Bug 18535

	When S/Key authentication is enabled, a user can run keyinit to
generate keys in /etc/skeykeys.  That user can then use unsecured channels
to access the host with one time passwords.  When the user no longer wants
S/Key access though there is no easy way to remove the S/Key passwords.

	Consider a user who only uses S/Key when on a trip at unsecured
terminals, and the rest of the time uses ssh or kerberized telnet.  Upon
return the user would like to clear all S/Key entries, so there is no
possbility of someone being able to log in with S/Key, even if they have
the users secret password.

	This could also be useful if the users secret password was compromised.

	The only known way to clear the entries is to continue to log on
until all the keys are used up.

Fix: 

I suggest a command such as "keyclear" that removes the user's
S/Key entry from /etc/skeykeys.
How-To-Repeat: 
	Configure S/Key. :-)