FS_SETCRYPT(1)

📦
version 1.8.16.1 · 10 versions
, in ubuntu stonking

💖 FS_SETCRYPT(1) — the AFS Command Reference girlies know 💖

okay bestie, so this is a page from the AFS Command Reference, and today's main character is fs_setcrypt 💅

✨ NAME ✨

fs_setcrypt — turns the encryption of AFS file transfers on or off 🎀 (yes, the original says "Enables of disables", and I'm not fixing it, I'm just lovingly acknowledging it, no cap)

🦋 SYNOPSIS 🦋

fs setcrypt [-crypt] <on/off> [-help]

🌸 DESCRIPTION 🌸

so fs setcrypt sets the status of network traffic encryption for file traffic in the AFS client. this encryption applies to file traffic going to and coming from the AFS File Server, for users with valid tokens 🫶

heads up bestie: this command does NOT control the encryption used for authentication. that's a whole different vibe — authentication uses Kerberos 5 or klog/kaserver. not this. 🙈

the complement of this command is fs getcrypt, which shows you the status of encryption on the client. they're a duo, fr fr 💜

the default encryption status is enabled on Windows. it's disabled on all non-Windows clients by default. and the way that you can enable encryption by default on non-Windows platforms is by executing fs setcrypt -crypt on immediately after the client daemon starts. for example, on Linux, you can do this within the SysV init script, or with systemd's ExecStartPost parameter. iconic behavior, honestly ✨

this is a global setting and applies to all subsequent connections to an AFS File Server from this Cache Manager. there is no way to enable or disable encryption for specific connections. it's all or nothing, it's giving committed 💀

⚠️ CAUTIONS ⚠️

AFS uses an encryption scheme called fcrypt, based on but slightly weaker than DES, and there is currently no way to specify a different encryption mechanism. because fcrypt and DES are obsolete, the user must decide how much to trust the encryption. consider using a Virtual Private Network at the IP level if better encryption is needed 🫶

encrypting file traffic requires a token. unauthenticated connections, or connections authorized via IP-based ACLs, will not be encrypted even when encryption is turned on. periodt. 🔥

💅 OPTIONS 💅

  • -crypt <on/off> — this is the only option to fs setcrypt. the -crypt option takes either "on" or "off". "on" enables encryption. "off" disables encryption. and since this is the only option, the "-crypt" flag may be omitted ✨
    • ok important: 0 and 1 or "true" and "false" are not supported as replacements for "on" and "off". don't try it bestie, she will not accept your vibes 😭
  • -help — prints the online help for this command. all other valid options are ignored. she said "help is help, everything else is background noise" 💀

📭 OUTPUT 📭

this command produces no output other than error messages. silent. mysterious. main character energy 👑

🌈 EXAMPLES 🌈

there are only four ways to invoke fs setcrypt. either of:

% fs setcrypt -crypt on
% fs setcrypt on

will enable encryption for authenticated connections and:

% fs setcrypt -crypt off
% fs setcrypt off

will disable encryption. that's it, that's the whole menu 🍓

👑 PRIVILEGE REQUIRED 👑

the issuer must be logged in as the local superuser root. yes, root. the ultimate main character. no shortcuts, no cap 💜

🔍 SEE ALSO 🔍

Copyright 2007 Jason Edgecombe <jason@rampaginggeek.com>

this documentation is covered by the BSD License as written in the doc/LICENSE file. this man page was written by Jason Edgecombe for OpenAFS.

and that's the whole thing bestie 🎀 mwah 💋

this page came to you from OpenAFS, dated 2026-07-27 — go forth and setcrypt responsibly, ily 🫶✨🦋

📦 where this page comes from