.TH KEYSRV 4.SH NAMEkeysrv \- secret key server.SH SYNOPSIS.B auth/keysrv.SH DESCRIPTION.I Keysrvis a file service run on a connection to an authentication server.It allows a remote userto change a secret stored on the server by.IR keyfs (4),which must have been started before.IR keysrv ,in a name space with the authentication data available under.BR /mnt/keys ..PP.I Keysrvserves a single file,.BR secret ,on a connection accessed through file descriptor 0 (ie, the standard `input').When invoked, itfirst authenticates the connection using.IR security-auth (2),requiring the client to use.B sha1and.BR rc4_256 .If authentication succeeds,.I keysrvexports a name space containing a file.BR secret .The authentication ensures that only a user that possesses a valid certificate can connect to the service..PPIf the authenticated user (ie, the user name in the verified certificate)has an entry in.BR /mnt/keys ,as served by.IR keyfs (4),and that user has a non-empty secret,then the file.B secretwill accept reads and writes.(Otherwise, every read or write returns an appropriate error.)Every successful read returns 0 bytes; thus a read can be used to check that the user is known and has a secret key.Each write contains data of the following form:.IP.EX.fi.I oldhash[.I newsecret].EE.PP.I Oldhashis the SHA1 hash(see.IR keyring-sha1 (2))of the user's existing secret, as 20 hexadecimal digits.If the value of.I oldhashdoes not match that of the stored secret, the write returns an error and suitable diagnostic..I Oldhashis optionally followed by a.IR newsecret ,in clear text as a sequence of bytes (typically the secret as.IR utf (6)),separated from.I oldhashby a single space.If the.I oldhashmatches that of the secret currently stored,.I newsecretreplaces it.The write returns an error if.I oldhashdoes not match the stored value, or if something else goes wrong..PP.I Keysrvcan be invoked via.IR listen (1):.IP.EXlisten -t -A 'tcp!*!infkey' {auth/keysrv}.EE.PPNormally that is done automatically whenstarting an authentication service using.B svc/auth(see.IR svc (8))..PP.IR Passwd (1)dials the service, authenticates, and mounts the resulting connection on.BR /mnt/keysrv ,where it accesses the.B secretfile to change the secret..SH FILES.TF /mnt/keysrv.TP.B /mnt/keysmount point for.IR keyfs (4).TP.B /mnt/keysrvexported mount point for.I keysrv.SH SOURCE.B /appl/cmd/auth/keysrv.b.SH SEE ALSO.IR listen (1),.IR passwd (1),.IR keyfs (4),.IR logind (8)