAR>> \
964 <B>-admin</B> <<VAR>admin principal to use for authentication</VAR>>
965 Administrator's (<VAR>admin_user</VAR>) password: <VAR>admin_password</VAR>
966 new_password: <VAR>new_password</VAR>
967 Verifying, please re-enter new_password: <VAR>new_password</VAR>
972 </B><DD>Is an acceptable alias for <B>setpassword</B> (<B>setp</B> is the
973 shortest acceptable abbreviation).
974 <P><DT><B><VAR>name of user</VAR>
975 </B><DD>Names the Authentication Database entry for which to set the
978 </B><DD>Names an administrative account that has the <TT>ADMIN</TT> flag on its
979 Authentication Database entry, such as <B>admin</B>. The password
980 prompt echoes it as <VAR>admin_user</VAR>. Enter the appropriate password
981 as <VAR>admin_password</VAR>.
982 <P><DT><B><VAR>new_password</VAR>
983 </B><DD>Specifies the user's new password. It is subject to the
984 restrictions imposed by the <B>kpwvalid</B> program, if you use it.
987 <HR><H2><A NAME="HDRWQ517" HREF="auagd002.htm#ToC_591">Displaying and Setting the Quota on User Volumes</A></H2>
988 <P>User volumes are like all other volumes with respect to
989 quota. Each new AFS volume has a default quota of 5000 KB, unless you
990 use the <B>-maxquota</B> argument to the <B>vos create</B> command to
991 set a different quota. You can also use either of the following
992 commands to change quota at any time:
994 <P><LI><B>fs setquota</B>
995 <P><LI><B>fs setvol</B>
997 <P>You can use any of the three following commands to display a volume's
1000 <P><LI><B>fs quota</B>
1001 <P><LI><B>fs listquota</B>
1002 <P><LI><B>fs examine</B>
1004 <P>For instructions, see <A HREF="auagd010.htm#HDRWQ234">Setting and Displaying Volume Quota and Current Size</A>.
1005 <A NAME="IDX7780"></A>
1006 <A NAME="IDX7781"></A>
1007 <A NAME="IDX7782"></A>
1008 <A NAME="IDX7783"></A>
1009 <A NAME="IDX7784"></A>
1010 <HR><H2><A NAME="HDRWQ518" HREF="auagd002.htm#ToC_592">Changing Usernames</A></H2>
1011 <P>By convention, many components of a user account incorporate
1012 the username, including the Protection and Authentication Database entries,
1013 the volume name and the home directory name. When changing a username,
1014 it is best to maintain consistency by changing the names of all components, so
1015 the procedure for changing a username has almost as many steps as the
1016 procedure for creating a new user account.
1017 <P><H3><A NAME="Header_593" HREF="auagd002.htm#ToC_593">To change a username</A></H3>
1019 <A NAME="IDX7785"></A>
1020 <A NAME="IDX7786"></A>
1021 <P><LI>Authenticate as an AFS identity with all of the following
1022 privileges. In the conventional configuration, the <B>admin</B>
1023 user account has them, or you possibly have a personal administrative
1024 account. (To increase cell security, it is best to create special
1025 privileged accounts for use only while performing administrative
1026 procedures; for further discussion, see <A HREF="auagd021.htm#HDRWQ584">An Overview of Administrative Privilege</A>.) If necessary, issue the <B>klog</B>
1027 command to authenticate.
1028 <PRE> % <B>klog</B> <VAR>admin_user</VAR>
1029 Password: <VAR>admin_password</VAR>
1031 <P>The following list specifies the necessary privileges and indicates how to
1032 check that you have them.
1034 <P><LI>Membership in the <B>system:administrators</B> group. If
1035 necessary, issue the <B>pts membership</B> command, which is fully
1036 described in <A HREF="auagd021.htm#HDRWQ587">To display the members of the system:administrators group</A>.
1037 <PRE> % <B>pts membership system:administrators</B>
1040 <P><LI>Inclusion in the <B>/usr/afs/etc/UserList</B> file. If
1041 necessary, issue the <B>bos listusers</B> command, which is fully
1042 described in <A HREF="auagd021.htm#HDRWQ593">To display the users in the UserList file</A>.
