AMANDA-AUTH-SSL(7)

💅 AMANDA-AUTH-SSL 💅

okay so bestie, welcome to amanda-auth-ssl — the (7) miscellanea page that explains how SSL does its thing between the Amanda server and client. yes it's a mouthful, no you're not gonna fall asleep, i promise 🫶

---

✨ DESCRIPTION ✨

so this authenticate method uses an ssl certificate to authenticate the host, and literally everything that travels over the network is encrypted. no peeking, no snooping, none of that 💅

the important bit: each amanda client/server must have its own certificate signed by the amanda CA certificate. no exceptions, no shortcuts, periodt.

---

🛠️ COMPILATION AND GENERAL INFORMATION 🛠️

Amanda must be configured with --with-ssl-security. that's the vibe check this whole thing needs to pass ✨

---

🎀 SERVER/CLIENT CONFIGURATION 🎀

these live in amanda.conf and amanda-client.conf. yes, both. keep up 👑

• ssl-dir the directory where amanda stores all the certificates. a good value is ~/amanda-ssl 🍓
• ssl-check-certificate-host check that the peer hostname matches the certificate host name.
• ssl-check-fingerprint check that the certificate's fingerprint is the same as the fingerprint we already have for that host.
• ssl-check-host do the bsd check — i.e. the dns name of the peer IP is the hostname we connect to.

---

🦋 FILESYSTEM LAYOUT FOR CERTIFICATES 🦋

the way this directory tree just *makes sense*… iconic honestly:

$SSL_DIR/CA/crt.pem                   # CA certificate that signed
                                      all certificates.
$SSL_DIR/CA/private/key.pem           # CA private key
                                      (on server only)
$SSL_DIR/me/crt.pem                   # public certificate of the host
$SSL_DIR/me/private/key.pem           # private key of the host
$SSL_DIR/me/fingerprint               # fingerprint of my certificate
$SSL_DIR/remote/HOSTNAME/fingerprint  # fingerprint of the HOSTNAME
                                      certificate

and here's the cute little plot twist 🔥 — on the HOSTNAME host, $SSL_DIR/remote/HOSTNAME is a symbolic link to ../me. self-referential slay.

---

🧚 PROGRAM TO HELP CONFIGURATION 🧚

the amssl program is a tool to manage the certificate. it's giving personal assistant energy, honestly. use it 💖

---

🌈 SEE ALSO 🌈

amanda(8), amanda.conf(5), amanda-client.conf(5), disklist(5), amdump(8), amrecover(8), amssl(8), amanda-auth(7)

The Amanda Wiki: : http://wiki.zmanda.com/ — yes that's a colon before the colon, no i don't make the rules 🙈

---

👑 AUTHORS 👑

• Jean-Louis Martineau <martineau@zmanda.com> Zmanda, Inc. (http://www.zmanda.com)
• Dustin J. Mitchell <dustin@zmanda.com> Zmanda, Inc. (http://www.zmanda.com)
• Paul Yeatman <pyeatman@zmanda.com> Zmanda, Inc. (http://www.zmanda.com)

---

and that's the whole page, bestie!! 💖 go forth, encrypt everything, get those certificates signed, and remember — fingerprint checks are not optional vibes, they're the whole point 🎀

this has been Amanda 3.5.4, dated 07/23/2025 — mwah, catch you in the next manpage 💅✨