BOS_LISTKEYS(8)

📦
version 1.8.16.1 · 10 versions
, in ubuntu stonking

💖 BOS_LISTKEYS 💖

okay bestie so this is BOS_LISTKEYS(8) from the AFS Command Reference and it's lowkey one of the most "handle with care" pages in the whole set, so buckle up 🎀

✨ NAME ✨

bos_listkeys — displays the server encryption keys from the KeyFile file 🔑

✨ SYNOPSIS ✨

bos listkeys -server <machine name> [-showkey]
    [-cell <cell name>] [-noauth] [-localauth] [-help]

bos listk -se <machine name> [-sh] [-c <cell name>]
    [-n] [-l] [-h]

✨ DESCRIPTION ✨

So the bos listkeys command formats and displays the list of server encryption keys that live in the /etc/openafs/server/KeyFile file on whatever server machine you named with the -server argument. That's it, that's the job 💅

It's equivalent to asetkey list, except — and this is the slay part — it can be run remotely. no cap 🫶

Wanna edit the list of keys? Use the asetkey command instead, and go read asetkey(8) for the whole story. You can also remove keys remotely with the bos removekey command. And hmm, if you're using the Authentication Server (kaserver) instead of a Kerberos v5 KDC, then instead of asetkey you'll want the bos addkey command to add a new key. iykyk 😌

🌸 CAUTIONS 🌸

okay this is the part where I hold your hand and look you dead in the eyes 😭

Displaying the actual keys on the standard output stream (that's what happens when you include the -showkey flag) is a security exposure. Displaying a checksum is sufficient for most purposes. fr fr, checksum is enough, don't be messy 🙈

Also real talk: this command will only list keys in the KeyFile; it cannot display keys from a KeyFileExt. A server running a modern, secure installation using only keys for the rxkad-k5 extension will yield no keys in the output of this command. so if you get nothing back, that's not a bug bestie, that's just the vibe check 💀

💅 OPTIONS 💅

  • -server <machine name> — Indicates the server machine from which to display the KeyFile file. Identify the machine by IP address or its host name (either fully-qualified or abbreviated unambiguously). For details, see bos(8).

For consistent performance in the cell, the output must be the same on every server machine. asetkey(8) explains how to keep the machines synchronized. (yes this matters, don't skip it ✨)

  • -showkey — Displays the octal digits that constitute each key. Anyone who has access to the resulting output will have complete access to the AFS cell and will be able to impersonate the AFS cell to any client, so be very careful when using this option. like, very very careful 💀🔒
  • -cell <cell name> — Names the cell in which to run the command. Do not combine this argument with the -localauth flag. For more details, see bos(8).
  • -noauth — Assigns the unprivileged identity "anonymous" to the issuer. Do not combine this flag with the -localauth flag. For more details, see bos(8).
  • -localauth — Constructs a server ticket using a key from the local /etc/openafs/server/KeyFile or /etc/openafs/server/KeyFileExt file. The bos command interpreter presents the ticket to the BOS Server during mutual authentication. Do not combine this flag with the -cell or -noauth options. For more details, see bos(8).
  • -help — Prints the online help for this command. All other valid options are ignored. (a little "I'm out, don't @ me" flag, love that for us 🎀)

🦋 OUTPUT 🦋

The output includes one line for each server encryption key listed in the KeyFile file, identified by its key version number.

If the -showkey flag is included, the output displays the actual string of eight octal numbers that constitute the key. Each octal number is a backslash and three decimal digits.

If the -showkey flag is not included, the output represents each key as a checksum, which is a decimal number derived by encrypting a constant with the key.

Following the list of keys or checksums, the string "Keys last changed" indicates when a key was last added to the KeyFile file. The words "All done" indicate the end of the output. iconic little sign-off honestly 👑

For mutual authentication to work properly, the output from the command "kas examine afs" must match the key or checksum with the same key version number in the output from this command. match or it's over bestie 😭

🌈 EXAMPLES 🌈

The following example shows the checksums for the keys stored in the KeyFile file on the machine "fs3.example.com".

% bos listkeys fs3.example.com
key 1 has cksum 972037177
key 3 has cksum 2825175022
key 4 has cksum 260617746
key 6 has cksum 4178774593
Keys last changed on Mon Apr 12 11:24:46 1999.
All done.

The following example shows the actual keys from the KeyFile file on the machine "fs6.example.com".

% bos listkeys fs6.example.com -showkey
key 0 is '\040\205\211\241\345\002\023\211'
key 1 is '\343\315\307\227\255\320\135\244'
key 2 is '\310\310\255\253\326\236\261\211'
Keys last changed on Wed Mar 31 11:24:46 1999.
All done.

(not me showing you the second one and feeling nervous for you 🫣 be careful with that output pls)

👑 PRIVILEGE REQUIRED 👑

The issuer must be listed in the /etc/openafs/server/UserList file on the machine named by the -server argument, or must be logged onto a server machine as the local superuser "root" if the -localauth flag is included.

so basically: be on the list, or be root. no in-between 💜

🎀 SEE ALSO 🎀

KeyFile(5), KeyFileExt(5), UserList(5), asetkey(8), bos_addkey(8), bos_removekey(8), bos_setauth(8), kas_examine(8)

(the whole friend group, go say hi 🫶)

IBM Corporation 2000. <http://www.ibm.com/> All Rights Reserved.

This documentation is covered by the IBM Public License Version 1.0. It was converted from HTML to POD by software written by Chas Williams and Russ Allbery, based on work by Alf Wachsmann and Elizabeth Cassell.

okay that's the whole page, you ate that 💖 this dropped as part of OpenAFS and the date on it is 2026-07-27 — go forth and list those keys responsibly, bestie, and pls pls pls think twice before adding -showkey 😭🌸

📦 where this page comes from