fs_nukenfscreds - Discard NFS translator tokens

       Copyright 2013 Sine Nomine Associates

       This  documentation  is  covered by the BSD License as written in the doc/LICENSE file. This man page was
       written by Andrew Deason for OpenAFS.

OpenAFS                                            2025-03-21                                 FS_NUKENFSCREDS(1)

       When using the NFS translator, it is possible for clients to supply AFS tokens that the NFS translator
       will use for NFS-originating accesses from a specific host and uid. The fsnukenfscreds command, when run
       on the translator host, will destroy all tokens for all uids for a specific NFS client host. After this
       command is run successfully, all accesses for all users from that host will be unauthenticated until they
       provide AFS tokens again.

       This command can be useful in the following scenario. Say you have an NFS client machine accessing a
       translator, and the machine is decommissioned, and a new machine is brought up with the same IP. If there
       are credentials associated with certain uids from that host, it is possible that accesses from the new
       host will use the same credentials from the old host, even if they haven't authenticated. With the
       fs_nukenfscreds command, you can destroy all credentials associated with the machine when it is
       decommissioned, ensuring that that situation cannot occur.

       The  following  example  destroys  credentials  from  all  PAGs  for  the  NFS  translator  client   host
       198.51.100.20:

          % fs nukenfscreds -addr 198.51.100.20

       fs_nukenfscreds - Discard NFS translator tokens

-addr <host>
           Specifies  which  host  to  invalidate  tokens  for.  Specify  either a resolvable host name or an IP
           address.

       -help
           Prints the online help for this command. All other valid options are ignored.

       If the specified tokens were destroyed successfully, no output is generated.

       The issuer must be logged in as the local superuser "root".

fs_exportafs(1), klog(1), knfs(1)

fsnukenfscreds-addr <host>
           [-help]

       fsnu-a <host>
           [-h]