.\" Automatically generated by Pod::Man 2.25 (Pod::Simple 3.26) .\" .\" Standard preamble: .\" ======================================================================== .de Sp \" Vertical space (when we can't use .PP) .if t .sp .5v .if n .sp .. .de Vb \" Begin verbatim text .ft CW .nf .ne \\$1 .. .de Ve \" End verbatim text .ft R .fi .. .\" Set up some character translations and predefined strings. \*(-- will .\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left .\" double quote, and \*(R" will give a right double quote. \*(C+ will .\" give a nicer C++. Capital omega is used to do unbreakable dashes and .\" therefore won't be available. \*(C` and \*(C' expand to `' in nroff, .\" nothing in troff, for use with C<>. .tr \(*W- .ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p' .ie n \{\ . ds -- \(*W- . ds PI pi . if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch . if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\" diablo 12 pitch . ds L" "" . ds R" "" . ds C` "" . ds C' "" 'br\} .el\{\ . ds -- \|\(em\| . ds PI \(*p . ds L" `` . ds R" '' 'br\} .\" .\" Escape single quotes in literal strings from groff's Unicode transform. .ie \n(.g .ds Aq \(aq .el .ds Aq ' .\" .\" If the F register is turned on, we'll generate index entries on stderr for .\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index .\" entries marked with X<> in POD. Of course, you'll have to process the .\" output yourself in some meaningful fashion. .ie \nF \{\ . de IX . tm Index:\\$1\t\\n%\t"\\$2" .. . nr % 0 . rr F .\} .el \{\ . de IX .. .\} .\" .\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2). .\" Fear. Run. Save yourself. No user-serviceable parts. . \" fudge factors for nroff and troff .if n \{\ . ds #H 0 . ds #V .8m . ds #F .3m . ds #[ \f1 . ds #] \fP .\} .if t \{\ . ds #H ((1u-(\\\\n(.fu%2u))*.13m) . ds #V .6m . ds #F 0 . ds #[ \& . ds #] \& .\} . \" simple accents for nroff and troff .if n \{\ . ds ' \& . ds ` \& . ds ^ \& . ds , \& . ds ~ ~ . ds / .\} .if t \{\ . ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u" . ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u' . ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u' . ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u' . ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u' . ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u' .\} . \" troff and (daisy-wheel) nroff accents .ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V' .ds 8 \h'\*(#H'\(*b\h'-\*(#H' .ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#] .ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H' .ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u' .ds th \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#] .ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#] .ds ae a\h'-(\w'a'u*4/10)'e .ds Ae A\h'-(\w'A'u*4/10)'E . \" corrections for vroff .if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u' .if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u' . \" for low resolution devices (crt and lpr) .if \n(.H>23 .if \n(.V>19 \ \{\ . ds : e . ds 8 ss . ds o a . ds d- d\h'-1'\(ga . ds D- D\h'-1'\(hy . ds th \o'bp' . ds Th \o'LP' . ds ae ae . ds Ae AE .\} .rm #[ #] #H #V #F C .\" ======================================================================== .\" .IX Title "WALLET 1" .TH WALLET 1 "2013-03-27" "1.0" "wallet" .\" For nroff, turn off justification. Always turn off hyphenation; it makes .\" way too many mistakes in technical documents. .if n .ad l .nh .SH "NAME" wallet \- Client for retrieving secure data from a central server .SH "SYNOPSIS" .IX Header "SYNOPSIS" \&\fBwallet\fR [\fB\-hv\fR] [\fB\-c\fR \fIcommand\fR] [\fB\-f\fR \fIfile\fR] [\fB\-k\fR \fIprincipal\fR] [\fB\-p\fR \fIport\fR] [\fB\-s\fR\ \fIserver\fR] [\fB\-S\fR \fIsrvtab\fR] [\fB\-u\fR \fIprincipal\fR] \fIcommand\fR [\fIarg\fR ...] .SH "DESCRIPTION" .IX Header "DESCRIPTION" \&\fBwallet\fR is a client for the wallet system, which stores or creates secure information such as Kerberos keytabs, associates them with ACLs and other metadata, and allows clients to view and download them. This client provides the user interface to the wallet system for both users and wallet administrators. .PP The \fBwallet\fR command-line client takes a command and optional arguments on the command line, authenticates