Subject: [netatalk-admins] DES, how to log in

From: Paul Krohn <[email-masked]>
Date: Wed, 30 Sep 98 09:13:52 -0700

with lots of generous help from people on this list, i've successfuly 
compiled & installed netatalk on a couple of test systems & am very close 
on my destination system. 

on my test system, when i try to log in using AppleShare 3.7.4, i get a 
dialog box that specifies clear text, scrambled, or two-way scrampled 
depending on whether i've specified 
-cleartxt, -randnum, or -rand2num. If either of the latter two are 
specified, my user/pass combo fails - 'your password is incorrect. please 
re-enter it'.

what have i forgotten?

------------
Paul Krohn
San Francisco Examiner Systems Department
110 Fifth Street
San Francisco, CA  94103
415-777-7884
[email-masked] - www.examiner.com

---

From: "Paul J. Schinder" <[email-masked]>
Date: Wed, 30 Sep 1998 12:33:50 -0400

On Wed, Sep 30, 1998 at 09:13:52AM -0700, Paul Krohn wrote:
} with lots of generous help from people on this list, i've successfuly 
} compiled & installed netatalk on a couple of test systems & am very close 
} on my destination system. 
} 
} on my test system, when i try to log in using AppleShare 3.7.4, i get a 
} dialog box that specifies clear text, scrambled, or two-way scrampled 
} depending on whether i've specified 
} -cleartxt, -randnum, or -rand2num. If either of the latter two are 
} specified, my user/pass combo fails - 'your password is incorrect. please 
} re-enter it'.
} 
} what have i forgotten?

randnum does not use /etc/passwd.  Do you have your netatalk password
in cleartext in a file named .passwd in your home directory?  (For
security's sake, it should, of course, *not* be the same as your
regular password.)

} 
} ------------
} Paul Krohn
} San Francisco Examiner Systems Department
} 110 Fifth Street
} San Francisco, CA  94103
} 415-777-7884
} [email-masked] - www.examiner.com
} 

-- 
--------
Paul J. Schinder
NASA Goddard Space Flight Center
[email-masked]

---

From: Cameron Hart <[email-masked]>
Date: Thu, 01 Oct 1998 10:13:42 +1200

While on the subject of DES and randnum authentication. I have successfully
compiled against libdes, and logged in using 2 way randnum authentication.
However, I got the impression from auth.c in the afp code, and probably
something I read somewhere, that I could change password when using 2-way
randnum. I have yet to successfully do so. Has anyone managed to get this
working?

Cam.

---

From: Neil McAllister <[email-masked]>
Date: Wed, 30 Sep 1998 15:39:34 -0700

See the -setpassword and -savepassword options in afpd.conf

--
Neil McAllister, Systems Administrator
Primo Angeli Inc., San Francisco, CA, USA
http://www.primo.com  mailto:[email-masked]

---

From: Mike <[email-masked]>
Date: Wed, 30 Sep 1998 16:40:14 -0700 (PDT)

Hello,
Also, make sure that the ~/.passwd file is owned by the user that needs to
access it, and that the file is chmod 600.

-M
--------------------------------------------------------------------------
Systems Department Operating Systems Analyst for the Ruben Salazar Library
              of California State University at Sonoma.
  /UNIX(/BSD/SysV)\N_NW[.]VMS\WNTS\WNTW\W95\W311\WFWG\DOS:MacOS/NeXTSTEP  
--------------------------------------------------------------------------

---

From: Mike <[email-masked]>
Date: Wed, 30 Sep 1998 16:55:35 -0700 (PDT)

Hello,
Yes, I use 2-way-scrambled, and all of my users are able to change their
passwords.

Do your users own the file ~/.passwd with chmod 600 ?

-M

On Thu, 1 Oct 1998, Cameron Hart wrote:
[chop]
> randnum. I have yet to successfully do so. Has anyone managed to get this
[chop]
> > security's sake, it should, of course, *not* be the same as your
[chop]

---

From: Cameron Hart <[email-masked]>
Date: Thu, 01 Oct 1998 13:46:29 +1300

Yes, I have a ~/.passwd file with 0600 permissions. I am using
netatalk-1.4b2+pre-asun2.1.0-10a, what version are you using? BTW, I also compile
against PAM, so that is DES and PAM. Do you think they would conflict?

Cam.

---

From: Mike <[email-masked]>
Date: Thu, 01 Oct 1998 00:43:42 -0700 (PDT)

Hello,

Yes, we are using the the asun "stable" source tree. (We are demonstrating
the stability of Linux and daemons right now and are trying to avoid the
pre/alpha releases of software. I have heard good things about the
stability, and improvements to performance with the 2.x pre dist, but I am
still using the older...) 

Options that we have enabled that relate to passowrd:
-nocleartxt -norandnum -rand2num -savepassword -setpassword

(We are using a number of other flags, but these are the ones that have
to do with passwords and authentication.)

Do you have these enabled?

What happens when you set -norand2num -norandnum and *only* allow
plain-text/clear-text passwords (just for testing) ? If the user is still
not able to save their password, it is likely that the DES additions are
not the cause of your problems.

What happens when you set the svaepassword and setpassword options?

