NAME

       bos_util - Manipulate the AFS server Keyfile

SYNOPSIS

       bos_util add <kvno>

       bos_util adddes <kvno>

       bos_util delete <kvno>

       bos_util list

DESCRIPTION

       The bos_util command manipulates the AFS server Keyfile. It can take a password from standard input,
       convert it to a key, and add it to the KeyFile; list the keys in the KeyFile; or remove a key from thet
       KeyFile. It is very similar in function to asetkey, but asetkey works with keytab files whereas bos_util
       works with passwords directly.

       bos_util expects one of the following subcommands:

       add <kvno>
           Add  a  key with key version <kvno> to the KeyFile using a password from standard input. This command
           uses the normal AFS password salt algorithm to generate the key (equivalent to  the  des-cbc-crc:afs3
           enctype in Kerberos v5). This command is basically equivalent to bos addkey.

       adddes <kvno>
           Add  a key with key version <kvno> to the KeyFile using a password from standard input.  This command
           does not salt the password when generating the key  (equivalent  to  the  des-cbc-crc:v4  enctype  in
           Kerberos v5).

           Since  this command applies no salt to the password, it can be used as a last resort for generating a
           DES key with a salt algorithm that other utilities don't know how to use by giving this  command  the
           pre-salted  password.  This  can be useful when, for example, using Microsoft Active Directory as the
           Kerberos KDC, since Active Directory uses a different salt algorithm for service principals than most
           Unix Kerberos implementations. The best approach, however, is to find a way to generate a keytab  and
           then use asetkey.

       delete <kvno>
           Delete the key with the specified key version from the KeyFile. This command is equivalent to asetkey
           delete or bos removekey.

       list
           List the keys in the KeyFile. This command is equivalent to asetkey list or bos listkeys.

       The  bos_util  command  does  not use the normal AFS option parsing library and its subcommands cannot be
       abbreviated.

CAUTIONS

       bos_util is intended for use with a Kerberos v4 environment and therefore is mostly  obsolete.  Normally,
       rather  than  using  this  command,  you  will  want  to  use ktutil to create a keytab (perhaps with its
       add_entry command) and then use asetkey as normal. bos_util only supports the AFS password salt algorithm
       and no password salt algorithm and therefore may not produce the  same  key  from  a  given  password  as
       Kerberos  v5 utilities unless one is careful to use that same salt algorithm when creating the key in the
       KDC.

       Creating an AFS key with a known password and then using bos_util or bos addkey to add that  key  to  the
       KeyFile  is not recommended.  Human-created passwords are usually not as strong as a random key generated
       using a good entropy source, such as with the -randkey option to the MIT Kerberos v5 kadmin ktadd command
       or the equivalent in other Kerberos v5 implementations. The security of AFS depends on  the  strength  of
       the AFS service key; it should therefore be as random as possible.

       It  is imperative that the key version number (kvno) given matches the kvno on the Kerberos server. If it
       doesn't, users won't be able to authenticate. The key generated by bos_util must also match the  internal
       representation on the Kerberos server including the salt.

OPTIONS

       bos_util takes no options.

PRIVILEGE REQUIRED

       The issuer must be logged onto a file server machine as the local superuser "root".

SEE ALSO

       asetkey(8), bos_addkey(8), bos_listkeys(8), bos_removekey(8), kadmin(8), ktutil(8)

COPYRIGHT

       Copyright 2007 Jason Edgecombe <jason@rampaginggeek.com>

       This  documentation  is  covered by the BSD License as written in the doc/LICENSE file. This man page was
       written by Jason Edgecombe for OpenAFS.

OpenAFS                                            2025-05-19                                        BOS_UTIL(8)