Section: AFS Command Reference (8)
bos removekey - Removes a server encryption key from the KeyFile file
<key version number
+ >>> << [-cell
bos removek << -s <machine name >>> << -k <key version number+ >>>
<< [-c <cell name] >>> [-n] [-l] [-h]
The bos removekey
command removes each specified encryption key fromthe /usr/afs/etc/KeyFile
file on the machine named by the -server
argument. Use the -kvno
argument to identify each key by its keyversion number; use the bos listkeys
command to display the key versionnumbers.
Before removing a obsolete key, verify that the cell's maximum ticketlifetime has passed since the current key was defined using the kassetpassword
and bos addkey
commands. This ensures that no clientsstill possess tickets encrypted with the obsolete key.
- -server <machine name>
- Indicates the server machine on which to change the/usr/afs/etc/KeyFile file. Identify the machine by IP address or itshost name (either fully-qualified or abbreviated unambiguously). Fordetails, see the bos(8) manpage.
In cells that use the Update Server to distribute the contents of the/usr/afs/etc directory, it is conventional to specify only the systemcontrol machine as a value for the -server argument. Otherwise, repeatthe command for each file server machine. For further discussion, seethe bos(8) manpage.
- -kvno <key version number>+
- Specifies the key version number of each key to remove.
- -cell <cell name>
- Names the cell in which to run the command. Do not combine this argumentwith the -localauth flag. For more details, see the bos(8) manpage.
- Assigns the unprivileged identity anonymous to the issuer. Do notcombine this flag with the -localauth flag. For more details, seethe bos(8) manpage.
- Constructs a server ticket using a key from the local/usr/afs/etc/KeyFile file. The bos command interpreter presents theticket to the BOS Server during mutual authentication. Do not combine thisflag with the -cell or -noauth options. For more details, seethe bos(8) manpage.
- Prints the online help for this command. All other valid options areignored.
The following command removes the keys with key version numbers 5 and 6from the KeyFile
file on the system control machine fs1.abc.com
% bos removekey -server fs1.abc.com -kvno 5 6
The issuer must be listed in the /usr/afs/etc/UserList
file on themachine named by the -server
argument, or must be logged onto a servermachine as the local superuser root
if the -localauth
IBM Corporation 2000. <http://www.ibm.com/
> All Rights Reserved.
This documentation is covered by the IBM Public License Version 1.0. It wasconverted from HTML to POD by software written by Chas Williams and RussAllbery, based on work by Alf Wachsmann and Elizabeth Cassell.
- PRIVILEGE REQUIRED
- SEE ALSO
This document was created byman2html,using the manual pages.