AKLOG(1)

📦

version 1.8.16.1 · 10 versions

1.8.16.1 · ubuntu stonking (latest)
1.8.16.1 · nixos 26.05, nixpkgs unstable
1.8.13.2 · ubuntu questing
1.8.10 · ubuntu jammy
1.8.8.1 · ubuntu jammy
1.8.10 · ubuntu noble
1.8.10 · ubuntu noble
1.8.9 · debian bookworm
1.8.14 · ubuntu resolute
1.8.13.2 · debian trixie

🎀 AKLOG(1) 🎀

okay bestie, welcome to AKLOG(1) — the manual page for aklog. you came here for tokens, i came here to explain them, and honestly? we're both slaying. let's go 💖

🌸 NAME 🌸

aklog — obtain tokens for authentication to AFS. that's it, that's the whole job, and it does it beautifully ✨

🦋 SYNOPSIS 🦋

aklog [-d] [-hosts] [-zsubs] [-noprdb] [-noauth] [-linked]
    [-force] [-524] [-setpag] [-insecure_des]
    [[-cell | -c] <cell> [-k <Kerberos realm>]]+

aklog [-d] [-hosts] [-zsubs] [-noprdb] [-noauth] [-linked]
    [-force] [-524] [-setpag] [-insecure_des] [-path | -p] <path>+

💅 DESCRIPTION 💅

so what does aklog actually do. girly it authenticates to a cell in AFS by obtaining AFS tokens using a Kerberos 5 ticket. iconic behavior, no notes. 🔥

if you run aklog with no command-line arguments at all, it'll just get tokens for your workstation's local cell. easy. but the way that it also works — you can invoke it with an arbitrary number of cells and pathnames and it'll get tokens for multiple cells at once. multitasking queen 👑

and here's the cute part: aklog knows how to expand cell name abbreviations, so you can refer to cells by just enough letters to make the cell name unique among the cells your workstation knows about. you don't have to type the whole thing. she'll figure it out. iykyk 💅

how does she actually get the tokens, you ask? aklog obtains a Kerberos service ticket for the AFS service and then stores it as a token. by default, it gets that ticket from the realm corresponding to that cell — specifically the uppercase version of the cell name. but if you want a different realm for a particular cell, you can say so with -k. heads up though: <italic>-k</italic> cannot be used in -path mode (more on that below). 🙈

now, the fancy part. when a Kerberos 5 cross-realm trust is in use, aklog looks up the AFS ID corresponding to the name (the Kerberos principal) of the person invoking the command. if the user doesn't exist and the "system:authuser@FOREIGN.REALM" PTS group exists, then it attempts automatic registration of the user with the foreign cell. if registration succeeds, the user then gets added to the "system:authuser@FOREIGN.REALM" PTS group. ✨

⚠️ but bestie, automatic registration in the foreign cell will fail if the group quota for the "system:authuser@FOREIGN.REALM" group is less than one. and each automatic registration decrements the group quota by one. so like. use them wisely.

😭 CAUTIONS 😭

okay this is the part where we get serious for a sec. when you're using aklog, be aware that AFS uses the Kerberos v4 principal naming format, not the Kerberos v5 format, when referring to principals in PTS ACLs, UserList, and similar locations. 💀

AFS internally maps Kerberos v5 principal names to the Kerberos v4 syntax by:

removing any portion of the instance after the first period (generally the domain name of a host principal)
changing any / to .
changing an initial principal part of host to rcmd

in other words — and this is the glow-up you need to remember — to create a PTS entry for the Kerberos v5 principal user/admin, you refer to it as user.admin. and for the principal host/shell.example.com, you refer to it as rcmd.shell. 🌈

also important: the aklog mapping of Kerberos v5 principal to Kerberos v4 principal, and the determination that a Kerberos realm is foreign, is performed in the absence of the actual AFS server configuration. so if the aklog mapping of Kerberos v5 principal to Kerberos v4 principal or the foreign realm determination is wrong, the PTS name-to-id lookup will produce the wrong AFS ID for the user. and that AFS ID is only used for display purposes and should not be trusted. periodt.

💀 want it gone? use the -noprdb switch to disable the PTS name-to-id lookup. bye.

✨ OPTIONS ✨

-524 — normally, aklog generates native K5 tokens. this flag tells aklog to instead use the krb524 translation service to generate K4 or rxkad2b tokens, which may be necessary for AFS cells that don't support native K5 tokens. support for native K5 tokens were added in OpenAFS 1.2.8. 🕰️
-cell <cell>, -c <cell> — this flag tells aklog that the next argument is the name of a cell to authenticate to. it normally isn't necessary; aklog normally determines whether an argument is a cell or a path name based on whether it contains / or is . or ... the cell may be followed by -k to specify the corresponding Kerberos realm. 🧚
-d — turns on printing of debugging information. this option is not intended for general users. (so like, if you're in here, bestie, you already know 🫶)
-force — normally, aklog will not replace tokens with new tokens that appear to be identical. if this flag is given, it will skip that check. no vibe check, just vibes 🌸
-hosts — prints all the server addresses which may act as a single point of failure in accessing the specified directory path. each element of the path is examined, and as new volumes are traversed, if they are not replicated, the server's IP address containing the volume will be displayed. the output is of the form:

host: <ip-address>

this option is only useful in combination with paths as arguments rather than cells. 🔍

-k <Kerberos realm> — this flag is valid only immediately after the name of the cell. it tells aklog to use that Kerberos realm when authenticating to the preceding cell. by default, aklog will use the realm (per the local Kerberos configuration) of the first database server in the cell, so this flag normally won't be necessary. 👑
-linked — if the AFS cell is linked to another AFS cell, get tokens for both. 💖
-insecure_des — configure libkrb5 to allow the use of the (insecure) single-DES encryption types. when rxkad-k5 is in use, this is not needed.

