# Name

afppasswd — AFP password maintenance utility

# Synopsis

**afppasswd** [-cfnr] [-a *username*] [-p *path*] [-u *minimum uid*] [-w *password string*]

**afppasswd** [-r]

# Description

**afppasswd** creates and maintains the credential file used by the SRP
("Secure Remote Password") UAM and, with **-r**, the legacy *afppasswd*
file used by the "Randnum exchange" and "2-Way Randnum exchange" UAMs.

By default **afppasswd** operates in **SRP mode** and stores per-user
salts and verifiers in the SRP verifier file (default *afppasswd.srp*
under the netatalk configuration directory, or whatever is configured
via the "**srp passwd file**" option in **afp.conf**(5)). Pass **-r**
to operate on the legacy Randnum file (default *afppasswd* under the
netatalk configuration directory, or as configured via the
"**passwd file**" option) instead.

There are two invocation styles:

- *As root*, **afppasswd** manages credentials for any system user.
  The user is named with **-a** *username* (which both adds new entries
  and updates existing ones), or the entire file is initialized at once
  with **-c**.
- *As a regular user*, **afppasswd** takes no positional arguments and
  changes the calling user's own AFP password: for SRP by default and for
  the legacy RandNum UAM with **-r**.

The named user must already exist as a local system user.

> ***NOTE:*** The legacy Randnum and 2-Way Randnum UAMs only provide
weak password protection and are discouraged. They should only be enabled
to support very old AFP clients that cannot use SRP, DHX, or DHX2.
Randnum requires a file named *afppasswd.key* at the same path as the
*afppasswd* file. The key file contains a hex-encoded 8-byte DES key that
Randnum uses to encrypt the stored password. **afppasswd -r -c** creates
this key file if it is missing and validates an existing one. Randnum
password updates refuse to proceed unless the key file is present and valid.
The Randnum UAM logs a warning at startup when the key file is missing or
invalid, but authentication and password changes still fail until it is fixed.

The key file must contain exactly 16 hexadecimal characters, such as
`0123456789ABCDEF`, with an optional trailing newline. Generate a fresh random
key for each server instead of reusing this example value.

# Examples

Administrator initializing the SRP verifier file and adding a new user:

    example% sudo afppasswd -c
    example% sudo afppasswd -a newuser
    Enter NEW AFP password: (hidden)
    Enter NEW AFP password again: (hidden)
    afppasswd: updated SRP verifier.

Administrator updating an existing user's SRP password:

    example% sudo afppasswd -a someuser

Local user changing their own SRP password:

    example% afppasswd

Administrator managing the legacy Randnum file at a non-default path:

    example% sudo afppasswd -r -c -p /usr/local/etc/afppasswd
    example% sudo afppasswd -r -a olduser -p /usr/local/etc/afppasswd
    Enter NEW AFP password: (hidden)
    Enter NEW AFP password again: (hidden)
    afppasswd: updated Randnum password.

# Options

**-a** *username*

> Add or update the named user. Required when an administrator operates
on a specific user. Non-root invocations always operate on the calling
user and do not accept this option.

**-c**

> Create and initialize the password/verifier file. Existing entries are
populated as placeholders for every local system user with a uid at or
above the **-u** threshold; passwords still need to be set individually
with **-a**. With **-r**, also create or validate the companion
*afppasswd.key* file for the Randnum UAM.

**-f**

> Force the action. With **-c**, allows overwriting an existing
password/verifier file.

**-r**

> Operate on the legacy Randnum *afppasswd* file instead of the SRP
verifier file. Affects which file is read or created and which default
path is used when **-p** is not given.

**-p** *path*

> Override the default path of the password/verifier file. The default is
the SRP verifier file in SRP mode and the Randnum *afppasswd* file with
**-r**; both defaults can also be configured globally in **afp.conf**(5)
via "**srp passwd file**" and "**passwd file**" respectively.

**-n**

> If cracklib support is built into *netatalk*, this option disables
password strength validation for this invocation.

**-u** *minimum uid*

> The minimum *user id* (uid) that **afppasswd** considers when **-c**
walks the local user database to populate the file. Defaults to 100.

**-w** *password string*

> Use *string* as the password instead of typing it interactively. Use
this option only when absolutely necessary, since the password may
remain in the terminal history in plain text.

# Files

*afppasswd.srp*

> Default SRP verifier file, located under the netatalk configuration
directory. One line per user, formatted as
*username:hex_salt:hex_verifier*. Override with **-p** or with the
"**srp passwd file**" option in **afp.conf**(5).

*afppasswd*

> Default legacy Randnum file, located under the netatalk configuration
directory. Used only with **-r**. Override with **-p** or with the
"**passwd file**" option in **afp.conf**(5).

*afppasswd.key*

> Companion key file for the legacy Randnum file. It must contain exactly
16 hexadecimal characters with an optional trailing newline.

# See Also

afpd(8), afp.conf(5)

# Author

[Contributors to the Netatalk Project](https://netatalk.io/contributors)
