Update the members page to reflect the new EC and full memebers

[wiki.git] / doc / root-instance.mdwn

diff --git a/doc/root-instance.mdwn b/doc/root-instance.mdwn
index 46666b15fe29ea57a71c0dc3c6603f13acf1353b..d3bc5eebf96ce6a98a83198d98d46780c63603ea 100644 (file)
--- a/doc/root-instance.mdwn
+++ b/doc/root-instance.mdwn
@@ -47,9 +47,7 @@ your Athena account.
 You can also make things in Moira or AFS owned by your root instance,
 if you don't want your null instance to be able to mess with mailing
 lists or lockers. For Moira, make them owned by
-`KERBEROS:yourname.root@ATHENA.MIT.EDU`. (For legacy Kerberos 4 reasons,
-Moira and AFS both use a dot instead of a slash to separate the
-principal and the instance.) For AFS, ask accounts or afsreq to get
+`KERBEROS:yourname/root@ATHENA.MIT.EDU`. For AFS, ask accounts or afsreq to get
 you a 'pts id', basically an account with the AFS servers, and then
 you can give bits to yourname.root and start blanching your root
 instance onto AFS groups.
@@ -100,9 +98,27 @@ extra instance's password instead.
 
 ## Getting them
 
-You need to show up in person to IS&T User Accounts in N42 with a
+You need to show up in person to [IS&T User
+Accounts](http://ist.mit.edu/support/accounts) in
+[E17](http://whereis.mit.edu/?go=E17) during business hours with a
 photo ID to obtain new Kerberos identities. For the reasons described
 above, being in control of your null instance and sending a zephyr or
 authenticated e-mail with it does not mean that you can go ahead and
 make changes to your root or extra instance too.  While you're there,
 be sure to ask for a pts id, if you want to use your tickets with AFS.
+
+## Upgrading cryptographic strength
+
+You should change your root instance’s password with a command like this, to upgrade your key from critically weak DES encryption algorithm to strong AES encryption:
+
+    kadmin -p andersk/root -q 'cpw -e aes256-cts:normal -e aes128-cts:normal andersk/root'
+
+(Note: This might make your password incompatible with a [handful of services](http://debathena.mit.edu/trac/ticket/529) that you should not have been using with your root instance in the first place.)  You can confirm the change with
+
+    kadmin -p andersk/root -q 'getprinc andersk/root'
+
+which should list a line like
+
+    Key: vno 4, aes256-cts-hmac-sha1-96, no salt
+
+If you change your password again, you will need to specify your desired enctypes with the -e option; otherwise, they will be reset to the defaults.