BOS_LISTKEYS(8) AFS Command Reference BOS_LISTKEYS(8)
bos_listkeys - Displays the server encryption keys from the KeyFile file
bos listkeys -server <machine name> [-showkey]
[-cell <cell name>] [-noauth] [-localauth] [-help]
bos listk -se <machine name> [-sh] [-c <cell name>]
[-n] [-l] [-h]
The bos listkeys command formats and displays the list of server encryption keys from the /etc/openafs/server/KeyFile file on the server
machine named by the -server argument. It is equivalent to asetkey list, but can be run remotely.
To edit the list of keys, use the asetkey command; see asetkey(8) for more information. You can also remove keys remotely using the bos
removekey command. If you are using the Authentication Server (kaserver) rather than a Kerberos v5 KDC, use the bos addkey command instead
of asetkey to add a new key.
Displaying actual keys on the standard output stream (by including the -showkey flag) is a security exposure. Displaying a checksum is
sufficient for most purposes.
-server <machine name>
Indicates the server machine from which to display the KeyFile file. Identify the machine by IP address or its host name (either fully-
qualified or abbreviated unambiguously). For details, see bos(8).
For consistent performance in the cell, the output must be the same on every server machine. asetkey(8) explains how to keep the
Displays the octal digits that constitute each key. Anyone who has access to the resulting output will have complete access to the AFS
cell and will be able to impersonate the AFS cell to any client, so be very careful when using this option.
-cell <cell name>
Names the cell in which to run the command. Do not combine this argument with the -localauth flag. For more details, see bos(8).
Assigns the unprivileged identity "anonymous" to the issuer. Do not combine this flag with the -localauth flag. For more details, see
Constructs a server ticket using a key from the local /etc/openafs/server/KeyFile file. The bos command interpreter presents the ticket
to the BOS Server during mutual authentication. Do not combine this flag with the -cell or -noauth options. For more details, see
Prints the online help for this command. All other valid options are ignored.
The output includes one line for each server encryption key listed in the KeyFile file, identified by its key version number.
If the -showkey flag is included, the output displays the actual string of eight octal numbers that constitute the key. Each octal number
is a backslash and three decimal digits.
If the -showkey flag is not included, the output represents each key as a checksum, which is a decimal number derived by encrypting a
constant with the key.
Following the list of keys or checksums, the string "Keys last changed" indicates when a key was last added to the KeyFile file. The words
"All done" indicate the end of the output.
For mutual authentication to work properly, the output from the command "kas examine afs" must match the key or checksum with the same key
version number in the output from this command.
The following example shows the checksums for the keys stored in the KeyFile file on the machine "fs3.abc.com".
% bos listkeys fs3.abc.com
key 1 has cksum 972037177
key 3 has cksum 2825175022
key 4 has cksum 260617746
key 6 has cksum 4178774593
Keys last changed on Mon Apr 12 11:24:46 1999.
The following example shows the actual keys from the KeyFile file on the machine "fs6.abc.com".
% bos listkeys fs6.abc.com -showkey
key 0 is '