1043 <PRE> % <B>bos listusers</B> <<VAR>machine name</VAR>>
1045 <P><LI>The <TT>ADMIN</TT> flag on the Authentication Database entry.
1046 However, the Authentication Server performs its own authentication, so the
1047 following instructions direct you to specify an administrative identity on the
1048 <B>kas</B> command line itself.
1049 <P><LI>The <B>a</B> (<B>administer</B>), <B>d</B>
1050 (<B>delete</B>), and <B>i</B> (<B>insert</B>) permissions on the
1051 ACL of the directory where you are removing the current mount point and
1052 creating a new one. If necessary, issue the <B>fs listacl</B>
1053 command, which is fully described in <A HREF="auagd020.htm#HDRWQ572">Displaying ACLs</A>.
1054 <PRE> % <B>fs listacl</B> [<<VAR>dir/file path</VAR>>]
1056 <P>Members of the <B>system:administrators</B> group always
1057 implicitly have the <B>a</B> (<B>administer</B>) and by default also
1058 the <B>l</B> (<B>lookup</B>) permission on every ACL and can use the
1059 <B>fs setacl</B> command to grant other rights as necessary.
1061 <P><LI><A NAME="LIWQ519"></A>Issue the <B>pts listowned</B> command to display the names
1062 of the groups the user owns. After you change the username in the
1063 Protection Database in Step <A HREF="#LIWQ520">3</A>, you must issue the <B>pts rename</B> command to change
1064 each group's owner prefix to match the new name, because the Protection
1065 Server does not automatically make this change. For a complete
1066 description of the <B>pts listowned</B> command, see <A HREF="auagd019.htm#HDRWQ536">Displaying Information from the Protection Database</A>.
1067 <PRE> % <B>pts listowned</B> <<VAR>user or group name or id</VAR>>
1069 <P><LI><A NAME="LIWQ520"></A>Issue the <B>pts rename</B> command to change the
1070 user's name in the Protection Database.
1071 <PRE> % <B>pts rename</B> <<VAR>old name</VAR>> <<VAR>new name</VAR>>
1073 <P><LI>Issue the <B>pts rename</B> command to change the group names you
1074 noted in Step <A HREF="#LIWQ519">2</A>, so that their owner prefix (the part of the group name
1075 before the colon) accurately reflects the owner's new name.
1076 <P>Repeat the command for each group. Step <A HREF="#LIWQ520">3</A> details its syntax.
1077 <PRE> % <B>pts rename</B> <<VAR>old name</VAR>> <<VAR>new name</VAR>>
1079 <P><LI>Issue the <B>kas</B> command to enter interactive mode.
1080 <P>The Authentication Server performs its own authentication rather than
1081 accepting your existing AFS token. By default, it authenticates your
1082 local (UNIX) identity, which possibly does not correspond to an AFS-privileged
1083 administrator. Include the <B>-admin</B> argument to name an
1084 identity that has the <TT>ADMIN</TT> flag on its Authentication Database
1085 entry. To verify that an entry has the flag, issue the <B>kas
1086 examine</B> command as described in <A HREF="auagd021.htm#HDRWQ590">To check if the ADMIN flag is set</A>.
1087 <PRE> % <B>kas -admin</B> <<VAR>admin principal to use for authentication</VAR>>
1088 Administrator's (<VAR>admin_user</VAR>) password: <VAR>admin_password</VAR>
1091 <P>where <B>-admin</B> names an administrative account that has the
1092 <TT>ADMIN</TT> flag on its Authentication Database entry, such as
1093 <B>admin</B>. The password prompt echoes it as
1094 <VAR>admin_user</VAR>. Enter the appropriate password as
1095 <VAR>admin_password</VAR>.
1096 <A NAME="IDX7787"></A>
1097 <A NAME="IDX7788"></A>
1098 <P><LI>Issue the <B>(kas) delete</B> command to delete the user's
1099 existing Authentication Database entry.
1101 <PRE> ka> <B>delete</B> <<VAR>name of user</VAR>>
1106 </B><DD>Is the shortest acceptable abbreviation for <B>delete</B>, or you can
1107 use the alias <B>rm</B>.
1108 <P><DT><B><VAR>name of user</VAR>
1109 </B><DD>Names the Authentication Database entry to delete.
