Set up a team and share a vault

In this tutorial you create a team on your Sternway server, invite a teammate, check each other’s safety numbers, and share a vault of hosts with them. At the end a host you add to the team vault appears on your teammate’s devices, end-to-end encrypted.

What you need

• Two Sternway accounts on the same sync server: yours and your teammate’s. Each of you signs in on the desktop app as in Turn on encrypted sync. You can try it alone with a second account on a second computer.
• A way to talk to your teammate other than Sternway: in person, a phone call or a chat you already trust. You use it to compare safety numbers.

You do the steps marked You in your app, and your teammate does the ones marked Teammate in theirs. All of them are under Settings › Account & Sync › Teams on the desktop.

1. Create the team

You:

1. Open Settings › Account & Sync and then Teams.
2. Choose New team, type a Team name such as Ops, and create it.

You are the team’s owner. Your app signs the team’s member list with your account’s key, and every member’s app checks that signature, so the server cannot add people or change who has access.

2. Invite your teammate

You:

1. Open the team and choose Invite a member.
2. Type your teammate’s email address under Invite by email and choose Send invite.
3. Sternway shows Invite sent. You can also share this link. If your server cannot send email, copy the link and send it to your teammate yourself.

Teammate:

1. Open Teams and choose Join a team.
2. Paste the invite link and choose Join team.

3. Compare safety numbers and accept the team

A safety number is a short fingerprint of an account’s keys. Comparing it over another channel proves that the keys Sternway shows really belong to that person, and not to someone the server put in their place.

Teammate: Sternway now asks Accept the team Ops?, with the owner’s name and their safety number. Nothing from the team is used on this device until it is accepted.

1. Call or meet the owner. You open Security and account, where Your safety number is shown, and read it out.
2. Teammate: if every digit matches the number in the prompt, choose Accept team.

You: in the team’s member list, your teammate’s row says Not verified. Choose Verify, compare the number with your teammate in the same way, and choose Mark as verified if every digit matches.

4. Create a vault and share it

You:

1. In the team, under Team vaults, choose New team vault and name it, for example Production.
2. On the new vault choose Give access, pick your teammate as Member, set Vault access to Can edit or Can view, leave Access ends at Never (until you remove it), and confirm.

Sternway seals the vault’s key to your teammate’s verified keys and signs the access into the team’s member list.

Teammate: Sternway shows (your name) shared the vault Production with you. Choose Accept vault.

5. Put a host in the vault

You:

1. Go to Hosts. Now that you have more than one vault, the toolbar has a vault list: choose Production.

2. Choose New › New host, fill it in as in the first tutorial, and Save. It is created in the Production vault.

   To move a host you already have, open its ⋯ menu and choose Move to vault….

Teammate: go to Hosts. The host is there, in the Production vault. The first time your teammate connects to it, their app records how it is set up (address, port, jump hosts, login); if a team member changes any of that later, the app shows who changed what before it connects.

What you did

You created a team, invited a member, both checked a safety number over a channel the server does not control, and shared a vault whose key only the two of you hold. The server routes the encrypted items and keeps the signed member list, but cannot read the hosts or give anyone else access.

Next

• How teams and trust work: what the signed member list protects and what it does not.
• Set team policies, such as requiring the app lock or keys instead of passwords.
• Export the audit log.
• Removing a member rotates the key of every vault they could open; see How teams and trust work for what that can and cannot take back.