AUTHMGR(8)

NAME
authmgr - network user authentication client

SYNOPSIS
authmgr

DESCRIPTION
The Firewall Toolkit user authentication client (authsrv) is a client-side interface to the OpenFWTK user authentication daemon (authmgr). It provides a convenient, command line interface for creating, modifying, disabling, and deleting users. See authsrv(8) for more information on the authentication management system.

  Configuration Options
authmgr reads configuration rules from the netperm-table. It reads all rules using the authmgr and * authmgr reads the netperm-table from top to bottom. If there are multiple rules in the table that could apply for a particular attribute, authmgr uses the first one that it finds. See netperm-table(5) for a more complete explanation of netperm-table syntax and precedence.

authmgr recognizes the following attributes:

authserver host port
    Specifies the host running the authentication server (and the port on which it runs) that the proxies use for authenticating users.

    host
        Specifies an IP address or host name.

    port
        Specifies a service name or port number.

COMMANDS
authmgr recognizes the following commands from within its command line interface:

addgroup user group [group..]
    Makes the user a member of the specified group(s). You must be a global administrator to use this command.

adduser user[fullname]
    Adds a user to the authentication database. You must be a global administrator or a group administrator to use this command. If you are a group administrator, users you create are the automatically made members of your group. Note that you still must enable a user after you have added the user.

    user
        Name of the user to be added to the authentication database. The user names must match the user names for the strong authentication system you are using. The user names in the user authentication management system do not generally need to match user names on the firewall itself. By default, you do not create any user accounts on the firewall, unless those accounts are used for system-wide authentication by PAM , sshd (8) authentication modules and alikes.

    fullname
        The user's full name or other descriptive text about the user. Use quotes for information that contains spaces.

deluser user
    Deletes the specified user from the authentication database. You must be a global administrator a group administrator to use this command. If you are a group administrator, the user must be a member of your group.

disable user
    Disable the specified user from the authentication database. The user's information remains in the database, but does not allow the user to use the system. The user authentication system disables users after a set number (configurable by the administrator) of failed login attempts. You must be the database administrator or a group administrator to use this command. If you are a group administrator, the user must be a member of your group.

display user
    Displays the status, authentication protocol, and last login of the specified user. You must be the database administrator or a group administrator to use this command. If you are a group administrator, the user must be a member of your group.

enable user [onetime]
    Allows users who have been disabled to use the system again. You must be the database administrator or a group administrator to use this command. If you are a group administrator, the user must be a member of your group.

    user
        Name of a user.

    onetime
        Enables the user for one successful authentication. After the user successfully authenticates once, authmgr automatically disables the user.

exit
    Exits authmgr.

help
    Displays a list of valid commands for authmgr.

list [group]

password [user] passwordtext
    Sets the password for the current user. You must be the database administrator or a group administrator to use this command. If you are a group administrator, the user must be a member of your group.

    user
        Name of a user. If you specify a user name, changes the password for the specified user.

    passwordtext
        Password for the current or specified user. Valid values depend on the protocol being used. For the default protocols, valid values are:

        SecurID
            The seed in hex

        SNK Eight 3-digit groups used to key the SNK calculator for this user

        S/Key
            The seed for the user's password

        password
            A reusable password. Use quotes if the password contains spaces.

proto user protocol
    Sets the authentication protocol for the specified user to the named protocol. You must be the database administrator or a group administrator to use this command. If you are a group administrator, the user must be a member of your group.

    user
        Name of a user.

    protocol
        The name of the authentication protocol. Available protocols depends on the protocols compiled into authmgr. By default, valid values are:

        •   SecurID

        •   snk

        •   Skey-md4

        •   Skey-md5

        •   Skey-SHA1

        •   Skey-rmd160

        •   password

quit
    Exits authmgr.

rename user newname [fullname]
    Changes the existing record for the existing user with the specified information.

    user
        Name of an existing user in the authentication database.

    newname
        The new user name that you wish to use.

    fullname
        The new user's full name or other descriptive text about the user. Use quotes for information that contains spaces.

revoke user group
    Exclude the user from members of the specified group. You must be a global administrator to use this command.

unwiz user group [group..]
    Removes the group administrator flags from the specified user. You must be a global administrator to use this command. This command has no effect on global administrators. To remove global administrator privileges from a user, delete and recreate the user.

wiz user group [group..]
    Makes the specified user a group administrator of the group(s) of which they are currently a member.

?   Displays a list of valid commands for authmgr.

EXAMPLES
This example shows the configuration lines in the netperm-table that indicate that the authentication client accesses the authentication server running on the same machine on port 7777:

    authmgr:        authserver 127.0.0.1 7777

This example shows an administrator running as root starting authmgr on the firewall, logging in as an administrative user, and creating and enabling a new user in the authentication database.

root@firewall # authmgr
Connected to server
authmgr-> login fwadmin
Password:                         password does not display
Logged in
authmgr-> list
Report for users in database
user       group      longname      status proto      last
----       -----      --------      -----  -----      ----
fwadmin                               y W  Skey-md5   Thu May  2 11:41:42 2007
scooter               Scooter Lindley y    Snk        Wed May  1 09:02:12 2007
authmgr-> adduser john 'John Whorfin'
ok - user added initially disabled
authmgr-> enable john
enabled
authmgr-> proto john Snk
changed
authmgr-> pass john '160 270 203 065 022 034 232 162'
Secret key changed
authmgr-> list
Report for users in database
user       group      longname      status proto      last
----       -----      --------      -----  -----      ----
fwadmin                               y W  Skey-md5   Thu May  2 11:41:42 2007
scooter               Scooter Lindley y    Snk        Wed May  1 09:02:12 2007
john                  John Whorfin    ena  Snk        never
authmgr-> quit
#

FILES

/usr/local/etc/netperm-table
    The network permissions file contains configuration information for the Firewall Toolkit, including authmgr.

BUGS
Report bugs to the fwtk-users mailing list. Include a complete example, explaining what you expected to happen and what actually happened. Be sure to indicate the type of system (operating system, hardware, etc.) you are using, as well as the version of authmgr.

AUTHOR
Alexei Kravchuk.

SEE ALSO
netperm-table(5), rc(8), authsrv(8)