1111 <A NAME="IDX7789"></A>
1112 <A NAME="IDX7790"></A>
1113 <P><LI>Issue the <B>(kas) create</B> command to create an Authentication
1114 Database entry for the new username. To avoid having the user's
1115 password echo visibly on the screen, do not include the
1116 <B>-initial_password</B> argument; instead enter the password at the
1117 prompts that appear in that case, as shown in the following syntax
1119 <PRE> ka> <B>create</B> <<VAR>name of user</VAR>>
1120 initial_password: <VAR>password</VAR>
1121 Verifying, please re-enter initial_password: <VAR>password</VAR>
1126 </B><DD>Is the shortest acceptable abbreviation for <B>create</B>.
1127 <P><DT><B><VAR>name of user</VAR>
1128 </B><DD>Specifies the new username.
1129 <P><DT><B><VAR>password</VAR>
1130 </B><DD>Specifies the password for the new user account. If the user is
1131 willing to tell you his or her current password, you can retain it.
1132 Otherwise, provide a string of eight characters or less to comply with the
1133 length restriction that some applications impose. Possible choices for
1134 an initial password include the username, a string of digits from a personal
1135 identification number such as the Social Security number, or a standard string
1136 such as <B>changeme</B>. Instruct the user to change the string to
1137 a truly secret password as soon as possible by using the <B>kpasswd</B>
1138 command as instructed in the <I>IBM AFS User Guide</I>.
1140 <P><LI>Issue the <B>quit</B> command to leave interactive mode.
1141 <PRE> ka> <B>quit</B>
1143 <A NAME="IDX7791"></A>
1144 <A NAME="IDX7792"></A>
1145 <A NAME="IDX7793"></A>
1146 <A NAME="IDX7794"></A>
1147 <A NAME="IDX7795"></A>
1148 <P><LI><A NAME="LIWQ521"></A>Issue the <B>vos rename</B> command to change the name of
1149 the user's volume. For complete syntax, see <A HREF="auagd010.htm#HDRWQ246">To rename a volume</A>.
1150 <PRE> % <B>vos rename</B> <<VAR>old volume name</VAR>> <<VAR>new volume name</VAR>>
1152 <A NAME="IDX7796"></A>
1153 <A NAME="IDX7797"></A>
1154 <A NAME="IDX7798"></A>
1155 <A NAME="IDX7799"></A>
1156 <A NAME="IDX7800"></A>
1157 <P><LI><A NAME="LIWQ522"></A>Issue the <B>fs rmmount</B> command to remove the existing
1158 mount point. For the <VAR>directory</VAR> argument, specify the
1159 read/write path to the mount point, to avoid the failure that results when you
1160 attempt to delete a mount point from a read-only volume.
1161 <PRE> % <B>fs rmmount</B> <<VAR>directory</VAR>>
1163 <A NAME="IDX7801"></A>
1164 <A NAME="IDX7802"></A>
1165 <A NAME="IDX7803"></A>
1166 <P><LI><A NAME="LIWQ523"></A>Issue the <B>fs mkmount</B> command to create a mount point
1167 for the volume's new name. Specify the read/write path to the
1168 mount point for the <VAR>directory</VAR> argument, as in the previous
1169 step. For complete syntax, see Step <A HREF="#LIWQ509">6</A> in <A HREF="#HDRWQ503">To create one user account with individual commands</A>.
1170 <PRE> % <B>fs mkmount</B> <<VAR>directory</VAR>> <<VAR>volume name</VAR>>
1172 <P><LI>If the changes you made in Step <A HREF="#LIWQ522">10</A> and Step <A HREF="#LIWQ523">11</A> are to a mount point that resides in a
1173 replicated volume, use the <B>vos release</B> command to release the
1174 volume, as described in <A HREF="auagd010.htm#HDRWQ194">To replicate a read/write volume (create a read-only volume)</A>.
