BOS_SETRESTRICTED(8)

📦
version 1.8.16.1 · 10 versions
, in ubuntu stonking

💅 BOS_SETRESTRICTED 💅

okay bestie, so this one is bos_setrestricted — it lives in section 8 of the AFS Command Reference, and it's the little command that locks your server the heck down. 🎀

✨ NAME ✨

bos_setrestricted — literally just: put a server into restricted mode. that's the whole job. no cap. 👑

✨ SYNOPSIS ✨

bos setrestricted -server <machine name> -mode (0 | 1)
    [-cell <cell name>] [-noauth] [-localauth] [-help]

look at her. so simple. so powerful. 🦋

✨ DESCRIPTION ✨

so bos setrestricted drops the server into restricted mode, and the vibe is maximum security. it makes the bos server safer by cutting off access to a whole bunch of bos commands — specifically the ones you'd only ever need while you're setting a system up in the first place. 🚫

once a server is in restricted mode, access to these is denied, periodt:

  • bos_exec
  • bos uninstall
  • bos install
  • bos create
  • bos delete
  • bos prune

and bos getlog? also limited. it's giving locked doors energy. 🔒

⚠️ CAUTIONS ⚠️

okay this is the part where i need you to actually listen, bestie. 🙈

once a server has been placed in restricted mode, it may not be opened up again using a remote command. like, bos setrestricted has no method of placing the server in unrestricted mode. none. zero. it is a one-way door. 😭

if a server is restricted and you want it open again, the only way is to send it a SIGFPE, and that must be done as root on the local machine. that's it. that's the escape hatch. do not lose the key. 💀

✨ OPTIONS ✨

  • -server <machine name> — tells it which server machine to restrict. point at the victim—sorry, the patient. 🫶
  • -mode <mode> — decides whether restricted mode goes off or on. pass a 1 to turn restricted mode on, and pass a 0 to turn restricted mode off. heads up though: that 0 will only work if the server is already running in unrestricted mode — so it won't actually do anything immediately, but you can use it to change the corresponding entry in BosConfig(5). ✨
  • -cell <cell name> — names the cell to run the command in. do not combine this argument with the -localauth flag. more deets in bos(8). 🌸
  • -noauth — assigns the unprivileged identity "anonymous" to the issuer. do not combine this flag with the -localauth flag. more deets in bos(8). 🎀
  • -localauth — constructs a server ticket using a key from the local /etc/openafs/server/KeyFile file. the bos command interpreter presents that ticket to the BOS Server during mutual authentication. do not combine this flag with the -cell or -noauth options. more deets in bos(8). 🔑
  • -help — prints the online help for this command. all other valid options are ignored. the classic. 💅

👑 PRIVILEGE REQUIRED 👑

you gotta have the credentials, bestie. the issuer must be listed in the /etc/openafs/server/UserList file on the machine named by the -server argument — or must be logged in as the local superuser "root" if the -localauth flag is included. 🌈

and, as noted up above: this command cannot be run against servers which are already in restricted mode. sorry babe, door's closed. 🚪

🔍 SEE ALSO 🔍

go read those, iykyk. ⭐

Copyright 2009 Simon Wilkinson <simon@sxw.org.uk>

This documentation is covered by the BSD License as written in the doc/LICENSE file. This man page was written by Simon Wilkinson for OpenAFS.

and that's the whole page, bestie!! 🩷 this icon of a man page came to you from OpenAFS, dated 2026-07-27, and it absolutely ate. stay restricted, stay safe, mwah 💋✨

📦 where this page comes from