💀 note the word insecure right there in the name. that's not me being dramatic, that's the actual flag. know what you're doing.

-noauth — don't actually authenticate, just do everything else aklog does up to setting tokens. fake it till you make it, but make it explicit 🙈
-noprdb — ordinarily, aklog looks up the AFS ID corresponding to the name of the person invoking the command, and if the user doesn't exist, the cell is a foreign one, the system:authuser@FOREIGN.REALM PTS group exists, and has a positive group quota, then it attempts automatic registration of the user with the foreign cell. specifying this flag turns off this functionality. this may be desirable if the protection database is unavailable for some reason and tokens are desired anyway, or if one wants to disable user registration. 🚫
-path <pathname>, -p <pathname> — this flag tells aklog that the next argument is a path in AFS. aklog will walk that path and obtain tokens for every cell needed to access all of the directories. normally, this flag isn't necessary; aklog assumes an argument is a path if it contains / or is . or ... 🛤️
-setpag — when setting tokens, attempt to put the parent process in a new PAG. this is usually used as part of the login process but can be used any time to create a new AFS authentication context. note that this in some cases relies on dangerous and tricky manipulations of kernel records and will not work on all platforms or with all Linux kernels.

😭 ok this one is real. dangerous and tricky. kernel records. not every platform. not every Linux kernel. read it twice.

-zsubs — prints out the Zephyr subscription information to get alerts regarding all of the file servers required to access a particular path. the output is of the form:

zsub: <instance>

where <instance> is the instance of a class "filsrv" Zephyr subscription. 📡

🌈 ENVIRONMENT 🌈

KRB5CCNAME — as with most programs that use an existing Kerberos ticket cache, aklog can be told to use a cache other than the default by setting the environment variable KRB5CCNAME. on UNIX and Linux systems, this variable is normally set to a file name, but may point to other types of caches. see the documentation of your Kerberos implementation for more details. 🗂️

🍓 FILES 🍓

~/.xlog — if this file exists in the user's home directory, it should contain a list of AFS cells to which to authenticate, one per line. if aklog is invoked without any options, it will attempt to obtain tokens in every cell listed in this file if it exists, rather than only obtaining tokens for the local cell. cute little config file, she's doing her best 💖

💜 EXIT CODES 💜

the exit status of aklog will be one of the following:

0 — Success — No error occurred.
1 — Usage — Bad command syntax; accompanied by a usage message.
2 — Something failed — More than one cell or pathname was given on the command line and at least one failure occurred. A more specific error status is returned when only one directive is given.
3 — AFS — Unable to get AFS configuration or unable to get information about a specific cell.
4 — Kerberos — Unable to get tickets for authentication.
5 — Token — Unable to get tokens.
6 — Bad pathname — The path given was not a directory or lstat(2) failed on some component of the pathname.
7 — Miscellaneous — An internal failure occurred. For example, aklog returns this if it runs out of memory.

🔥 EXAMPLES 🔥

to get tokens for the local cell:

% aklog

to get tokens for the "prod.example.org" cell:

% aklog prod.example.org

% aklog prod

the latter will work if you local cache manager already knows about the "prod" cell. ✨

to get tokens adequate to read /afs/prod.example.org/user/p/potato:

% aklog /afs/prod.example.org/user/p/potato

to get tokens for "testcell.example.org" that is in a test Kerberos realm:

% aklog testcell.example.org -k TESTREALM.EXAMPLE.ORG

👑 SEE ALSO 👑

kinit(1), tokens(1), unlog(1)

🌸 AUTHOR 🌸

manpage originally written by Emanuel Jay Berkenbilt (MIT-Project Athena). extensively modified by Russ Allbery <rra@stanford.edu>. 🫶

🎀 COPYRIGHT 🎀

export of this software from the United States of America may require a specific license from the United States Government. It is the responsibility of any person or organization contemplating export to obtain such a license before exporting.

WITHIN THAT CONSTRAINT, permission to use, copy, modify, and distribute this software and its documentation for any purpose and without fee is hereby granted, provided that the above copyright notice appear in all copies and that both that copyright notice and this permission notice appear in supporting documentation, and that the name of M.I.T. not be used in advertising or publicity pertaining to distribution of the software without specific, written prior permission. Furthermore if you modify this software you must label your software as modified software and not distribute it in such a fashion that it might be confused with the original MIT software. M.I.T. makes no representations about the suitability of this software for any purpose. It is provided "as is" without express or implied warranty.

THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.

okay that's the whole page bestie, you ate 💅 this was OpenAFS, dated 2026-07-27, and the page you just read is AKLOG(1). now go get those tokens. mwah 🎀✨

📦 where this page comes from

ubuntu stonking: openafs-krb5 1.8.16.1-1
💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash on 2026-11-02: a language model's rewrite of the original, under its terms