1176 % <B>vos release</B> <<VAR>volume name or ID</VAR>>
1179 <TABLE><TR><TD ALIGN="LEFT" VALIGN="TOP"><B>Note:</B></TD><TD ALIGN="LEFT" VALIGN="TOP">This step can be necessary even if the home directory's parent directory
1180 is not itself a mount point for a replicated volume (and is easier to overlook
1181 in that case). For example, the ABC Corporation template puts the mount
1182 points for user volumes in the <B>/afs/abc.com/usr</B>
1183 directory. Because that is a regular directory rather than a mount
1184 point, it resides in the <B>root.cell</B> volume mounted at the
1185 <B>/afs/abc.com</B> directory. That volume is replicated, so
1186 after changing it the administrator must issue the <B>vos release</B>
1190 <HR><H2><A NAME="HDRWQ524" HREF="auagd002.htm#ToC_594">Removing a User Account</A></H2>
1191 <A NAME="IDX7804"></A>
1192 <A NAME="IDX7805"></A>
1193 <P>Before removing an account, it is best to make a backup copy of the
1194 user's home volume on a permanent storage medium such as tape. If
1195 you need to remove several accounts, it is probably more efficient to use the
1196 <B>uss delete</B> command instead; see <A HREF="auagd017.htm#HDRWQ486">Deleting Individual Accounts with the uss delete Command</A>.
1197 <P><H3><A NAME="Header_595" HREF="auagd002.htm#ToC_595">To remove a user account</A></H3>
1199 <P><LI>Authenticate as an AFS identity with all of the following
1200 privileges. In the conventional configuration, the <B>admin</B>
1201 user account has them, or you possibly have a personal administrative
1202 account. (To increase cell security, it is best to create special
1203 privileged accounts for use only while performing administrative
1204 procedures; for further discussion, see <A HREF="auagd021.htm#HDRWQ584">An Overview of Administrative Privilege</A>.) If necessary, issue the <B>klog</B>
1205 command to authenticate.
1206 <PRE> % <B>klog</B> <VAR>admin_user</VAR>
1207 Password: <VAR>admin_password</VAR>
1209 <P>The following list specifies the necessary privileges and indicates how to
1210 check that you have them.
1212 <P><LI>Membership in the <B>system:administrators</B> group. If
1213 necessary, issue the <B>pts membership</B> command, which is fully
1214 described in <A HREF="auagd021.htm#HDRWQ587">To display the members of the system:administrators group</A>.
1215 <PRE> % <B>pts membership system:administrators</B>
1218 <P><LI>Inclusion in the <B>/usr/afs/etc/UserList</B> file. If
1219 necessary, issue the <B>bos listusers</B> command, which is fully
1220 described in <A HREF="auagd021.htm#HDRWQ593">To display the users in the UserList file</A>.
1221 <PRE> % <B>bos listusers</B> <<VAR>machine name</VAR>>
1223 <P><LI>The <TT>ADMIN</TT> flag on the Authentication Database entry.
1224 However, the Authentication Server performs its own authentication, so the
1225 following instructions direct you to specify an administrative identity on the
1226 <B>kas</B> command line itself.
1227 <P><LI>The <B>d</B> (<B>delete</B>) permission on the ACL of the
1228 directory where you are removing the user volume's mount point. If
1229 necessary, issue the <B>fs listacl</B> command, which is fully described
1230 in <A HREF="auagd020.htm#HDRWQ572">Displaying ACLs</A>.
1231 <PRE> % <B>fs listacl</B> [<<VAR>dir/file path</VAR>>]
1233 <P>Members of the <B>system:administrators</B> group always
1234 implicitly have the <B>a</B> (<B>administer</B>) and by default also
1235 the <B>l</B> (<B>lookup</B>) permission on every ACL and can use the
1236 <B>fs setacl</B> command to grant other rights as necessary.
1238 <P><LI><B>(Optional)</B> If it is possible you need to restore the
1239 user's account someday, note the username and AFS UID, possibly in a file
1240 designated for that purpose. You can later restore the account with its
1242 <P><LI><B>(Optional)</B> Copy the contents of the user's volume to
1243 tape. You can use the <B>vos dump</B> command as described in <A HREF="auagd010.htm#HDRWQ240">Dumping and Restoring Volumes</A> or the AFS Backup System as described in <A HREF="auagd012.htm#HDRWQ296">Backing Up Data</A>.
1244 <P><LI><A NAME="LIWQ525"></A><B>(Optional)</B> If you intend to remove groups that the
1245 user owns from the Protection Database after removing the user's entry,
1246 issue the <B>pts listowned</B> command to display them. For
1247 complete instructions, see <A HREF="auagd019.htm#HDRWQ536">Displaying Information from the Protection Database</A>.
