| 2 |
- |
1 |
.TH PASSWD 1
|
|
|
2 |
.SH NAME
|
|
|
3 |
passwd, netkey \- change or verify user password
|
|
|
4 |
.SH SYNOPSIS
|
|
|
5 |
.B passwd
|
|
|
6 |
[
|
|
|
7 |
.IR username [@ domain ]
|
|
|
8 |
]
|
|
|
9 |
.PP
|
|
|
10 |
.B netkey
|
|
|
11 |
.SH DESCRIPTION
|
|
|
12 |
.I Passwd
|
|
|
13 |
changes the invoker's Plan 9 password and/or APOP secret.
|
|
|
14 |
The Plan 9 password is used to login to a terminal while
|
|
|
15 |
the APOP secret is used for a number of external services:
|
|
|
16 |
POP3, IMAP, and VPN access. The optional argument specifies
|
|
|
17 |
the user name and authentication domain to use if different
|
|
|
18 |
than the one associated with the machine
|
|
|
19 |
.I passwd
|
|
|
20 |
is run on.
|
|
|
21 |
.PP
|
|
|
22 |
The program first prompts for the old Plan 9 password in the specified
|
|
|
23 |
domain to establish
|
|
|
24 |
identity.
|
|
|
25 |
It then prompts for changes to the password and the
|
|
|
26 |
secret.
|
|
|
27 |
New passwords and secrets must be typed twice, to forestall mistakes.
|
|
|
28 |
New passwords must be sufficiently hard to guess.
|
|
|
29 |
They may be of any length greater than seven characters.
|
|
|
30 |
.PP
|
|
|
31 |
.I Netkey
|
|
|
32 |
prompts for a password to encrypt network challenges.
|
|
|
33 |
It is a substitute for a SecureNet box.
|
|
|
34 |
.PP
|
|
|
35 |
These commands may be run only on a terminal, to avoid
|
|
|
36 |
transmitting clear text passwords over the network.
|
|
|
37 |
.SH SOURCE
|
|
|
38 |
.B /sys/src/cmd/auth/passwd.c
|
|
|
39 |
.br
|
|
|
40 |
.B /sys/src/cmd/auth/netkey.c
|
|
|
41 |
.SH "SEE ALSO"
|
|
|
42 |
.I readnvram
|
|
|
43 |
in
|
|
|
44 |
.IR authsrv (2),
|
|
|
45 |
.IR encrypt (2),
|
|
|
46 |
.IR cons (3),
|
|
|
47 |
.IR auth (8),
|
|
|
48 |
.IR securenet (8)
|
|
|
49 |
.PP
|
|
|
50 |
Robert Morris and Ken Thompson,
|
|
|
51 |
``UNIX Password Security,''
|
|
|
52 |
.I AT&T Bell Laboratories Technical Journal
|
|
|
53 |
Vol 63 (1984), pp. 1649-1672
|
|
|
54 |
.SH BUGS
|
|
|
55 |
Now that
|
|
|
56 |
.I cpu
|
|
|
57 |
connections are always encrypted, the only good reason
|
|
|
58 |
to require that these commands be run only on terminals
|
|
|
59 |
is concern that the CPU server might be subverted.
|