.TH AUTH 8.SH NAMEchangeuser, convkeys, convkeys2, printnetkey, status, enable, disable, authsrv, guard.srv, debug, wrkey, login, newns, none, as \- maintain or query authentication databases.SH SYNOPSIS.B auth/changeuser.RB [ -np ].I user.PP.B auth/convkeys.RB [ -p ].I keyfile.PP.B auth/convkeys2.RB [ -p ].I keyfile.PP.B auth/printnetkey.I user.PP.B auth/status.I user.PP.B auth/enable.I user.PP.B auth/disable.I user.PP.B auth/authsrv.PP.B auth/guard.srv.PP.B auth/debug.PP.B auth/wrkey.PP.B auth/login.I user.PP.B auth/newns[.B -ad] [.B -n.I namespace].I command.I arg\&....PP.B auth/none[.B -n.I namespace].I command.I arg\&....PP.B auth/as.I user.I command.SH DESCRIPTIONThese administrative commands run only on the authentication server..IR Changeusermanipulates an authentication database file system served by.IR keyfs (4)and used by file servers.There are two authentication databases,one holding information about Plan 9 accountsand one holding SecureNet keys.A.I userneed not be installed in both databasesbut must be installed in the Plan 9 database to connect to a Plan 9 service..PP.I Changeuserinstalls or changes.I userin an authentication database.It does not install a user on a Plan 9 file server; see.IR fossilcons (8)for that..PPOption.B -pinstalls.I userin the Plan 9 database..I Changeuserasks twice for a password for the new.IR user .If the responses do not matchor the password is too easy to guessthe.I useris not installed..I Changeuseralso asks for an APOP secret.This secret is used in the APOP (RFC1939),CRAM (RFC2195), andMicrosoft challenge/response protocols used forPOP3, IMAP, and VPN access..PPOption.B -ninstalls.I userin the SecureNet database and prints out a key for the SecureNet box.The key is chosen by.IR changeuser ..PPIf neither option.B -por option.B -nis given,.I changeuserinstalls the.I userin the Plan 9 database..PP.I Changeuserprompts forbiographical information such as email address,user name, sponsor and department number andappends it to the file.B /adm/netkeys.whoor.BR /adm/keys.who ..PP.I Convkeysre-encrypts the key file.IR keyfile .Re-encryption is performed in place.Without the.B -poption.I convkeysuses the key stored in NVRAMto decrypt the file, and encrypts it using the new key.By default, .I convkeysprompts twice for the new password.The.B -pforces.I convkeysto also prompt for the old password.The format of.I keyfileis described in.IR keyfs (4)..PPThe format of the key file changed between Release 2and 3 of Plan 9..I Convkeys2is like.IR convkeys .However, in addition to rekeying, it converts fromthe previous format to the Release 3 format..PP.I Printnetkeydisplays the network key as it should be entered into thehand-held Securenet box..PP.I Statusis a shell script that prints out everything known abouta user and the user's key status..PP.I Enable/disableare shell scripts that enable/disable both the Plan 9 andNetkey keys for individual users..PP.I Authsrvis the program, run only on the authentication server, that handles ticket requestson TCP port 567.It is startedby an incoming call to the serverrequesting a conversation ticket; its standard input and outputare the network connection..I Authsrvexecutes the authentication server's end of the appropriate protocol asdescribed in.IR authsrv (6)..PP.I Guard.srvis similar.  It is called whenever a foreign (e.g. Unix) system wantsto do a SecureNet challenge/response authentication..SS Anywhere commands.PPThe remaining commands need not be run on an authentication server..PP.I Debugattempts to authenticate using each.B p9sk1key found in.I factotumand prints progress reports..PP.I Wrkeyprompts for a machine key, host owner, and host domain and stores them inlocal non-volatile RAM..PP.I Loginallows a user to change his authenticated id to.IR user ..I Loginsets up a new namespace from.BR /lib/namespace ,starts a.IR factotum (4)under the new id and.IR exec s.IR rc (1)under the new id..PP.I Newnssets up a new namespace from.I namespace(default.BR /lib/namespace )and.IR exec sits arguments.If there are no arguments, it.IR exec s.BR /bin/rc .Under.BR -a ,.I newnsadds to the current namespace instead of constructing a new one.The.BR -doption enables debugging output..PP.I Nonesets up a new namespace from.I namespace(default.BR /lib/namespace )as the user.I noneand.IR exec sits arguments under the new id.If there are no arguments, it.IR exec s.BR /bin/rc .It's an easy way to run a command as.IR none ..PP.I Asexecutes.I commandas.IR user ..I Commandis a single argument to.IR rc ,containing an arbitrary.I rccommand.This only works for the hostowner and only if.L #¤/caphashstill exists..SH FILES.TF /sys/lib/httppasswords.TP.B /lib/ndb/authSpeaksfor relationships and mappings forRADIUS server id's..TP.B /adm/keys.whoList of users in the Plan 9 database..TP.B /adm/netkeys.whoList of users in the SecureNet database..TP.B /sys/lib/httppasswordsList of realms and passwords for HTTP access..SH SOURCE.B /sys/src/cmd/auth.SH "SEE ALSO".IR passwd (1),.I readnvramin.IR authsrv (2),.IR keyfs (4),.IR securenet (8).SH BUGSOnly CPU kernels permit changing userid.