Updated docs

[mirror/userdir-ldap.git] / doc / ud-info.1.yo

diff --git a/doc/ud-info.1.yo b/doc/ud-info.1.yo
index 10ca844..841a01f 100644 (file)
--- a/doc/ud-info.1.yo
+++ b/doc/ud-info.1.yo
@@ -35,6 +35,7 @@ itemize(
   it() loginshell - Full path to the prefered Unix login shell. e.g. file(/bin/bash)
   it() emailforward - Destination email address.
   it() userpassword - Encrypted version of the password. [root]
+  it() sshrsaauthkey - SSH RSA public authentication key.
   it() supplementarygid - A list of group names that the user belongs.
            This field emulates the functionality of the traditional Unix group
           file. [root]
@@ -62,9 +63,9 @@ Maintainer-only information includes precise location information
 [postalcode, postal address, lat/long] telephone numbers, and the vacation
 message.
 
-Admin-only/maintainer-only information includes email forwarding and the 
-encrypted password. Note that email forwarding is necessarily publicly viewable 
-from accounts on the actual machines.
+Admin-only/user-only information includes email forwarding, ssh keys and
+the encrypted password. Note that email forwarding is necessarily publicly 
+viewable from accounts on the actual machines.
 
 manpagesection(LAT/LONG POSITION)
 There are three possible formats for giving position information and several
@@ -112,10 +113,27 @@ Remember that we are after reasonable coordinates for drawing an xearth
 graph and looking for people to sign keys, not for coordinates accurate
 enough to land an ICBM on your doorstop!
 
-manpagesection(Editing Supplemental GIDs)
+manpagesection(EDITING SUPPLEMENTAL GIDS)
 When the root function is activated then the supplemental GIDs can be
 manipulated as a list of items. It is possible to add and remove items from
-the list by name. Proper prompts are given.
+the list by name. Proper prompts are given. A similar editing function is
+made available for the host acl list.
+
+manpagesection(ENCRYPTION PUBLIC KEYS)
+The directory associates two types of public encryption keys with the user,
+a PGP key fingerprint and a SSH RSA authentication key. It is not possible for
+a user to change their associated key fingerprint, that can only be done by
+the keyring maintainers after performing reasonable verification of the new
+key. Who ever controls the PGP key can make any modification to the LDAP
+account by using the PGP mail gateways.
+
+SSH RSA authentication keys are used by the SSH protocol to authenticate a
+user based on a cryptographic challenge. These keys pairs are created by the
+ssh-keygen program. The public version that is stored in the directory is
+generally placed in a file called identity.pub. SSH RSA authentication keys
+are password equivelents, whoever has the private half of the key can use it
+to login to any machine, but not affect changes to the LDAP entry. SSH
+authentication keys are kept private.
 
 manpageoptions()
 startdit()