FreeBSD Manual Pages
AFPPASSWD(1) Netatalk AFP Fileserver Manual AFPPASSWD(1) Name afppasswd -- AFP password maintenance utility Synopsis afppasswd [-cfnr] [-a username] [-p path] [-u minimum uid] [-w password string] afppasswd [-r] Description afppasswd creates and maintains the credential file used by the SRP ("Se- cure Remote Password") UAM and, with -r, the legacy afppasswd file used by the "Randnum exchange" and "2-Way Randnum exchange" UAMs. By default afppasswd operates in SRP mode and stores per-user salts and verifiers in the SRP verifier file (default afppasswd.srp under the ne- tatalk configuration directory, or whatever is configured via the "srp passwd file" option in afp.conf(5)). Pass -r to operate on the legacy Rand- num file (default afppasswd under the netatalk configuration directory, or as configured via the "passwd file" option) instead. There are two invocation styles: * As root, afppasswd manages credentials for any system user. The user is named with -a username (which both adds new entries and updates existing ones), or the entire file is initialized at once with -c. * As a regular user, afppasswd takes no positional arguments and changes the calling user's own AFP password: for SRP by default and for the legacy RandNum UAM with -r. The named user must already exist as a local system user. NOTE: The legacy Randnum and 2-Way Randnum UAMs only provide weak password protection and are discouraged. They should only be enabled to support very old AFP clients that cannot use SRP, DHX, or DHX2. Randnum requires a file named afppasswd.key at the same path as the afppasswd file. The key file contains a hex-encoded 8-byte DES key that Randnum uses to encrypt the stored password. afppasswd -r -c creates this key file if it is missing and validates an existing one. Randnum password updates refuse to proceed unless the key file is present and valid. The Randnum UAM logs a warning at startup when the key file is missing or invalid, but authentication and password changes still fail until it is fixed. The key file must contain exactly 16 hexadecimal characters, such as 0123456789ABCDEF, with an optional trailing newline. Generate a fresh ran- dom key for each server instead of reusing this example value. Examples Administrator initializing the SRP verifier file and adding a new user: example% sudo afppasswd -c example% sudo afppasswd -a newuser Enter NEW AFP password: (hidden) Enter NEW AFP password again: (hidden) afppasswd: updated SRP verifier. Administrator updating an existing user's SRP password: example% sudo afppasswd -a someuser Local user changing their own SRP password: example% afppasswd Administrator managing the legacy Randnum file at a non-default path: example% sudo afppasswd -r -c -p /usr/local/etc/afppasswd example% sudo afppasswd -r -a olduser -p /usr/local/etc/afppasswd Enter NEW AFP password: (hidden) Enter NEW AFP password again: (hidden) afppasswd: updated Randnum password. Options -a username Add or update the named user. Required when an administrator oper- ates on a specific user. Non-root invocations always operate on the calling user and do not accept this option. -c Create and initialize the password/verifier file. Existing entries are populated as placeholders for every local system user with a uid at or above the -u threshold; passwords still need to be set indi- vidually with -a. With -r, also create or validate the companion af- ppasswd.key file for the Randnum UAM. -f Force the action. With -c, allows overwriting an existing pass- word/verifier file. -r Operate on the legacy Randnum afppasswd file instead of the SRP ver- ifier file. Affects which file is read or created and which default path is used when -p is not given. -p path Override the default path of the password/verifier file. The default is the SRP verifier file in SRP mode and the Randnum afppasswd file with -r; both defaults can also be configured globally in afp.conf(5) via "srp passwd file" and "passwd file" respectively. -n If cracklib support is built into netatalk, this option disables password strength validation for this invocation. -u minimum uid The minimum user id (uid) that afppasswd considers when -c walks the local user database to populate the file. Defaults to 100. -w password string Use string as the password instead of typing it interactively. Use this option only when absolutely necessary, since the password may remain in the terminal history in plain text. Files afppasswd.srp Default SRP verifier file, located under the netatalk configuration directory. One line per user, formatted as user- name:hex_salt:hex_verifier. Override with -p or with the "srp passwd file" option in afp.conf(5). afppasswd Default legacy Randnum file, located under the netatalk configura- tion directory. Used only with -r. Override with -p or with the "passwd file" option in afp.conf(5). afppasswd.key Companion key file for the legacy Randnum file. It must contain ex- actly 16 hexadecimal characters with an optional trailing newline. See Also afpd(8), afp.conf(5) Author Contributors to the Netatalk Project (https://netatalk.io/contributors) Netatalk 4.5.0 AFPPASSWD(1)
Name | Synopsis | Description | Examples | Options | Files | See Also | Author
Want to link to this manual page? Use this URL:
<https://man.freebsd.org/cgi/man.cgi?query=afppasswd&sektion=1&manpath=FreeBSD+Ports+15.1.quarterly>