AFPPASSWD(1)

✨ AFPPASSWD(1) ✨ — Netatalk AFP Fileserver Manual 💖

🎀 Name

Okay so bestie, afppasswd is the AFP password maintenance utility 💅 It's giving "keep your credentials in check" energy. 🦋

🌸 Synopsis

afppasswd [-cfnr] [-a username] [-p path] [-u minimum uid] [-w password
string]

afppasswd [-r]

💜 Description

Okay, so afppasswd is the one that creates and maintains the credential file for the SRP ("Secure Remote Password") UAM 🔐 And if you add -r, it also handles the legacy afppasswd file used by the "Randnum exchange" and "2-Way Randnum exchange" UAMs. Iykyk 🙈

By default, afppasswd runs in SRP mode and stores per-user salts and verifiers in the SRP verifier file. The default is afppasswd.srp under the netatalk configuration directory, but you can change it with the "srp passwd file" option in afp.conf(5) ✨ Pass -r to work on the legacy Randnum file instead (default afppasswd under the netatalk configuration directory, or whatever you set with the "passwd file" option) 🧚

There are two invocation styles, and they are literally giving two different vibes:

• 👑 As root, afppasswd manages credentials for any system user. You name the user with -a username, which both adds new entries and updates existing ones. Or you can initialize the whole file at once with -c 💅
• 🫶 As a regular user, afppasswd takes no positional arguments and changes your own AFP password. It's SRP by default, and the legacy RandNum UAM with -r 🌈

The named user has to already exist as a local system user, no cap 🧢

NOTE: The legacy Randnum and 2-Way Randnum UAMs only provide weak password protection and are discouraged 💀 They should only be enabled to support very old AFP clients that can't use SRP, DHX, or DHX2. Randnum requires a file named afppasswd.key at the same path as the afppasswd file. That key file holds a hex-encoded 8-byte DES key that Randnum uses to encrypt the stored password. Running afppasswd -r -c creates this key file if it's missing and validates an existing one. Randnum password updates refuse to proceed unless the key file is present and valid. The Randnum UAM logs a warning at startup when the key file is missing or invalid, but authentication and password changes still fail until it's fixed. 😭

The key file must contain exactly 16 hexadecimal characters, such as 0123456789ABCDEF, with an optional trailing newline. Generate a fresh random key for each server instead of reusing this example value 🔑✨

🍓 Examples

Administrator initializing the SRP verifier file and adding a new user:

example% sudo afppasswd -c
example% sudo afppasswd -a newuser
Enter NEW AFP password: (hidden)
Enter NEW AFP password again: (hidden)
afppasswd: updated SRP verifier.

Administrator updating an existing user's SRP password:

example% sudo afppasswd -a someuser

Local user changing their own SRP password:

example% afppasswd

Administrator managing the legacy Randnum file at a non-default path:

example% sudo afppasswd -r -c -p /usr/local/etc/afppasswd
example% sudo afppasswd -r -a olduser -p /usr/local/etc/afppasswd
Enter NEW AFP password: (hidden)
Enter NEW AFP password again: (hidden)
afppasswd: updated Randnum password.

🌈 Options

• -a username — Add or update the named user. This is required when an admin is operating on a specific user. Non-root invocations always work on the calling user, so they don't accept this one 🙅‍♀️
• -c — Create and initialize the password/verifier file. Existing entries get filled in as placeholders for every local system user with a uid at or above the -u threshold. You still need to set passwords individually with -a 💖 With -r, it also creates or validates the companion afppasswd.key file for the Randnum UAM.
• -f — Force it! With -c, this lets you overwrite an existing password/verifier file 💥
• -r — Work on the legacy Randnum afppasswd file instead of the SRP verifier file. This changes which file gets read or created, and which default path gets used when -p isn't given 🦋
• -p path — Override the default path of the password/verifier file. The default is the SRP verifier file in SRP mode and the Randnum afppasswd file with -r. Both defaults can be configured globally in afp.conf(5) via "srp passwd file" and "passwd file" respectively 🌸
• -n — If cracklib support is built into netatalk, this turns off password strength validation for this run 🙈
• -u minimum uid — The minimum user id (uid) that afppasswd considers when -c walks the local user database to fill the file. It defaults to 100 ✨
• -w password string — Use string as the password instead of typing it in interactively. Only do this when it's absolutely necessary, because the password may stick around in your terminal history in plain text 😬

📁 Files

• afppasswd.srp — The default SRP verifier file, living under the netatalk configuration directory. It has one line per user, formatted as username:hex_salt:hex_verifier. Override it with -p or the "srp passwd file" option in afp.conf(5) 🧚
• afppasswd — The default legacy Randnum file, under the netatalk configuration directory. Only used with -r. Override it with -p or the "passwd file" option in afp.conf(5) 💜
• afppasswd.key — The companion key file for the legacy Randnum file. It must contain exactly 16 hexadecimal characters with an optional trailing newline 🔑

🫶 See Also

afpd(8), afp.conf(5) 💅

👑 Author

Contributors to the Netatalk Project 💖

---

Netatalk 4.5.1, AFPPASSWD(1) — bestie, that's a wrap! Source version 4.5.1 🌈💅✨ Stay iconic, and I'll see you in the next manpage, periodt 🦋💖