sfsauthd_config(5)

NAME
sfsauthd_config - user-authentication daemon confiuration

DESCRIPTION

Hostname name
    Set the Location part of the server's self-certifying pathname. The default is the current host's fully-qualified hostname.

Keyfile path
    Tells sfsrwsd to look for its private key in file path. The default is sfs_host_key. SFS looks for file names that do not start with / in /etc/sfs, or whatever directory you specified if you used the -with-etcdir option to configure ().

Userfile [-update] [-create] [-passwd] [-admin] [-prefix=prefix] [-uid=uid | -uidmap=u1-u2+u3] [-gid=gid | -gidmap=g1-g2+g3] [-pub=pubpath] path
    This specifies a file in which sfsauthd should look for user public keys when authenticating users. You can specify multiple Userfile directives to use multiple files. This can be useful in an environment where most user accounts are centrally maintained, but a particular server has a few locally-maintained guest (or root) accounts.

    Userfile has the following options:

    -update
        Specifies a user database as updatable. Users can register new public keys, update their public keys, and change their server key information on writable databases. If this command is not given, the database is assumed to read-only and possibly on a remote machine. Thus, sfsauthd maintains local copies of read-only databases in /var/sfs/authdb. This process ensures that temporarily unavailable file servers never disrupt sfsauthd's operation.

    -create
        Create an empty sfs_users file if no such file exists.

    -passwd
        Treat the Unix passwd file (/etc/passwd on most machines) as part of this userfile. Use password, shell and home directory information. Allows users who do not exist in the database to log into sfsauthd with their UNIX password, so that they might register an SFS key (note this allso requires the -update flag). See sfskey register, for details on this. Also important for proper functioning of rexd.

    -admin
        Allow an SFS administrator to make changes to user records that have the admin flag set in their privs field.

    -prefix=prefix
        Prepend the prefix prefix to usernames in the given userfile.

    -uid=uid
    -uidmap=u1-u2+u3
        These options are mutually exclusive. The first maps every user's credentials in the given file to the given UID, uid. The second maps users in the UID range (u1 to u2) to the offset u3. For example, if you wanted to map users to 1000-2520 to 61000-62520, you would supply -uidmap=1000-2520+60000.

    -gid=gid
    -gidmap=g1-g2+g3
        See above. Functions the same as gid and gidmap, but applies to group IDs, rather than user IDs. Again, these options are mutually exclusive.

    -pub=pubpath
        sfsauthd supports the secure remote password protocol, or SRP. SRP lets users connect securely to sfsauthd with their passwords, without needing to remember the server's public key. To prove its identity through SRP, the server must store secret data derived from a user's password. The file path specified in Userfile contains these secrets for users opting to use SRP. The -pub option tells sfsauthd to maintain in pubpath a separate copy of the database without secret information. pubpath might reside on an anonymously readable SFS file system--other machines can then import the file as a read-only database using a Userfile line with the -update flag.

    If no Userfile directive is specified, sfsauthd uses the following default (again, unqualified names are assumed to be in /etc/sfs):

      Userfile -update -passwd -pub=sfs_users.pub sfs_users

Logfile path
    Use the logfile given by path to output the signature log generated by sfsauthd. The default logfile is /var/sfs/sign_log.

SRPfile path
    Where to find default parameters for the SRP protocol. Generate such a file using the "sfskey gensrp" command. The default is sfs_srp_params. If the default file does not exist, serving pre-generated SRP parameters is disabled.

Denyfile path
    Specify a file containing a list of users that are to be explicitly denied the ability to register and update keys on the authserver. The default is sfs_deny. If the default file does not exist, we assume an empty list.

Realm name
    Define the realm to which this authserver will belong. Authentication information (including SRP) can be shared amongst authservers that are in the same realm. Thus, a user that wants to authenticate to a realm, can contact any authserver in that realm.

    If the realm directive does NOT appear in this file, the authserver will not join any realm. This behavior is the default. If the realm directive does appear, name cannot be empty.

    NOTE: Changing an authserver's realm after users have already registered using SRP requires all users to update their authentication data because the realm is bound into the stored SRP information. Specifically, each user will need to run

      sfskey update -r username@authserver
    A user logged on to the authserver can use the hostname - to signify the local host:

      sfskey update -r -

Certpath dir [dir ...]
    Specify a certification path to return to the client as a result of an "sfskey login" command; this list of directories will become the arguments to a dirsearch certprog. That is, for a certpath "dir1 dir2" the client will add a certprog "dirsearch dir1 dir2" to the user's agent. The certification path will be tagged with a prefix equal to the authserver's realm (see above).

    NOTE: The certpath directive only makes sense if the authserver is part of a realm. The certpath will be ignored if the realm directive isn't specified.

    There are three ways to specify a certpath directory:

      certpath //dir1 /dir2 @sfs.host.domain,HOSTID/dir2
    which can also be written

      certpath //dir1
      certpath /dir2
      certpath @sfs.host.domain,HOSTID/dir2
    A directory starting with two slashes ("//") is considered relative to the client machine's root ("/"). A directory starting with one slash ("/") is relative to the authserver's self-certifying pathname (the authserver performs the substitution before is sends the dir). The third form is a fully specified directory on SFS.

    The default certpath is empty.

FILES

/etc/sfs/sfsauthd_config
/usr/local/share/sfs/sfsauthd_config
    user-authentication daemon confiuration

(Files in /etc/sfs supersede default versions in /usr/local/share/sfs.)

SEE ALSO
dirsearch(1), newaid(1), rex(1), sfsagent(1), sfskey(1), ssu(1), sfs_config(5), sfs_srp_params(5), sfs_users(5), sfscd_config(5), sfsrwsd_config(5), sfssd_config(5), funmount(8), sfsauthd(8), sfscd(8), sfsrwsd(8), sfssd(8), vidb(8)

The full documentation for SFS is maintained as a Texinfo manual. If the info and SFS programs are properly installed at your site, the command info SFS should give you access to the complete manual.

For updates, documentation, and software distribution, please see the SFS website at http://www.fs.net.

AUTHOR
sfsdev@redlab.lcs.mit.edu