AUTHKEYS(5)

📦 version 3.0.6, in debian bookworm, debian trixie, ubuntu jammy, ubuntu noble, ubuntu questing, ubuntu resolute, ubuntu stonking

💖 AUTHKEYS — the Heartbeat auth file, explained bestie-style 💖

okay so real talk, this is authkeys(5) from the Heartbeat cluster messaging layer, and honestly? she's a config file. but she's an important one. let's get into it 🫶

✨ NAME ✨

authkeys — the authentication file for the Heartbeat cluster messaging layer. that's it, that's the whole job, and she does it flawlessly 💅

🌸 DESCRIPTION 🌸

so heartbeat(8) reads /etc/ha.d/authkeys, right? and what that does is let Heartbeat securely authenticate cluster nodes. like, this is how your nodes prove to each other that they're actually part of the squad and not some random impostor trying to crash the party 🙈

⚠️ bestie. listen. this file must not be readable or writable by any users other than root. nobody else. not your cousin, not your cat, not nobody. lock it down 🔒

🎀 FILE FORMAT 🎀

you need two things in the authkeys file, minimum:

  1. a line that says which key to use in signing outgoing packets — like, the outgoing vibe ✈️
  2. one or more lines defining how incoming packets might be being signed — the receiving vibe 📥

and the file has to follow this format exactly, no improvising:

auth num
num method secret
num method secret
num method secret
...

now let's break down what all that means:

  • num is a numerical identifier, and it has to be between 1 and 15 inclusive. also it must be unique within the file — no duplicate numbers, that's not the vibe, that's a problem 💀
  • method is one of the available authentication signature methods (scroll down, bestie, the supported ones are listed right there 👇)
  • secret is an alphanumerical shared secret used to identify cluster nodes to each other. it's like a little handshake password between your nodes 🤝

and then auth num is the line that selects the currently active authentication method and secret. so whichever num you name there? that's the one in the spotlight, main character energy 👑

🌈 SUPPORTED SIGNATURE METHODS 🌈

here's what authkeys supports, listed here in alphabetical order (as the original says, even though the list itself is being a little chaotic about it, we love her anyway 💜):

  • md5 — the MD5 hash method. this one requires a shared secret. classic, reliable, she's been around.
  • sha1 — the SHA-1 hash method. this one also requires a shared secret. ✨
  • crc — the Cyclic Redundancy Check hash method. this one does not require a shared secret, and bestie... it's insecure. it's use is strongly discouraged. like, do not. 🚫 no cap, we're being so serious about this one. please don't run crc unless you genuinely have no other option and have accepted your fate 💀
🦋 want the absolutely up-to-date list of authentication methods supported? you can grab it by running ls /usr/lib/heartbeat/plugins/HBauth/*.so. go look, the plugins will tell you everything ✨

👑 AUTHORS 👑

the icons who made this happen:

  • Alan Robertson <alanr@unix.sh> — heartbeat, original Wiki page 📝
  • Lars Ellenberg <lars.ellenberg@linbit.com> — Heartbeat Maintainer; code fixes; documentation updates 🔧
  • Florian Haas <florian.haas@linbit.com> — man page 📖

💌 the sign-off

this whole thing is from Heartbeat 3.0.6, dated 24 Nov 2009 — yeah she's vintage, she's an icon, she predates half the apps on your phone and she's still out here authenticating cluster nodes. respect the elders 💅✨🎀

okay love you, go fix your permissions, bye 💖🦋🌸

📦 where this page comes from