to the wallet server using Kerberos, and sends that command and arguments to server. It then reads the results and displays them to the user or stores them in a file. The client itself does not know which commands are valid and which aren't; apart from some special handling of particular commands, it sends all commands to the server to respond to appropriately. This allows additional commands to be added to the wallet system without changing all of the clients. .PP The primary commands of the wallet system are \f(CW\*(C`get\*(C'\fR, which retrieves some secure data from the wallet, \f(CW\*(C`store\*(C'\fR, which stores some secure data in the wallet, and \f(CW\*(C`show\*(C'\fR, which stores the metadata about an object stored in the wallet. Each object in the wallet has a type, which determines what data the object represents and may determine special handling when downloading or storing that object, and a name. For example, a wallet object for the \f(CW\*(C`host/example.com\*(C'\fR Kerberos keytab would have a type of \&\f(CW\*(C`keytab\*(C'\fR and a name of \f(CW\*(C`host/example.com\*(C'\fR. The meaning of the name is specific to each type of object. .PP Most other wallet commands besides those three are only available to wallet administrators. The exception is attribute commands; see \&\s-1ATTRIBUTES\s0. The other commands allow setting ownership and ACLs on objects, creating and destroying objects, creating and destroying ACLs, and adding and removing entries from ACLs. An \s-1ACL\s0 consists of one or more entries, each of which is a scheme and an identifier. A scheme specifies a way of checking whether a user is authorized. An identifier is some data specific to the scheme that specifies which users are authorized. For example, for the \f(CW\*(C`krb5\*(C'\fR scheme, the identifier is a principal name and only that principal is authorized by that \s-1ACL\s0 entry. .PP To run the wallet command-line client, you must either already have a Kerberos ticket or use the \fB\-u\fR option. You can obtain a Kerberos ticket with \fBkinit\fR and see your current Kerberos tickets with \fBklist\fR. The wallet client uses the remctl protocol to talk to the wallet server. .SH "OPTIONS" .IX Header "OPTIONS" .IP "\fB\-c\fR \fIcommand\fR" 4 .IX Item "-c command" The command prefix (remctl type) to use. Normally this is an internal implementation detail and the default (\f(CW\*(C`wallet\*(C'\fR) should be fine. It may sometimes be useful to use a different prefix for testing a different version of the wallet code on the server. This option can also be set in \&\fIkrb5.conf\fR; see \s-1CONFIGURATION\s0 below. .IP "\fB\-f\fR \fIfile\fR" 4 .IX Item "-f file" This flag is only used in combination with the \f(CW\*(C`get\*(C'\fR and \f(CW\*(C`store\*(C'\fR commands. For \f(CW\*(C`get\*(C'\fR, rather than sending the secure data to standard output (the default), the secure data will be stored in \fIfile\fR. For \&\f(CW\*(C`store\*(C'\fR, the data to be stored will be read from \fIfile\fR. .Sp With \f(CW\*(C`get\*(C'\fR, if the object being retrieved is not a keytab object, any current file named \fIoutput\fR is renamed to \fI\fIoutout\fI.bak\fR before the new file is created. \fI\fIoutout\fI.new\fR is used as a temporary file and any existing file with that name will be deleted. .Sp If the object being retrieved is a keytab object and the file \fIoutput\fR already exists, the downloaded keys will be added to the existing keytab file \fIoutput\fR. Old keys are not removed; you may wish to run \f(CW\*(C`kadmin ktremove\*(C'\fR or an equivalent later to clean up old keys. \fI\fIoutput\fI.new\fR is still used as a temporary file and any existing file with that name will be deleted. .IP "\fB\-k\fR \fIprincipal\fR" 4 .IX Item "-k principal" The service principal of the wallet server. The default is to use the \&\f(CW\*(C`host\*(C'\fR principal for the wallet server. The principal chosen must match one of the keys in the keytab used by \fBremctld\fR on the wallet server. This option can also be set in \fIkrb5.conf\fR; see \s-1CONFIGURATION\s0 below. .IP "\fB\-h\fR" 4 .IX Item "-h" Display a brief summary of options and exit. All other valid options and commands are ignored. .IP "\fB\-p\fR \fIport\fR" 4 .IX Item "-p port" The port to connect to on the wallet