'\" te
.\" Copyright (C) 2005, Sun Microsystems, Inc. All Rights Reserved
.\" Copyright 1989 AT&T
.\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License").  You may not use this file except in compliance with the License.
.\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing.  See the License for the specific language governing permissions and limitations under the License.
.\" When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE.  If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
.TH CHKEY 1 "Feb 25, 2017"
.SH NAME
chkey \- change user's secure RPC key pair
.SH SYNOPSIS
.LP
.nf
\fBchkey\fR [\fB-p\fR] [\fB-s\fR nis | files | ldap]
     [\fB-m\fR \fI<mechanism>\fR]
.fi

.SH DESCRIPTION
.LP
\fBchkey\fR is used to change a user's secure \fBRPC\fR public key and secret
key pair. \fBchkey\fR prompts for the old secure-rpc password and verifies that
it is correct by decrypting the secret key. If the user has not already used
\fBkeylogin\fR(1) to decrypt and store the secret key with \fBkeyserv\fR(8),
\fBchkey\fR registers the secret key with the local \fBkeyserv\fR(8) daemon.
If the secure-rpc password does not match the login password, \fBchkey\fR
prompts for the login password. \fBchkey\fR uses the login password to encrypt
the user's secret Diffie-Hellman (192 bit) cryptographic key.
.sp
.LP
\fBchkey\fR ensures that the login password and the secure-rpc  password(s) are
kept the same, thus enabling password shadowing. See \fBshadow\fR(5).
.sp
.LP
The key pair can be stored in the  \fB/etc/publickey\fR file (see
\fBpublickey\fR(5)) or the \fBNIS\fR \fBpublickey\fR map.
If a new secret key is generated, it will be
registered with the local \fBkeyserv\fR(8) daemon.
.sp
.LP
Keys for specific mechanisms can be changed or reencrypted using the \fB-m\fR
option followed by the authentication mechanism name. Multiple  \fB-m\fR
options can be used to change one or more keys.
.sp
.LP
If the source of the  \fBpublickey\fR is not specified with the \fB-s\fR
option,  \fBchkey\fR consults the  \fBpublickey\fR entry in the name service
switch configuration file.  See \fBnsswitch.conf\fR(5). If the  \fBpublickey\fR
entry specifies one and only one source, then \fBchkey\fR will change the key
in the specified name service. However, if multiple name services are listed,
\fBchkey\fR can not decide which source to update and will display an error
message. The user should specify the source explicitly with the \fB-s\fR
option.
.sp
.LP
Non root users are not allowed to change their key pair in the \fBfiles\fR
database.
.SH OPTIONS
.LP
The following options are supported:
.sp
.ne 2
.na
\fB\fB-p\fR\fR
.ad
.RS 18n
Re-encrypt the existing secret key with the user's login password.
.RE

.sp
.ne 2
.na
\fB\fB-s\fR \fBnis\fR\fR
.ad
.RS 18n
Update the \fBNIS\fR database.
.RE

.sp
.ne 2
.na
\fB\fB-s\fR \fBfiles\fR\fR
.ad
.RS 18n
Update the  \fBfiles\fR database.
.RE

.sp
.ne 2
.na
\fB\fB-s\fR \fBldap\fR\fR
.ad
.RS 18n
Update the  LDAP database.
.RE

.sp
.ne 2
.na
\fB\fB-m\fR\fI <mechanism>\fR\fR
.ad
.RS 18n
Changes or re-encrypt the secret key for the specified mechanism.
.RE

.SH FILES
.ne 2
.na
\fB\fB/etc/nsswitch.conf\fR\fR
.ad
.RS 22n

.RE

.sp
.ne 2
.na
\fB\fB/etc/publickey\fR\fR
.ad
.RS 22n

.RE

.SH SEE ALSO
.LP
.BR keylogin (1),
.BR keylogout (1),
.BR nsswitch.conf (5),
.BR publickey (5),
.BR shadow (5),
.BR attributes (7),
.BR keyserv (8),
.BR newkey (8)