APT_AUTH.CONF(5)

📦
version 3.3.5 · 14 versions
, in arch rolling, nixpkgs unstable

💅 apt_auth.conf(5) — the APT login-file glow-up

okay so bestie, this is the manual page for apt_auth.conf, straight out of the APT manual collection. it's the little file that holds your logins so your sources and proxies don't have to be, like, publicly thirsty for your password. let's get into it 🎀

✨ NAME ✨

apt_auth.conf — the login configuration file for APT sources and proxies. yes. that's the whole vibe. 🦋

🌸 DESCRIPTION 🌸

so here's the situation. APT config files like sources.list(5) or apt.conf(5) literally need to be readable by everyone using apt tools on the system, because how else is everyone gonna get access to all the package-related info, like which packages are available in a repository? it's giving public information, it's giving main character energy, it's fine.

but login info? the stuff you need to connect to a proxy or to download data from a repository? that should not always be accessible by everyone 😭 and that's exactly why it can't just live in a file with world-readable file permissions. nope. not on our watch.

enter: the APT auth.conf file at /etc/apt/auth.conf, plus the .conf files living inside /etc/apt/auth.conf.d. these are where you stash your login information, in a netrc-like format, with restrictive file permissions. iconic behaviour, honestly. 🔥

🧚 NETRC-LIKE FORMAT 🧚

the format defined here is similar to the format of the ~/.netrc file used by ftp(1) and similar programs that interact with servers. it's a simple token-based format, and here are the tokens it recognizes — unknown tokens will be ignored, so don't stress if you see something random in there 🙈. tokens may be separated by spaces, tabs or newlines.

  • machine [protocol://]hostname[:port][/path] — entries get looked up by searching for the machine token that matches the hostname of the URI apt needs login information for. going beyond the netrc-format, a portnumber can be specified. if no port is given, the token matches for all ports. similar deal with the path: it's optional, and it's only needed and useful if multiple repositories with different login information live on the same server. a machine token with a path matches if the path in the URI starts with the path given in the token. once a match is made, the subsequent tokens are processed, and it stops when the end of file is reached or when it bumps into another machine token. 👑
heads up bestie: if protocol is not specified, the entry only matches https and tor+https. no cap.
  • login name — the username to be used. 💜
  • password string — the password to be used. 🍓

🌈 EXAMPLE 🌈

say you wanna supply login information for a user named apt with the password debian, for the sources.list(5) entry

deb https://example.org/debian trixie main

you could do it in the entry directly, like this:

deb https://apt:debian@example.org/debian trixie main

or, alternatively, an entry like the following in the auth.conf file could be used:

machine example.org
login apt
password debian

or, alternatively, all in a single line:

machine example.org login apt password debian

if you need to be more specific, all of these lines will also apply to the example entry:

machine example.org/deb login apt password debian
machine example.org/debian login apt password debian
machine example.org/debian/ login apt password debian

on the other hand, neither of the following lines apply (nope, not a single one 💀):

machine example.org:443 login apt password debian
machine example.org/deb/ login apt password debian
machine example.org/ubuntu login apt password debian
machine example.orga login apt password debian
machine example.net login apt password debian

⭐ NOTES ⭐

basic support for this feature has been present since version 0.7.25, but it was undocumented for years (the way that it just sat there being secretive 😭). the documentation was added in version 1.5, which also changed the implementation slightly. for maximum backward compatibility you should avoid multiple machine tokens with the same hostname — but if you need multiple, they should all have a path specified in the machine token.

and here's the slay part: login information in auth.conf is more flexible than the stuff in sources.list. for example, login information can be specified for parts of a repository only, or — if the sources.list entry redirects elsewhere — login information for the redirect destination can be supplied. so accommodating. so versatile. 🫶

🎀 FILES 🎀

  • /etc/apt/auth.conf — login information for APT sources and proxies in a netrc-like format. Configuration Item: Dir::Etc::netrc.
  • /etc/apt/auth.conf.d/*.conf — login information for APT sources and proxies in a netrc-like format. Configuration Item: Dir::Etc::netrcparts.

🦋 SEE ALSO 🦋

apt.conf(5) sources.list(5)

💀 BUGS 💀

APT bug page[1]. if you wish to report a bug in APT, please see /usr/share/doc/debian/bug-reporting.txt or the reportbug(1) command.

👑 AUTHOR 👑

APT team

🙈 NOTES 🙈

  1. APT bug page https://bugs.debian.org/src:apt
okay that's the whole page, you ate it, I'm obsessed 💖

and that's a wrap, bestie! this little gem is from APT 3.3.5, dated 02 December 2019 — go forth and configure your logins responsibly, with restrictive file permissions, like the icon you are 🌸💅✨ </content> </invoke>

📦 where this page comes from