1248 <PRE> % <B>pts listowned</B> <<VAR>user or group name or id</VAR>>
1250 <P><LI><A NAME="LIWQ526"></A>(<B>Optional)</B> Issue the <B>pts delete</B> command
1251 to remove the groups the user owns. However, if it is likely that other
1252 users have placed the groups on the ACLs of directories they own, it is best
1254 <PRE> % <B>pts delete</B> <<VAR>user or group name or id</VAR>><SUP>+</SUP>
1259 </B><DD>Is the shortest acceptable abbreviation for <B>delete</B>.
1260 <P><DT><B><VAR>user or group name or id</VAR>
1261 </B><DD>Specifies the name or AFS UID of each group displayed in the output from
1262 Step <A HREF="#LIWQ525">4</A>.
1264 <A NAME="IDX7806"></A>
1265 <A NAME="IDX7807"></A>
1266 <A NAME="IDX7808"></A>
1267 <P><LI>Issue the <B>kas delete</B> command to remove the user's
1268 Authentication Database entry.
1269 <P>The Authentication Server performs its own authentication rather than
1270 accepting your existing AFS token. By default, it authenticates your
1271 local (UNIX) identity, which possibly does not correspond to an AFS-privileged
1272 administrator. Include the <B>-admin</B> argument to name an
1273 identity that has the <TT>ADMIN</TT> flag on its Authentication Database
1274 entry. To verify that an entry has the flag, issue the <B>kas
1275 examine</B> command as described in <A HREF="auagd021.htm#HDRWQ590">To check if the ADMIN flag is set</A>.
1276 <PRE> % <B>kas delete</B> <<VAR>name of user</VAR>> \
1277 <B>-admin</B> <<VAR>admin principal to use for authentication</VAR>>
1278 Administrator's (<VAR>admin_user</VAR>) password: <VAR>admin_password</VAR>
1283 </B><DD>Is the shortest acceptable abbreviation for <B>delete</B>.
1284 <P><DT><B><VAR>name of user</VAR>
1285 </B><DD>Names the Authentication Database entry to delete.
1287 </B><DD>Names an administrative account that has the <TT>ADMIN</TT> flag on its
1288 Authentication Database entry, such as <B>admin</B>. The password
1289 prompt echoes it as <VAR>admin_user</VAR>. Enter the appropriate password
1290 as <VAR>admin_password</VAR>.
1292 <P><LI><A NAME="LIWQ527"></A>Issue the <B>vos listvldb</B> command to display the site
1293 of the user's home volume in preparation for removing it. By
1294 convention, user volumes are named
1295 <B>user</B>.<VAR>username</VAR>.
1296 <PRE> % <B>vos listvldb</B> <<VAR>volume name or ID</VAR>>
1301 </B><DD>Is the shortest acceptable abbreviation of <B>listvldb</B>.
1302 <P><DT><B><VAR>volume name or ID</VAR>
1303 </B><DD>Specifies the volume's name or volume ID number.
1305 <A NAME="IDX7809"></A>
1306 <A NAME="IDX7810"></A>
1307 <A NAME="IDX7811"></A>
1308 <A NAME="IDX7812"></A>
1309 <P><LI><A NAME="LIWQ528"></A>Issue the <B>vos remove</B> command to remove the
1310 user's volume. It automatically removes the backup version of the
1311 volume, if it exists. It is not conventional to replicate user volumes,
1312 so the command usually also completely removes the volume's entry from
1313 the Volume Location Database (VLDB). If there are ReadOnly replicas of
1314 the volume, you must repeat the <B>vos remove</B> command to remove each
1316 <PRE> % <B>vos remove</B> <<VAR>machine name</VAR>> <<VAR>partition name</VAR>> <<VAR>volume name or ID</VAR>>
1321 </B><DD>Is the shortest acceptable abbreviation of <B>remove</B>.
1322 <P><DT><B><VAR>machine name</VAR>
1323 </B><DD>Names the file server machine that houses the volume, as specified in the
1324 output from Step <A HREF="#LIWQ527">7</A>.
1325 <P><DT><B><VAR>partition name</VAR>
1326 </B><DD>Names the partition that houses the volume, as specified in the output
1327 from Step <A HREF="#LIWQ527">7</A>.
