--- a/src/goodjava/lucene/backup/BackupServer.java	Fri May 22 19:10:14 2020 -0600
+++ b/src/goodjava/lucene/backup/BackupServer.java	Sat May 23 19:01:57 2020 -0600
@@ -4,6 +4,10 @@
 import java.io.OutputStream;
 import java.io.FileOutputStream;
 import java.io.BufferedOutputStream;
+import java.io.Writer;
+import java.io.FileWriter;
+import java.io.Reader;
+import java.io.FileReader;
 import java.io.IOException;
 import java.util.Map;
 import java.net.Socket;
@@ -18,6 +22,7 @@
 import goodjava.rpc.RpcCall;
 import goodjava.rpc.RpcClient;
 import goodjava.rpc.RpcResult;
+import goodjava.rpc.Rpc;
 import goodjava.rpc.RpcException;
 import goodjava.logging.Logger;
 import goodjava.logging.LoggerFactory;
@@ -75,12 +80,16 @@
 
 	private void handle(Socket socket) {
 		RpcServer rpc = new RpcServer(socket);
-		while( !rpc.isClosed() ) {
+		Backup backup;
+		{
 			RpcCall call = rpc.read();
-			if( call == null )
-				break;
+			if( !call.cmd.equals("login") ) {
+				rpc.write( new RpcException("login expected") );
+				rpc.close();
+				return;
+			}
 			String name = (String)call.args[0];
-			Backup backup;
+			String password = (String)call.args[1];
 			synchronized(backups) {
 				backup = backups.get(name);
 				if( backup == null ) {
@@ -88,6 +97,29 @@
 					backups.put(name,backup);
 				}
 			}
+			File pwd = new File(backupDir,name+".pwd");
+			try {
+				if( !pwd.exists() ) {
+					Writer out = new FileWriter(pwd);
+					out.write(password);
+					out.close();
+				} else {
+					Reader in = new FileReader(pwd);
+					if( !IoUtils.readAll(in).equals(password) ) {
+						rpc.write( new RpcException("wrong password") );
+						rpc.close();
+						return;
+					}
+				}
+			} catch(IOException e) {
+				throw new RuntimeException(e);
+			}
+			rpc.write(Rpc.OK);
+		}
+		while( !rpc.isClosed() ) {
+			RpcCall call = rpc.read();
+			if( call == null )
+				break;
 			backup.handle(rpc,call);
 		}
 	}