skeyd(1)

NAME
skeyd - s/Key server

SYNOPSIS
skeyd

DESCRIPTION
skeyd(8) is a daemon program for authentication systems based on the one time password method. attempts to solve the distribution problem by centralizing the key file on a single system (the server) and making other systems (the clients) remotely and securely access the keys (that is, one time passwords). In other words, a single copy of is maintained on the server site, using the usual syntax and the usual skey tools. On the server site should be running; will answer queries coming from clients and provide them information in order to let clients authenticate users. should not be running on client systems; only goal is, infact, to answer queries from client systems. On client systems, authenticating application such as or connect to the server by means of a modified version of the library. That is, authenticating applications on client systems should be linked with the library provided in the STEL package in order to work in conjunction with the s/Key server. The systems relies on a single configuration file: /etc/skeydconf. It defines the address of the server ( skeyserver ), the port number is bound to ( skeyport ), and a DES encryption key, which is used for data transmissions between the clients and the server ( skeypwd ). All traffic between clients and server is, in fact, DES/CFB encrypted, a pseudo random initialization variable (IV) is used for each data exchange, and the MD4 algorithm is used to check data integrity for all data transmissions. This way, two goals are achieved: 1) it is harder, for malicious hackers, to passively and/or actively tamper with data transmissions and 2) the systems is more secure, since clients with a wrong key can not get any information from the server. The daemon should be run by The inetd.conf and services configuration files should be edited accordingly. For example: skeyd stream tcp nowait root /some/where/skeyd in.skeyd The port is, by arbitrary default, set to It can be set, however, to any free port.

SECURITY OF SKEYD
The security of the system basically depends on the secrecy of the skeypwd key which is shared between server and clients. For this reason, only reasonably sized, extra-dictionary keys should be used. The skeypwd key can be any length, since it is digested by means of the MD4 messages hashing function before being used with the DES algorithm. Actually, the most important security issue is secure distribution of the /etc/skeydconf configuration file to all parties. Distribution of this file should be done only once, when setting up the systems. However, no tools are provided to accomplish this task by now, and secure distribution of /etc/skeydconf is left as an exercise for the reader.

BUGS
The s/Key library is compiled with -DKEYD by default, in order to enable support. When compiled with -DSKEYD, skeylookup(3), violates the standard s/Key library syntax. It is possibile to compile the library by means of -DINSECURE, allowing clients to perform skey-setting for new skey users and skey-resetting for existing users. -DINSECURE is disabled by default, since trusting clients to perform key (re)setting is generally not a good idea. Use this option at your own risk.

DIAGNOSTIC
skeyd reports errors via syslog.

AUTHOR
David Vincenzetti <vince@dsi.unimi.it>, Stefano Taino <taino@dsi.unimi.it> and Fabio Bolognesi <bolo@dsi.unimi.it>.

SEE ALSO
skeydconf