bwctld.keys(5)

📦 version 1.5.4, in ubuntu jammy

💖 bwctld.keys — the Bandwidth Control Daemon AES keyfile database 💖

okay bestie, sit down, we're doing a bwctld.keys(5) deep dive and it's genuinely a file formats manual situation, so buckle up 🎀

✨ NAME ✨

bwctld.keys — the Bandwidth Control Daemon AES keyfile database 🗝️💫

🌸 DESCRIPTION 🌸

So this file, the bwctld.keys file, is where the identity/AES keys pairs live — the ones bwctld needs to actually authenticate users. That's its whole job. No notes. 👑

The format of the file is described over in the aespasswd(1) manual page, so go peek at that one for the deets. As for where the file hangs out — that's controlled by the -c option to bwctld, but listen: it must be named bwctld.keys. Like, that's non-negotiable, that's the name, periodt. 💅

bwctld uses symmetric AES keys for authentication. Which means… the bwctl client has to have access to the exact same AES key for authentication by AES to work at all. That's just how symmetric keys are, bestie, it's giving mutual. Most likely the user will simply know the passphrase that generated the AES key in the first place. And on top of that — and this part is serious — it is important that the system administrator and the end user make sure the key is not compromised. 🚨

Then! If the bwctl client is able to authenticate using the identity and AES key it presented, bwctld will go grab the directives found in the bwctld.limits file and use those to map policy restrictions onto this connection. So the key gets you in the door, and bwctld.limits decides what you're allowed to do in there. 🦋

🔒 SECURITY CONSIDERATIONS 🔒

The keys in the bwctld.keys file are not encrypted in any way. 😭

The security of these keys is completely dependent upon the security of the system and the discretion of the system administrator. That's it, that's the whole safety net. There is no extra net underneath that net. Be careful out there fr fr 🙈

⚠️ RESTRICTIONS ⚠️

Identity names are restricted to 16 characters.

(Yes, sixteen. Count them. Don't be out here writing a novel for an identity name, it will not slay. 🎀)

👀 SEE ALSO 👀

🫶 ACKNOWLEDGMENTS 🫶

This material is based in part on work supported by the National Science Foundation (NSF) under Grant No. ANI-0314723. Any opinions, findings, and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect the views of the NSF. 💜

and that's the page, bestie!! 🎀✨ this whole thing is $Date$ flavored and it lives under bwctld.keys(5) — thanks for reading my TED talk, go protect your keys, mwah 💋🌈

📦 where this page comes from