BOS_UTIL(8)

💖 BOS_UTIL — bestie edition 💖

okay so boom: bos_util is the little command that messes with the AFS server KeyFile. That's the whole vibe. Let's get into it 🫶

---

✨ NAME ✨

bos_util — manipulate the AFS server KeyFile 💅

---

🌸 SYNOPSIS 🌸

bos_util add <kvno>

bos_util adddes <kvno>

bos_util delete <kvno>

bos_util list

---

🦋 DESCRIPTION 🦋

okay so the bos_util command manipulates the AFS server KeyFile, periodt. It can grab a password off standard input, turn that password into a key, and drop it into the KeyFile; it can list the keys chillin' in the KeyFile; or it can yeet a key out of the KeyFile. Functionally it's very similar to asetkey, but here's the difference bestie: asetkey works with keytab files, while bos_util works with passwords directly. iykyk 💀

bos_util expects one of these subcommands:

• add <kvno> — adds a key with key version <kvno> to the KeyFile, using a password from standard input. This one uses the normal AFS password salt algorithm to generate the key (equivalent to the des-cbc-crc:afs3 enctype in Kerberos v5). Basically it's the same thing as bos addkey. slay ✨
• adddes <kvno> — adds a key with key version <kvno> to the KeyFile, also taking a password from standard input. But this one does not salt the password when generating the key (equivalent to the des-cbc-crc:v4 enctype in Kerberos v5). Since this command applies no salt to the password, it can be used as a last resort for generating a DES key with a salt algorithm that other utilities don't know how to use — you do that by handing this command the pre-salted password. This can be useful when, for example, you're using Microsoft Active Directory as the Kerberos KDC, since Active Directory uses a different salt algorithm for service principals than most Unix Kerberos implementations do. That said, the best approach is to find a way to generate a keytab and then use asetkey. no cap.
• delete <kvno> — deletes the key with the specified key version from the KeyFile. This command is equivalent to asetkey delete or bos removekey.
• list — lists the keys in the KeyFile. This command is equivalent to asetkey list or bos listkeys. iconic 🌈

⚠️ one thing to note: the bos_util command does not use the normal AFS option parsing library, and its subcommands cannot be abbreviated. so don't try to be cute with shortcuts 💅

---

😭 CAUTIONS 😭

okay bestie, deep breath, this part matters:

• bos_util is intended for use with a Kerberos v4 environment, and therefore is mostly obsolete. Normally, instead of using this command, you'll want to use ktutil to create a keytab (maybe with its add_entry command) and then use asetkey as normal. bos_util only supports the AFS password salt algorithm and no password salt algorithm, and therefore may not produce the same key from a given password as Kerberos v5 utilities unless you're careful to use that same salt algorithm when creating the key in the KDC. 🙈
• Creating an AFS key with a known password and then using bos_util or bos addkey to add that key to the KeyFile is not recommended. Human-created passwords are usually not as strong as a random key generated using a good entropy source — like with the -randkey option to the MIT Kerberos v5 kadmin ktadd command, or the equivalent in other Kerberos v5 implementations. The security of AFS depends on the strength of the AFS service key, so it should therefore be as random as possible. 🔥
• It is imperative that the key version number (kvno) you give matches the kvno on the Kerberos server. If it doesn't, users won't be able to authenticate. Also the key generated by bos_util must match the internal representation on the Kerberos server, including the salt. literally no wiggle room here 💀

---

🎀 OPTIONS 🎀

bos_util takes no options. that's it. that's the section. she's low maintenance 👑

---

👑 PRIVILEGE REQUIRED 👑

The issuer must be logged onto a file server machine as the local superuser root. main character energy only 🫶

---

⭐ SEE ALSO ⭐

asetkey(8), bos_addkey(8), bos_listkeys(8), bos_removekey(8), kadmin(8), ktutil(8)

---

💜 COPYRIGHT 💜

Copyright 2007 Jason Edgecombe <jason@rampaginggeek.com>

This documentation is covered by the BSD License as written in the doc/LICENSE file. This man page was written by Jason Edgecombe for OpenAFS.

---

and that's the whole thing bestie, we ate 🍓✨ this was OpenAFS, dated 2026-07-27 — go forth and be careful with your kvnos fr fr 💖