This section describes how to use the keylogin, chkey, and nisupdkeys commands to administer keys. (The nisaddcred command also performs some key-related operations.
This section assumes that you have an adequate understanding of the NIS+ security system in general, and in particular of the role that keys play in that system (see Security, for this information).
When a principal logs in, the login process prompts for a password. That password is used to pass the user through the login security gate and give the user access to the network. The login process also decrypts the user's private key stored in the user's home domain cred table and passes that private key to the keyserver. The keyserver then uses that decrypted private key to authenticate the user each time the user accesses an NIS+ object.
Normally, this is the only time the principal is asked to provide a password. However, if the principal's private key in the cred table was encrypted with a password that was different from the user's login password, login cannot decrypt it using the login password at login time, and thus cannot provide a decrypted private key to the keyserver. (This most often occurs when a user's private key in the cred table was encrypted with a Secure RPC password different from the user's login password. Note also that in this context, network password is sometimes used as a synonym for Secure RPC password.)
To temporarily remedy this problem, the principal must perform a keylogin, using the keylogin command, after every login. (The -r flag is used to keylogin the superuser principal and to store the superuser's key in /etc/.rootkey on a host.)
For a principal user:
# keylogin
For a principal machine (only once):
# keylogin -r
Note, however, that performing an explicit keylogin with the original password provides only a temporary solution good for the current login session only. The private key in the cred table is still encrypted with a password different than the user's login password so the next time the user logs in the problem will reoccur. To permanently solve this problem, the user must run chkey to change the password used to encrypt the private key to the user's login password (see Changing Keys for a NIS+ Principal).
The chkey command changes an NIS+ principal's public and private keys that are stored in the cred table. It does not affect the principal's entry either in the passwd table or in the /etc/passwd file.
The chkey command:
See the command descriptions for more information on these subjects.
Note: In a NIS+ environment, when you change your login password with any of the current administration tools or the passwd command, your private key in the cred table is automatically re-encrypted with the new password for you. Thus, you do not need to explicitly run chkey after a change of login password.
The chkey command interacts with the keyserver, the cred table, and the passwd table. In order to run chkey, you:
To use the chkey command to re-encrypt your private key with your login password, you first run keylogin using the original password, and then use chkey -p as shown in the following table, which illustrates how to perform a keylogin and chkey for a principal user:
The following sections describe how to change the keys of an NIS+ principal.
The following table shows how to change the keys for the root master server from the root master (as root).
Where:
In the first step of the process outlined in the previous table, nisaddcred updates the cred table for the root master, updates /etc.rootkey and performs a keylogin for the root master. At this point the directory objects served by the master have not been updated and their credential information is now out of synch with the root master. The subsequent steps described in the table are necessary to successfully update all the objects.
To change the keys for the root master server from some other machine you must have the required NIS+ credentials and authorization to do so.
Where:
When running nisupdkeys be sure to update all relevant directory objects at the same time. In other words, do them all with one command. Separate updates may result in an authentication error.
To change the keys of a root replica from the replica, use these commands:
replica# nisaddcred des replica# nisupdkeys dirs
Where:
When running nisupdkeys be sure to update all relevant directory objects at the same time. In other words, do them all with one command. Separate updates may result in an authentication error.
To change the keys of a nonroot server (master or replica) from the server, use these commands:
subreplica# nisaddcred des subreplica# nisupdkeys parentdir dirs
Where:
When running nisupdkeys be sure to update all relevant directory objects at the same time. In other words, do them all with one command. Separate updates may result in an authentication error.
The public keys of NIS+ servers are stored in several locations throughout the namespace. When new credential information is created for the server, a new key pair is generated and stored in the cred table. However, namespace directory objects still have copies of the server's old public key. The nisupdkeys command is used to update those directory object copies.
| Tasks | Commands |
|---|---|
| Update all keys of all servers of the current domain (Wiz.Com). | rootmaster# /usr/lib/nis/nisupdkeys |
| Update keys of all servers supporting the Sales.Wiz.Com domain directory object. | Fetch Public key for server rootmaster.Wiz.Com.
netname='unix.rootmaster@Wiz.Com'
Updating rootmaster.Wiz.Com.'s public key.
Public key: public-key
salesmaster# nisupdkeys Sales.Wiz.Com
(Screen notices not shown)
|
| Update keys for a server named server7 in all the directories that store them. | rootmaster# nisupdkeys -H server7 |
| Clear the keys stored by the Sales.Wiz.Com directory object. | rootmaster# nisupdkeys -C Sales.Wiz.Com |
| Clear the keys for the current domain directory object for the server named server7. | rootmaster# nisupdkeys -C -H server7 |
If you change a server's IP address, or add additional addresses (multihome), you need to run nisupdkeys to update NIS+ address information.
To update the IP addresses of one or more servers, use the nisupdkeys command -a option.
To update the IP addresses of servers of a given domain
rootmaster# nisupdkeys -a domain
To update the IP address of a particular server
rootmaster# nisupdkeys -a -H server