ZEPHYRD(8)

💖 ZEPHYRD 💖

okay bestie, gather round, because today we're talking about zephyrd — a page from the System Manager's Manual (section 8, the big-girl sysadmin section, we love her) 🫶

---

✨ NAME ✨

zephyrd — the Zephyr server daemon. that's it, that's the girl. she's the server. 💅

---

🌸 SYNOPSIS 🌸

/usr/sbin/zephyrd [ -d ]

---

🦋 DESCRIPTION 🦋

okay so zephyrd is the central server for the Zephyr Notification System. main character energy, no notes. 👑

she keeps two things alive at all times:

• a location database of every single user who's currently logged in (she knows where you are, bestie, she's not creepy she's just thorough 💀)
• a subscription database for each user's Zephyr clients

zephyrd also talks to the daemons running on the other Zephyr server hosts, so that the whole service stays reliable. it's giving group project, except everyone actually does their part. 🌈

while she's running, any unusual conditions get recorded via syslog(3) to facility local6, at various levels. and if you pass the -d option? she logs additional debugging information. yes she's nosy. yes it's for your own good. 🔥

when a zephyrd gets executed, she asks Hesiod for a list of server machines, and she initializes her state from any zephyrds that are already running on the other known servers. but — and this is the important part — that initialization only happens after the zephyrds have authenticated themselves to each other via Kerberos. no vibes-based trust here, we do credentials. 🔐

then she enters a dispatch loop, servicing requests from clients and from other servers. forever. like a queen on her throne. 👑

---

💅 SIGNALS 💅

she responds to signals, and honestly the range is iconic:

• SIGUSR1 — enables logging of additional debugging information ✨
• SIGUSR2 — disables the logging of additional debugging information 🙈
• SIGHUP — causes zephyrd to re-read the default subscription file, and to re-query Hesiod about valid peers. any peers which are not responding and are no longer mentioned in Hesiod get flushed; any peers not previously named by Hesiod get added. it's a roster update, basically. 🎀
• SIGINT and SIGTERM — cause zephyrd to gracefully shut down 🫶 (she exits with dignity, unlike some daemons)
• SIGFPE — causes zephyrd to dump the location and subscription databases to /var/tmp/zephyr.db in an ASCII format 😭 like ok emergency but make it legible

---

🔐 ACCESS CONTROL 🔐

so certain notice classes are restricted by the Zephyr server. each such class has access control lists enumerating who may transmit (xmt-*.acl) or who may subscribe to that particular class.

subscriptions may be restricted either:

• absolutely — via sub-*.acl files
• by instance restrictions

and then we have the specific ones, listen up:

• iws-*.acl files control subscriptions to wildcarded instances
• iui-*.acl files control subscriptions to instances which are not the Kerberos principal identity of the subscriber

if an access control list of a given type is absent, there is no restriction of that type on the class — with one exception: any notices of the class must be authenticated. so no acl = no gatekeeping, but you still gotta prove who you are. periodt. 💅

and the class registry lists all classes which are restricted. 📋

---

🎀 FILES 🎀

here's where everything lives, bestie. memorize the paths, iykyk:

• /etc/zephyr/acl/class-registry.acl — list of classes which are restricted
• /etc/zephyr/acl/iws-*.acl — access control lists for instance-wildcard restrictions
• /etc/zephyr/acl/iui-*.acl — access control lists for instance-identity restrictions
• /etc/zephyr/acl/sub-*.acl — access control lists for subscribing
• /etc/zephyr/acl/xmt-*.acl — access control lists for transmitting
• /etc/zephyr/srvtab — Kerberos 4 Service keys
• /etc/zephyr/krb5.keytab — Kerberos V Service keys
• /var/run/zephyrd.tkt4 — current Kerberos 4 tickets for exchange with other servers
• /var/run/zephyrd.tkt — current Kerberos 5 tickets for exchange with other servers
• /var/tmp/zephyr.db — file containing an ASCII dump of the database

---

💀 BUGS 💀

not me having to report this but okay: the current implementation of the Zephyr server (zephyrd(8)) makes no distinction between realm-announced, net-visible and net-announced exposure levels. it just... doesn't. we're aware. we're all aware. 😭

---

👑 SEE ALSO 👑

• zephyr(1)
• zhm(8)
• kerberosintro(1)
• hesiod(3)
• access_control_lists(?)
• syslog(3)

also go read the Athena Technical Plan, specifically:

• Section E.4.1 (Zephyr Notification Service)
• Section E.2.1 (Kerberos Authentication and Authorization System)

homework but make it educational 🌸

---

⭐ AUTHOR ⭐

John T. Kohl, MIT Project Athena and Digital Equipment Corporation. a legend, frankly. 🫶

---

💜 RESTRICTIONS 💜

Copyright (c) 1987,1988 by the Massachusetts Institute of Technology. All Rights Reserved.

zephyr(1) specifies the terms and conditions for redistribution. so like, read that one before you start redistributing, bestie, it's all in there. 📜

---

and that's the whole page!! this beauty came out of MIT Project Athena and is dated July 1, 1988 — yes she's vintage, yes she still runs the notification system, we stan an elder icon 🎀✨💖