Subject: [netatalk-admins] REPOST: purpose of PAM, crypt, and DES

From: patrick finerty <[email-masked]>
Date: Sun, 15 Feb 1998 20:06:39 -0700

i asked this on the 11th and received no replies. since i know this is 
a very high turnover list, i'm resending it. 

would someone be really kind and tell me exactly how PAM, DES, and/or 
crypt are used by afpd or any other part of netatalk?

thanks,

-patrick
-- 
       "There is only one aim in life and that is to live it."
 Karl Shapiro,(1959) from an essay on Henry Miller's Tropic of Cancer
	  finger [email-masked] for PGP key
		    http://zifi.genetics.utah.edu

---

From: David Beck <[email-masked]>
Date: Mon, 16 Feb 1998 15:37:18 +1030

Hi there,
		I have the dubious honor of needing to install netatalk on
		a Digital Alpha 433 au box.  Does anybody have any hints or 
		suggestions?

						Thanks.

							David.
-- 
                                               ("`-/")_.-'"``-._
(\__/)      David Beck   +61-8-201 3923         O O `; -._    )-;-,_`)
 (..)   _)   [email-masked]        =(_~_)=  _  )`-.\  ``-'
 /\/\  (       Systems Administrator            _.-~_..-_/ / ((.'
(m__m)_)       IST Computing Services         ((,.-'   ((,/  
     The Flinders University of South Australia

---

From: Julian Elischer <[email-masked]>
Date: Mon, 16 Feb 1998 13:01:35 -0800 (PST)

if it's running 'digital unix'
then the networking code is based on BSD4.4(early) code
and you might find that the FreeBSD stuff may give some hints.
(or NetBSD)

julian

---

From: patrick finerty <[email-masked]>
Date: Mon, 16 Feb 1998 15:15:27 -0700

Hi,

so, i guess my question really relates to the (Clear-Text) message I
see in the Mac Chooser when connecting to my Linux machine. Using DES
doesn't change this message. I guess I'm wondering if the 2way randnum 
is implemented for netatalk or not and if using DES or PAM is supposed 
to add support for it.

thanks,

-patrick

On February 16, 1998, Andras Kadinger wrote:

 > - I suppose, You get authenticated when logging on to the afpd volume.
 > If You use cleartext (on the network) passwords, then afpd can either
 > call crypt and compare the results with /etc/passwd (or the shadow
 > version of the same), or use the cleartext (on disk) password stored in
 > the user's home directory (I'm afraid I can't remember the magic
 > filename discussed before - it should be in the source or in the list
 > archives). In the case You use 2way randnum (on the network) passwords,
 > then both the password (on the network) and the password (on the disk)
 > are encrypted, so netatalk has no way to easily compare them (without
 > searching the keyspace of either one), and so has to rely on the above
 > mentioned magic file containing the cleartext password - it can encrypt
 > it then (not with crypt in this case, but with whatever algorithm is
 > used in the Mac 2way randnum authentication), see, if it matches. One
 > other encryption mechanism used instead of 2way randum (whatever that
 > is) might be DES, I suppose; the situation should be the same in this
 > case then.

---

From: Bill Studenmund <[email-masked]>
Date: Mon, 16 Feb 1998 16:24:40 -0800 (PST)

> is implemented for netatalk or not and if using DES or PAM is supposed 

The thing about 2way is that it requires having a plain-text password on
the server. Normal UN*X systems don't keep such a thing. Someone's
implimented it, and it uses a text file in the user's home dir, so you
have a UNIX and a Netatalk password. :-)

Take care,

Bill

---

From: Andras Kadinger <[email-masked]>
Date: Wed, 18 Feb 1998 01:13:02 +0100

> is implemented for netatalk or not and if using DES or PAM is supposed

Sorry, I personally can not help You with that, due to lack of
knowledge.

But one more thing: the asun version of afpd comes with an afpd.conf,
which has, among others, options for controlling the set of login
methods offered by afpd.

Sincerely,
Andras Kadinger
[email-masked]