sfs_users(5)

NAME
sfs_users - user-authentication database

DESCRIPTION
The sfs_users file, maintained and used by the sfsauthd program, maps public keys to local users and groups. It is roughly analogous to the Unix /etc/passwd file. Each line of sfs_users has the following format (split into two lines here only for clarity of presentation):

[USER|GROUP]:user:uid:version:gid:owner:pubkey:privs
                        :srp:privkey:srvprivkey:audit

user
    user is the unique name of a public key in the database. Ordinarily it is the same as a username in the local password file. However, in certain cases it may be useful to map multiple public keys to the same local account (for instance if several people have an account with root privileges). In such cases, each key should be given a unique name (e.g., dm/root, kaminsky/root, etc.).

uid uid is the user's user ID on the given server.

version
    version is the version number of this record in the users database. Upon registration, this value is set to 1. Upon every subsequent update, this value is incremented by 1.

gid gid is the users's group ID on the given server.

owner
    This field is ignored as of SFS 0.7.

pubkey
    pubkey is an ASCII, human-readable representation of the user's public key. Can be either a Rabin or 2-Schnorr public key as of SFS 0.7.

privs
    The privs field indicates whether a field can be updated by the SFS admin--given of course that a Userfile is included with the -admin option.

srp srp is the server-side information for the SRP protocol. Unlike the previous fields, this information must be kept secret. If the information is disclosed, an attacker may be able to impersonate the server by causing the sfskey add command to fetch the wrong HostID. Note also that SRP-info is specific to a particular hostname. If you change the Location of a file server, users will need to register new SRP-info.

privkey
    privkey is actually opaque to sfsauthd. It is private, per-user data that sfsauthd will return to users who successfully complete the SRP protocol. Currently, sfskey users this field to store an encrypted copy of a user's private key, allowing the user to retrieve the private key over the network.

srvprivkey
    If a user has chosen 2-Schnorr proactive signatures, the server's half of the private key is kept in this field.

audit
    audit contains the time, source IP address, and description of the last update to this field. Useful in recovering from a compromised key.

Note if you edit sfs_users files by hand, you risk overwriting concurrent updates by sfsauthd. Use the vidb command to lock sfs_users files while you edit them.

FILES

/etc/sfs/sfs_users
/usr/local/share/sfs/sfs_users
    user-authentication database

(Files in /etc/sfs supersede default versions in /usr/local/share/sfs.)

SEE ALSO
dirsearch(1), newaid(1), rex(1), sfsagent(1), sfskey(1), ssu(1), sfs_config(5), sfs_srp_params(5), sfsauthd_config(5), sfscd_config(5), sfsrwsd_config(5), sfssd_config(5), funmount(8), sfsauthd(8), sfscd(8), sfsrwsd(8), sfssd(8), vidb(8)

The full documentation for SFS is maintained as a Texinfo manual. If the info and SFS programs are properly installed at your site, the command info SFS should give you access to the complete manual.

For updates, documentation, and software distribution, please see the SFS website at http://www.fs.net.

AUTHOR
sfsdev@redlab.lcs.mit.edu