1328 <P><DT><B><VAR>volume name or ID</VAR>
1329 </B><DD>Specifies the volume's name or ID number.
1331 <A NAME="IDX7813"></A>
1332 <A NAME="IDX7814"></A>
1333 <A NAME="IDX7815"></A>
1334 <A NAME="IDX7816"></A>
1335 <P><LI><A NAME="LIWQ529"></A>Issue the <B>fs rmmount</B> command to remove the
1336 volume's mount point.
1337 <P>If you mounted the user's backup volume as a subdirectory of the home
1338 directory, then this command is sufficient to unmount the backup version as
1339 well. If you mounted the backup version at an unrelated location in the
1340 filespace, repeat the <B>fs rmmount</B> command for it.
1341 <PRE> % <B>fs rmmount</B> <<VAR>directory</VAR>>
1346 </B><DD>Is the shortest acceptable abbreviation of <B>rmmount</B>.
1347 <P><DT><B><VAR>directory</VAR>
1348 </B><DD>Names the mount point for the volume's previous name (the former home
1349 directory). Partial pathnames are interpreted relative to the current
1351 <P>Specify the read/write path to the mount point, to avoid the failure that
1352 results when you attempt to delete a mount point from a read-only
1353 volume. By convention, you indicate the read/write path by placing a
1354 period before the cell name at the pathname's second level (for example,
1355 <B>/afs/.abc.com</B>). For further discussion of the
1356 concept of read/write and read-only paths through the filespace, see <A HREF="auagd010.htm#HDRWQ208">Mounting Volumes</A>.
1358 <A NAME="IDX7817"></A>
1359 <A NAME="IDX7818"></A>
1360 <A NAME="IDX7819"></A>
1361 <A NAME="IDX7820"></A>
1362 <P><LI><A NAME="LIWQ530"></A>Issue the <B>pts delete</B> command to remove the
1363 user's Protection Database entry. A complete description of this
1364 command appears in Step <A HREF="#LIWQ526">5</A>.
1365 <PRE> % <B>pts delete</B> <<VAR>user or group name or id</VAR>>
1367 <P><LI>If the deleted user home directory resided in a replicated volume, use the
1368 <B>vos release</B> command to release the volume, as described in <A HREF="auagd010.htm#HDRWQ194">To replicate a read/write volume (create a read-only volume)</A>.
1370 % <B>vos release</B> <<VAR>volume name or ID</VAR>>
1373 <TABLE><TR><TD ALIGN="LEFT" VALIGN="TOP"><B>Note:</B></TD><TD ALIGN="LEFT" VALIGN="TOP">This step can be necessary even if the home directory's parent directory
1374 is not itself a mount point for a replicated volume (and is easier to overlook
1375 in that case). For example, the ABC Corporation template puts the mount
1376 points for user volumes in the <B>/afs/abc.com/usr</B>
1377 directory. Because that is a regular directory rather than a mount
1378 point, it resides in the <B>root.cell</B> volume mounted at the
1379 <B>/afs/abc.com</B> directory. That volume is replicated, so
1380 after changing it by deleting a mount point the administrator must issue the
1381 <B>vos release</B> command.
1384 <HR><P ALIGN="center"> <A HREF="../index.htm"><IMG SRC="../books.gif" BORDER="0" ALT="[Return to Library]"></A> <A HREF="auagd002.htm#ToC"><IMG SRC="../toc.gif" BORDER="0" ALT="[Contents]"></A> <A HREF="auagd017.htm"><IMG SRC="../prev.gif" BORDER="0" ALT="[Previous Topic]"></A> <A HREF="#Top_Of_Page"><IMG SRC="../top.gif" BORDER="0" ALT="[Top of Topic]"></A> <A HREF="auagd019.htm"><IMG SRC="../next.gif" BORDER="0" ALT="[Next Topic]"></A> <A HREF="auagd026.htm#HDRINDEX"><IMG SRC="../index.gif" BORDER="0" ALT="[Index]"></A> <P>
1385 <!-- Begin Footer Records ========================================== -->
1387 <br>© <A HREF="http://www.ibm.com/">IBM Corporation 2000.</A> All Rights Reserved
1389 <!-- End Footer Records ============================================ -->
1390 <A NAME="Bot_Of_Page"></A>
git://git.openafs.org / openafs.git / blob