X-Git-Url: https://sipb.mit.edu/gitweb.cgi/wiki.git/blobdiff_plain/201a4fc4679ec7b0f88532f653ded847c6bf389c..b69d781273c9f7c9096adc972b59b47558385e50:/doc/root-instance.mdwn?ds=sidebyside

diff --git a/doc/root-instance.mdwn b/doc/root-instance.mdwn
index 301ed22..b53a8ac 100644
--- a/doc/root-instance.mdwn
+++ b/doc/root-instance.mdwn
@@ -36,23 +36,19 @@ wisest idea to let servers that you're asking hundreds of people to
 log into and use be controlled by a password you're typing everywhere.
 
 So you get a root instance, and only type the root instance password
-on computers you trust and only when you need to. Many people only
-ever type it on their laptop, or on a freshly booted Live CD. Some
-people feel comfortable typing it on a few private Athena workstations
-(SIPB office heads are a common choice), but if an attacker has stolen
-your regular (null instance) password and installed a keylogger on
-your account, it doesn't matter where you're logging in if it's still
-your Athena account.
+on computers you trust and only when you need to.  You should only
+type your password on a computer that you trust, such a private laptop
+or workstation.  If you have access to physical hardware that you
+trust, but not a trusted installation, you can use a printed LiveCD,
+or a one-time LiveUSB as created by hardware that you trust.
 
 You can also make things in Moira or AFS owned by your root instance,
 if you don't want your null instance to be able to mess with mailing
 lists or lockers. For Moira, make them owned by
-`KERBEROS:yourname.root@ATHENA.MIT.EDU`. (For legacy Kerberos 4 reasons,
-Moira and AFS both use a dot instead of a slash to separate the
-principal and the instance.) For AFS, ask accounts or afsreq to get
-you a 'pts id', basically an account with the AFS servers, and then
-you can give bits to yourname.root and start blanching your root
-instance onto AFS groups.
+`KERBEROS:yourname/root@ATHENA.MIT.EDU`. For AFS, ask accounts or
+afsreq to get you a 'pts id', basically an account with the AFS
+servers, and then you can give bits to yourname.root and start
+blanching your root instance onto AFS groups.
 
 To use another instance, just specify it to the kinit command, e.g.,
 `kinit joeuser/root`.
@@ -66,7 +62,7 @@ have developed shell scripts to make it easy to switch between them.
  * nelhage has the [krbroot
    command](http://web.mit.edu/nelhage/Public/krbroot), with which you
    use syntax like "krbroot ssh linerva" when you want to use your
-   root instance for a command. You can also "krbroot shell".
+   root instance for a command. You can also "krbroot shell". adehnert [extended it](https://www.dehnerts.com/gitweb/?p=user/alex/software/my-snippets.git;a=blob;f=krbroot;hb=HEAD) to add a `krbroot screen` subcommand, use `ATHENA_USER`, and support arbitrary principals.
 
  * quentin and broder wrote [kdo](http://web.mit.edu/snippets/kerberos/kdo),
    which is similar in spirit to krbroot, but designed for Mac OS
@@ -113,9 +109,9 @@ be sure to ask for a pts id, if you want to use your tickets with AFS.
 
 You should change your root instance’s password with a command like this, to upgrade your key from critically weak DES encryption algorithm to strong AES encryption:
 
-    kadmin -p andersk/root -q 'cpw -e aes256-cts:normal -e aes128-cts:normal andersk/root'
+    kadmin -p andersk/root -q 'cpw -e aes256-cts:normal,aes128-cts:normal andersk/root'
 
-(Note: This might make your password incompatible with a [handful of services](http://debathena.mit.edu/trac/ticket/529) that you should not have been using with your root instance in the first place.)  You can confirm the change with
+(Note: This previously made your password incompatible with a [handful of services](http://debathena.mit.edu/trac/ticket/529) that you should not have been using with your root instance in the first place, but these services have now been fixed.)  You can confirm the change with
 
     kadmin -p andersk/root -q 'getprinc andersk/root'