ref: f70ebd8e628b12973b12da12fa83aa67f39f2efa
parent: 77ad456b31b2258be4c2fa2f4842910a7c92062c
author: cinap_lenrek <cinap_lenrek@felloff.net>
date: Mon Jan 1 23:50:13 EST 2018
factotum(4): document dp9ik, update protocol list
--- a/sys/man/4/factotum
+++ b/sys/man/4/factotum
@@ -81,6 +81,8 @@
can act in the role of client for any process possessing the
same user id as it. For select protocols such as
.B p9sk1
+and
+.B dp9ik
it can also act as a client for other processes provided
its user id may speak for the other process' user id (see
.IR authsrv (6)).
@@ -98,19 +100,24 @@
a metaprotocol used to negotiate which actual protocol to use.
.TP
.B p9sk1
-a Plan 9 shared key protocol described in
+legacy Plan 9 shared key protocol described in
.IR authsrv (6)'s
-``File Service'' section.
+``Ticket Service''
+and
+``P9sk1'' sections.
.TP
-.B p9sk2
-a variant of
+.B dp9ik
+extended version of
.B p9sk1
-described in
+that adds password bruteforce resistance and forward secrecy (see
.IR authsrv (6)'s
-``Remote Execution'' section.
+``Password authenticated key exchange''
+and
+``Dp9ik''
+sections).
.TP
.B p9cr
-a Plan 9 protocol that can use either
+legacy Plan 9 protocol that can use either
.B p9sk1
keys or SecureID tokens.
.TP
@@ -142,9 +149,6 @@
.IR vnc (1)'s
challenge/response.
.TP
-.B wep
-WEP passwords for wireless ethernet cards.
-.TP
.B wpapsk
WPA passwords for wireless ethernet cards.
.PD
@@ -193,9 +197,11 @@
.TP
.B \-S
indicates that the agent is running on a
-CPU server. On starting, it will attempt to get a
+CPU server. On starting, it will attempt to get
.B p9sk1
-key from NVRAM using
+and
+.B dp9ik
+keys from NVRAM using
.B readnvram
(see
.IR authsrv (2)),
@@ -265,11 +271,13 @@
file.
The required attributes depend on the authentication protocol.
.PP
-.BR P9sk1 ,
-.BR p9sk2 ,
+.BR Dp9ik ,
+.B p9sk1
and
-.BR p9cr
+.B p9cr
all require a key with
+.BR proto = dp9ik
+or
.BR proto = p9sk1 ,
a
.B dom
@@ -283,7 +291,7 @@
to be used. Here is an example:
.PP
.EX
- proto=p9sk1 dom=avayalabs.com user=presotto !password=lucent
+ proto=dp9ik dom=9front user=glenda !password=secret
.EE
.PP
.BR Apop ,
@@ -338,24 +346,10 @@
By convention, programs using the RSA protocol also require a
.B service
attribute set to
-.BR ssh ,
-.BR sshserve ,
+.B ssh
or
.BR tls .
.PP
-.B Wep
-requires a
-.BR key1 ,
-.BR key2 ,
-or
-.BR key3
-set to the password to be used.
-Starting the protocol causes
-.I factotum
-to configure the wireless ethernet card
-.B #l/ether0
-for WEP encryption with the given password.
-.PP
All keys can have additional attributes that act either as comments
or as selectors to distinguish them in the
.IR auth (2)
@@ -402,9 +396,11 @@
.PP
Whenever
.I factotum
-runs as a server, it must have a
+runs as a server, it must have
+.B dp9ik
+or
.B p9sk1
-key in order to communicate with the authentication
+keys in order to communicate with the authentication
server for validating passwords and challenge/responses of
other users.
.SS "Key Templates
@@ -743,3 +739,5 @@
.RE
.SH SOURCE
.B /sys/src/cmd/auth/factotum
+.SH "SEE ALSO"
+.IR authsrv (6)