FreeBSD Handbook : Security : S/Key : Secure connection initialization
Previous: S/Key
Next: Insecure connection initialization

6.2.1. Secure connection initialization

To initialize S/Key, change your password, or change your seed while logged in over a secure connection (e.g., on the console of a machine), use the `keyinit' command without any parameters while logged in as yourself:

$ keyinit
Updating wollman:			) these will not appear if you
Old key: ha73895			) have not used S/Key before
Reminder - Only use this method if you are directly connected.
If you are using telnet or rlogin exit with no password and use keyinit -s.
Enter secret password:			) I typed my pass phrase here
Again secret password:			) I typed it again

ID wollman s/key is 99 ha73896		) discussed below
SAG HAS FONT GOUT FATE BOOM		)

There is a lot of information here. At the `Enter secret password:' prompt, you should enter some password or phrase (I use phrases of minimum seven words) which will be needed to generate login keys. The line starting `ID' gives the parameters of your particular S/Key instance: your login name, the iteration count, and seed. When logging in with S/Key, the system will remember these parameters and present them back to you so you do not have to remember them. The last line gives the particular one-time password which corresponds to those parameters and your secret password; if you were to re-login immediately, this one-time password is the one you would use.


FreeBSD Handbook : Security : S/Key : Secure connection initialization
Previous: S/Key
Next: Insecure connection initialization