Subject: [netatalk-admins] denying access

From: Peter Bolmehag <[email-masked]>
Date: Wed, 21 Jan 1998 13:49:00 +0100

Hi!

I have netatalk running. When someone gets an account they automatically
are able to log in to the machine via netatalk. I want to be able to shut
out certain users. How?

Peter

----------------------------------------------------------------------------
 Peter Bolmehag
 LundaForum AB
 Tel: 046-182513
 Mobil: 0708-373409
 Epost: [email-masked]

---

From: Edan Idzerda <[email-masked]>
Date: Wed, 21 Jan 1998 08:04:55 -0500 (EST)

> are able to log in to the machine via netatalk. I want to be able to shut

Oooh, this might be tricky.  You should be able to disable netatalk
logins by setting their shell to something not specified in 
/etc/shells--or whatever getusershell() on your machine looks
in.

But that will probably be they can't login via telnet either.

If you want to disallow logins from the Mac side and the unix side,
easy.  If you want to allow unix logins but not allow Mac connections...
Hmmm.  I don't know if you can do that.

It wouldn't be too difficult to add another check in auth.c to 
kick out certain users, but I don't know what the critieria
would be so I don't have a solution in mind.

In other news, I've made a few updates to my baby-FAQ for netatalk on 
Solaris 2.  It's not a tremendous amount of research, but I think
it's becoming a good pointer for new Solaris users.  That's primarily
what I would like it to become.

- edan

--
Edan Idzerda	<[email-masked]>
System Administrator --  Michigan Technological University, Houghton MI USA

---

From: Sid Van den Heede <[email-masked]>
Date: Wed, 21 Jan 1998 09:37:06 -0500 (EST)

> would be so I don't have a solution in mind.

Now, if auth.c (or whatever) uses or can use Pluggable Authentication
Modules (pam), then you can relatively easily add this kind of control.
Pam is currently available in Linux and Solaris 2.6, so it should show up
in other UNIX-like OSs Real Soon Now.  The authentication module could
check the source of the user (e.g., IP address or name), but maybe not
much else.  An alternative would be to use ipfw stuff on Linux, or the TIS
firewall toolkit.

------------------------------------------------------------------
Sid Van den Heede               Open Text Corporation
+1 519 888 7111 x2211           185 Columbia Street West
+1 519 888 0677 (fax)           Waterloo, Ontario, Canada  N2L 5Z5
[email-masked]

---

From: Gregor Retti <[email-masked]>
Date: Wed, 21 Jan 1998 15:43:51 +0100

>are able to log in to the machine via netatalk. I want to be able to shut

there is a restcrition on password length for AFPservers (at least for
MacOS < 8) of 8 chars. so if you force the UNIX-only users to have longer
passwords, they wont be able to log in via appletalk (not very smooth but
might be a workaround).

regards
gregor

-----------------------------------------------------------------------
 gregor retti ----------- http://germanistik.uibk.ac.at/germ/retti.html
-----------------------------------------------------------------------

---

From: Andrew McNabb <[email-masked]>
Date: Wed, 21 Jan 1998 11:52:58 -0600

> passwords, they wont be able to log in via appletalk (not very smooth but

The same restriction applies to all of the UNIX machines that I have ever
used.

----------------------------------------------
                Andrew McNabb
             Argus Systems Group
          [email-masked]
----------------------------------------------
  I am an International Arms Trafficker!!!!!
http://online.offshore.com.ai/arms-trafficker/
----------------------------------------------

---

From: Edan Idzerda <[email-masked]>
Date: Wed, 21 Jan 1998 13:22:40 -0500 (EST)

> The same restriction applies to all of the UNIX machines that I have ever

The Unix machine will simply truncate the password at 8 characters.
It won't deny access or complain.  At least, that is the case with all
of the Unix machines I use on a regular basis.

- edan

---

From: Jeff Wiegley <[email-masked]>
Date: Wed, 21 Jan 1998 19:21:32 +0000

subject pretty much says it all.

The 3Com 10/100 drivers are pretty unstable by most reports and
so I'm using SMC cards which reportedly have excellent drivers.

Except the tulip based etherpower 10/100 (SMC9332?) driver doesn't
work 100% with netatalk (even with all the multicast options). So
I've been using the de4x5 driver instead which seems to work fine.

But now I've got the opportunity to put together another machine
and I was wondering the if the device driver for the Epic based
SMC9432TX works 100% with netatalk.

Anybody using the SMC9432 with netatalk? any opinions or advice
would be appreciated.

- Jeff

---

From: Bill Stewart-Cole <[email-masked]>
Date: Wed, 21 Jan 1998 14:54:37 -0600

>The same restriction applies to all of the UNIX machines that I have ever

Maybe so, but it does not apply to all Unix machines. Linux, Digital Unix,
and Ultrix definitely have packages available for longer passwords, and I
am fairly certain that FreeBSD does as well. Any authentication system that
can hand off to Radius has access to 16-character passwords as well.

----
Bill Stewart-Cole
This space for rent. Inquire within.