AUTH(8)
NAME
adduser, changeuser, printnetkey, renameuser, removeuser, enable, disable, expire, status, convkeys, wrkey − maintain authentication databases
SYNOPSIS
auth/adduser [-hnp] user
auth/changeuser [-hnp] user
auth/printnetkey user
auth/renameuser [-np] user newname
auth/removeuser [-np] user
auth/enable [-np] user
auth/disable [-np] user
auth/expire [-np] user date
auth/status user
auth/convkeys [-d] [-k key] keyfile
auth/wrkey [-k key]
DESCRIPTION
These administrative commands run only on the authentication server. Adduser, changeuser, renameuser, removeuser, enable, disable, expire, and status manipulate an authentication database file system served by keyfs(4) and used by file servers. There are two authentication databases, one holding information about Plan 9 accounts and one holding SecureNet keys. A user need not be installed in both databases but must be installed in the Plan 9 database to connect to a Plan 9 service.
Adduser installs user in an authentication database. User must not already exist in the database. It does not install a user on a Plan 9 file server.
Option -p installs user in the Plan 9 database. Adduser asks twice for a password for the new user. If the responses do not match or the password is too easy to guess the user is not installed.
Option -n installs user in the SecureNet database and prints out a key for the SecureNet box. The key is chosen by adduser.
If neither option -p or option -n is given, adduser installs the user in the Plan 9 database.
Option -h makes user a host able to receive authenticated incoming network calls. All Plan 9 CPU servers must be installed as users with host permission in the Plan 9 authentication database. This option is significant only in the Plan 9 database.
Changeuser modifies information for users already installed. Its syntax is the same as adduser’s.
Printnetkey prints user’s SecureNet key without changing it.
Renameuser changes user’s name to newname in both of the authentication databases. If newname is already known in either database, renameuser reports an error and makes no change. The options are the same as for adduser, except that if neither option -p nor option -n is given, the user is renamed in both databases.
Removeuser deletes user from both of the authentication databases. The options are the same as for renameuser.
Enable and disable change the status of user’s accounts. The options are the same as for renameuser.
Expire changes the expiration date for user to date, which is either the string never or a date in the form yyyymmdd, where yyyy is the year, mm is the month, and dd is the day the account should expire.
Both enable and expire attempt to change both the Plan 9 and SecureNet databases. The options are the same as for renameuser.
Status prints the status and expiration date of user’s Plan 9 and SecureNet accounts.
Convkeys re-encrypts the key file keyfile. Re-encryption is performed in place. Any file or authentication server using the key file must simultaneously have its key modified or it will be unable to decrypt keyfile. Convkeys uses the key stored in non-volatile RAM to decrypt the file, and encrypts it using the new key. By default, convkeys prompts twice for the new password. Option -k instead takes key, which must be DESKEYLEN bytes long. Note that a key is not a password. Option -d uses /dev/crypt for decrypting the key file. The format of keyfile is described in keyfs(4).
Wrkey sets the key used by the authentication server to decrypt key files. By default, it prompts twice for the password. Option -k is as in convkeys. Once the key is set, keyfs should be restarted so it serves the correct keys.
FILES
The non-volatile RAM on the server, which stores the key used
to decrypt key files.
SEE ALSO
BUGS
After changing authentication information, it is necessary to issue the auth command on file servers that are doing their own authentication. See fs(8).
Plan 9 — January 03, 1993