authcap.4 (2010 09)

a
authcap(4) authcap(4)
(TO BE OBSOLETED)
NAME
authcap - security databases for trusted systems
SYNOPSIS
/tcb/files/auth/*
/tcb/files/auth/system/*
DESCRIPTION
All security-relevant databases are stored in an ASCII format in the file system. This format is converted
to binary structures by support routines described in Section 3 manpages. This manpage describes the
format of these databases, and describes the philosophy of conversion into data structures.
Hierarchy Structure
The complete database resides in two hierarchies:
/tcb/files/auth/* and
/tcb/files. The
first hierarchy contains the Protected Password database, and has subdirectories with single letter
names, each of which is a starting letter for user names. Within each of these directories are regular
files, each containing an authcap (4) format file containing the Protected Password entry for a particular
user. Thus, all user names beginning with
x have their respective authentication and identity informa-
tion in a file in directory /tcb/files/auth/x.
Directories within
/tcb/files/auth/system
and /tcb/files contain system-wide information.
Global system settings reside in directory
/tcb/files/auth/system
. Terminal and device assign-
ment files are located in directory
/tcb/files.
The following database files reside in directory
system:
default Default Control
The following database files reside in directory
/tcb/files:
ttys Terminal Control
devassign Device Assignment
File Format
Each data file (
/tcb/files/auth/system
and /tcb/files) has the same format. Each file con-
sists of one virtual line, optionally split into multiple physical lines with the \ character present at the
end of all lines except the last. For example, the line
smk:u_name=smk:u_id#16:u_pwd=a78/a1.eitfn6:chkent:
can be split into:
smk:u_name=smk:u_id#16:\
:u_pwd=a78/a1.eitfn6:\
:chkent:
Note that all capabilities must be immediately preceded and followed with the : separator. Multiple line
entries require : at the end of each line and at the beginning of each continuation line in the entry. Con-
tinuation lines are indented by a tab character. Multiple entries are separated by a new-line character
that is not preceded by a continuation character:
daa:u_name=daa:u_id#75:u_maxtries#9:chkent:
smk:u_name=smk:u_id#76:u_maxtries#5:chkent:
Line Format
The format of a line is briefly as follows:
name:cap1:cap2:cap3:...:capn:chkent:
The entry is referenced by the name. The end of the name part of the entry is terminated by the : char-
acter.
At the end of each entry is the chkent field. This is used as an integrity check on each entry. The
auth-
cap routines reject all entries that do not contain the chkent terminator.
Each entry has 0 or more capabilities, each terminated with the
: character. Each capability has a
unique name. Numeric capabilities have the format:
id
#num
HP-UX 11i Version 3: September 2010 − 1 − Hewlett-Packard Company 1