server. The default is the default remctl port. This option can also be set in \fIkrb5.conf\fR; see \&\s-1CONFIGURATION\s0 below. .IP "\fB\-S\fR \fIsrvtab\fR" 4 .IX Item "-S srvtab" This flag is only used in combination with the \f(CW\*(C`get\*(C'\fR command on a \&\f(CW\*(C`keytab\*(C'\fR object, and must be used in conjunction with the \fB\-f\fR flag. After the keytab is saved to the file specified by \fB\-f\fR, the \s-1DES\s0 key for that principal will be extracted and written as a Kerberos v4 srvtab to the file \fIsrvtab\fR. Any existing contents of \fIsrvtab\fR will be destroyed. .Sp The Kerberos v4 principal name will be generated from the Kerberos v5 principal name using the \fIkrb5_524_conv_principal()\fR function of the Kerberos libraries. See its documentation for more information, but briefly (and in the absence of special configuration), the Kerberos v4 principal name will be the same as the Kerberos v5 principal name except that the components are separated by \f(CW\*(C`.\*(C'\fR instead of \f(CW\*(C`/\*(C'\fR; the second component is truncated after the first \f(CW\*(C`.\*(C'\fR if the first component is one of the recognized host-based principals (generally \f(CW\*(C`host\*(C'\fR, \f(CW\*(C`imap\*(C'\fR, \&\f(CW\*(C`pop\*(C'\fR, or \f(CW\*(C`smtp\*(C'\fR); and the first component is \f(CW\*(C`rcmd\*(C'\fR if the Kerberos v5 principal component is \f(CW\*(C`host\*(C'\fR. The principal name must not contain more than two components. .IP "\fB\-s\fR \fIserver\fR" 4 .IX Item "-s server" The wallet server to connect to. The default may be set when compiling the wallet client. If it isn't, either \fB\-s\fR must be given or the server must be set in \fIkrb5.conf\fR. See \s-1CONFIGURATION\s0 below. .IP "\fB\-u\fR \fIprincipal\fR" 4 .IX Item "-u principal" Rather than using the user's existing ticket cache for authentication, authenticate as \fIprincipal\fR first and use those credentials for authentication to the wallet server. \fBwallet\fR will prompt for the password for \fIprincipal\fR. Non-password authentication methods such as \&\s-1PKINIT\s0 aren't supported; to use those, run \fBkinit\fR first and use an existing ticket cache. .IP "\fB\-v\fR" 4 .IX Item "-v" Display the version of the \fBwallet\fR client and exit. All other valid options and commands are ignored. .SH "COMMANDS" .IX Header "COMMANDS" As mentioned above, most commands are only available to wallet administrators. The exceptions are \f(CW\*(C`acl check\*(C'\fR, \f(CW\*(C`check\*(C'\fR, \f(CW\*(C`get\*(C'\fR, \&\f(CW\*(C`store\*(C'\fR, \f(CW\*(C`show\*(C'\fR, \f(CW\*(C`destroy\*(C'\fR, \f(CW\*(C`flag clear\*(C'\fR, \f(CW\*(C`flag set\*(C'\fR, \f(CW\*(C`getattr\*(C'\fR, \&\f(CW\*(C`setattr\*(C'\fR, and \f(CW\*(C`history\*(C'\fR. \f(CW\*(C`acl check\*(C'\fR and \f(CW\*(C`check\*(C'\fR can be run by anyone. All of the rest of those commands have their own ACLs except \&\f(CW\*(C`getattr\*(C'\fR and \f(CW\*(C`history\*(C'\fR, which use the \f(CW\*(C`show\*(C'\fR \s-1ACL\s0, \f(CW\*(C`setattr\*(C'\fR, which uses the \f(CW\*(C`store\*(C'\fR \s-1ACL\s0, and \f(CW\*(C`comment\*(C'\fR, which uses the owner or \f(CW\*(C`show\*(C'\fR \s-1ACL\s0 depending on whether one is setting or retrieving the comment. If the appropriate \s-1ACL\s0 is set, it alone is checked to see if the user has access. Otherwise, \f(CW\*(C`destroy\*(C'\fR, \f(CW\*(C`get\*(C'\fR, \f(CW\*(C`store\*(C'\fR, \f(CW\*(C`show\*(C'\fR, \f(CW\*(C`getattr\*(C'\fR, \f(CW\*(C`setattr\*(C'\fR, \&\f(CW\*(C`history\*(C'\fR, and \f(CW\*(C`comment\*(C'\fR access is permitted if the user is authorized by the owner \s-1ACL\s0 of the object. .PP Administrators can run any command on any object or \s-1ACL\s0 except for \f(CW\*(C`get\*(C'\fR and \f(CW\*(C`store\*(C'\fR. For \f(CW\*(C`get\*(C'\fR and \f(CW\*(C`store\*(C'\fR, they must still be authorized by either the appropriate specific \s-1ACL\s0 or the owner \s-1ACL\s0. .PP If the locked flag is set on an object, no commands can be run on that object that change data except the \f(CW\*(C`flags\*(C'\fR commands, nor can the \f(CW\*(C`get\*(C'\fR command be used on that object. \f(CW\*(C`show\*(C'\fR, \f(CW\*(C`history\*(C'\fR, \f(CW\*(C`getacl\*(C'\fR, \&\f(CW\*(C`getattr\*(C'\fR, and \f(CW\*(C`owner\*(C'\fR, \f(CW\*(C`expires\*(C'\fR, or \f(CW\*(C`comment\*(C'\fR