From 728319cbde90981f0918f4ebeed007afebfdf1e3 Mon Sep 17 00:00:00 2001
From: Daira Hopwood <daira@jacaranda.org>
Date: Thu, 5 Sep 2013 17:39:08 +0100
Subject: [PATCH] Tue Jan 24 20:31:26 GMT 2012  Brian Warner
 <warner@lothar.com>   * Added information on accounts.url directive

---
 docs/frontends/FTP-and-SFTP.rst | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/docs/frontends/FTP-and-SFTP.rst b/docs/frontends/FTP-and-SFTP.rst
index d0adefa0..ed52e745 100644
--- a/docs/frontends/FTP-and-SFTP.rst
+++ b/docs/frontends/FTP-and-SFTP.rst
@@ -73,6 +73,19 @@ these strings.
 Now add an 'accounts.file' directive to your tahoe.cfg file, as described in
 the next sections.
 
+accounts.url Directive
+======================
+
+The accounts.url directive should point to a secure, preferably
+localhost-only service.  This makes it harder for attackers to brute force
+the password or use DNS poisoning to cause the Tahoe-LAFS gateway to talk
+with the wrong server, thereby revealing the username and passwords.
+
+Tahoe-LAFS will send the credentials, email address and password to the
+URI specified in the accounts.url directive.  If the credentials are correct,
+the server will return a rootcap string.  Otherwise, it returns the string
+"0" which means bad username and/or password.
+
 Configuring FTP Access
 ======================
 
-- 
2.45.2