without an argument can still be used on that object. .PP For more information on attributes, see \s-1ATTRIBUTES\s0. .IP "acl add " 4 .IX Item "acl add " Add an entry with and to the \s-1ACL\s0 . may be either the name of an \s-1ACL\s0 or its numeric identifier. .IP "acl check " 4 .IX Item "acl check " Check whether an \s-1ACL\s0 with the \s-1ID\s0 already exists. If it does, prints \&\f(CW\*(C`yes\*(C'\fR; if not, prints \f(CW\*(C`no\*(C'\fR. .IP "acl create " 4 .IX Item "acl create " Create a new, empty \s-1ACL\s0 with name . When setting an \s-1ACL\s0 on an object with a set of entries that don't match an existing \s-1ACL\s0, first create a new \s-1ACL\s0 with \f(CW\*(C`acl create\*(C'\fR, add the appropriate entries to it with \f(CW\*(C`acl add\*(C'\fR, and then set the \s-1ACL\s0 on an object with the \f(CW\*(C`owner\*(C'\fR or \&\f(CW\*(C`setacl\*(C'\fR commands. .IP "acl destroy " 4 .IX Item "acl destroy " Destroy the \s-1ACL\s0 . This \s-1ACL\s0 must no longer be referenced by any object or the \s-1ACL\s0 destruction will fail. The special \s-1ACL\s0 named \f(CW\*(C`ADMIN\*(C'\fR cannot be destroyed. .IP "acl history " 4 .IX Item "acl history " Display the history of the \s-1ACL\s0 . Each change to the \s-1ACL\s0 (not including changes to the name of the \s-1ACL\s0) will be represented by two lines. The first line will have a timestamp of the change followed by a description of the change, and the second line will give the user who made the change and the host from which the change was made. .IP "acl remove " 4 .IX Item "acl remove " Remove the entry with and from the \s-1ACL\s0 . may be either the name of an \s-1ACL\s0 or its numeric identifier. The last entry in the special \s-1ACL\s0 \f(CW\*(C`ADMIN\*(C'\fR cannot be removed to protect against accidental lockout, but administrators can remove themselves from the \&\f(CW\*(C`ADMIN\*(C'\fR \s-1ACL\s0 and can leave only a non-functioning entry on the \s-1ACL\s0. Use caution when removing entries from the \f(CW\*(C`ADMIN\*(C'\fR \s-1ACL\s0. .IP "acl rename " 4 .IX Item "acl rename " Renames the \s-1ACL\s0 identified by to . This changes the human-readable name, not the underlying numeric \s-1ID\s0, so the \s-1ACL\s0's associations with objects will be unchanged. The \f(CW\*(C`ADMIN\*(C'\fR \s-1ACL\s0 may not be renamed. may be either the current name or the numeric \s-1ID\s0. must not be all-numeric. To rename an \s-1ACL\s0, the current user must be authorized by the \f(CW\*(C`ADMIN\*(C'\fR \s-1ACL\s0. .IP "acl show " 4 .IX Item "acl show " Display the name, numeric \s-1ID\s0, and entries of the \s-1ACL\s0 . .IP "autocreate " 4 .IX Item "autocreate " Create a new object of type with name . The user must be listed in the default \s-1ACL\s0 for an object with that type and name, and the object will be created with that default \s-1ACL\s0 set as the object owner. .Sp Normally, there's no need to run this command directly. It's automatically run when trying to get or store an object that doesn't already exist. .IP "check " 4 .IX Item "check " Check whether an object of type and name already exists. If it does, prints \f(CW\*(C`yes\*(C'\fR; if not, prints \f(CW\*(C`no\*(C'\fR. .IP "comment []" 4 .IX Item "comment []" If is not given, displays the current comment for the object identified by and , or \f(CW\*(C`No comment set\*(C'\fR if none is set. .Sp If is given, sets the comment on the object identified by and to . If is the empty string, clears the comment. .IP "create " 4 .IX Item "create " Create a new object of type with name . With some backends, this will trigger creation of an entry in an external system as well. The new object will have no ACLs and no owner set, so usually the administrator will want to then set an owner with \f(CW\*(C`owner\*(C'\fR so that the object will be usable. .IP "destroy " 4 .IX Item "destroy " Destroy the object identified by and . With some backends, this will trigger destruction of an object in an external system as well. .IP "expires []" 4 .IX Item "expires []" If is not given, displays the current expiration of the object identified by and , or \f(CW\*(C`No expiration set\*(C'\fR if none is set. The expiration will be displayed in seconds since epoch. .Sp If is given, sets the expiration on the object identified by and to and (if given)