Just a few more things to check...

-Mike

 On Thu, 1 Oct 1998, Cameron Hart wrote:

> Date: Thu, 01 Oct 1998 13:46:29 +1300
> From: Cameron Hart <[email-masked]>
> To: "[email-masked]" <[email-masked]>
> Subject: Re: [netatalk-admins] DES, how to log in
>

---

From: Mike <[email-masked]>
Date: Sun, 04 Oct 1998 17:09:26 -0700 (PDT)

No answers, just some comments...
(See below)

On Mon, 5 Oct 1998, Cameron Hart wrote:
> Hi again,
[chop]
> Previously, my options were the same as yours, except for -norandnum. I
> had -randnum
> enabled. Turning this off made password changing work for me. Seems
> wierd I thought it
> would have just defaulted to 2 way randnum for changing pw anyway?
[chop]
> When I tried to change the password with cleartext enabled and randnum
> disabled, I got
> an error message back saying something to the extent of ' invalid
> password', then I
> get disconnected. I'm not sure what is going wrong here. Again I can log
> in without a
> problem, but changing the password fails. 

I do not yet know much about the ApleTalk protocol. I recently bougth the
book "Inside Appletalk", but I have not read it.

I made the assumption that netatalk would be susceptable to the same
backwards compatability for network sharing that the implementation of the
SMB protocol for Windows NT was:

... a client could request to use an older less secure protocol, and if
the server was configured to allow this kind of connection, it would be
allowed by default, unless specifically disabled...

I do not *know* if this is the case, but made the assumption that it was.
So I specifically disallow anything *but* 2-way rand, and none of the
appletalk users have shell access, so there are no valid password entires
for allowing them to ssh to the server. (Telnet, ftp, pop, sunrpc,nfs etc
are all disabled.)
This means that they must have ~/.passwd in plain-text, but no users with
shell access, and no passwords for these users existing in the the
passowrd file(s).

Using separate password files for shell users (me), netatalk users, and
samba users makes syncronization a problem for some, but I do not want any
shell account to have the same password as ~/.passwd or their unencrypted
smbpasswd file. Syncronization is not a problem from me. (Also, our users
either use Mac or PC for web page editing and file storage.)

I think that PAM is not needed if you just use 2-way-rand, since
/etc/shadow and /etc/passwd should not be consulted by netatalk when a
uaser needs to log-in. Changing of passwords should work as long as they
own ~/.passwd and have proper access to it.

If you *need* to have your /etc/passwd and /etc/shadow consulted and
modified via PAM wit netatalk, and users can log in, but cannot change
their password, then it is likely that you do have some problems with how
PAM support has been compiled into netatalk, or how it is configured on
your system. (Things that you are probably aware of which prompted you
to write your message...  ;)

> I am using Shadow passwords and Linux PAM. My /etc/pam.d/netatalk file
> looks like
> this:
> 
> #%PAM-1.0
> auth       required     /lib/security/pam_pwdb.so shadow
> account    required     /lib/security/pam_pwdb.so
> #password   required    /lib/security/pam_cracklib.so
> #password   required    /lib/security/pam_pwdb.so shadow use_authtok
> session    required     /lib/security/pam_pwdb.so
> 
> I don't really know much about PAM, so maybe I am missing something here?

I have not done much work with PAM yet either. I have not had the need to
implement it with netatalk... Yet.

At this point, I will step out of this thread, since I can't offer much in
the way of support with PAM and netatalk on this.

Is anyone else willing to step in and help Cam with questions of password 
changing with netatlk when /etc/passwd and /etc/shadow are access via PAM?

> Thanks,
[chopped all previous]

---

From: Cameron Hart <[email-masked]>
Date: Mon, 05 Oct 1998 11:55:30 +1300

Hi again,

> Do you have these enabled?

Previously, my options were the same as yours, except for -norandnum. I had -randnum
enabled. Turning this off made password changing work for me. Seems wierd I thought it
would have just defaulted to 2 way randnum for changing pw anyway?

> not the cause of your problems.

When I tried to change the password with cleartext enabled and randnum disabled, I got
an error message back saying something to the extent of ' invalid password', then I
get disconnected. I'm not sure what is going wrong here. Again I can log in without a
problem, but changing the password fails.

I am using Shadow passwords and Linux PAM. My /etc/pam.d/netatalk file looks like
this:

#%PAM-1.0

Thanks,

Cam.

---

From: Cameron Hart <[email-masked]>
Date: Mon, 05 Oct 1998 14:15:01 +1200

> own ~/.passwd and have proper access to it.

No, although I'm sure someone could write a PAM module to do this (if they
were feeling masochistic :-)

> to write your message...  ;)

Not sure, does anyone else on this list have an answer? The reason why I might
want to change /etc/shadow is because I want our users (who are all totally
Mac users, no shell access) to be able to change their netatalk password and
their mail password in one hit. Ideally netatalk could do a 2-way randnum
password change, and change the /etc/passwd at the same time. I guess having
the same ~/.passwd as /etc/passwd is a bit risque, however I think that having
two different passwords could be more than our users can cope with ;-)

> > session    required     /lib/security/pam_pwdb.so

...

Cam.

---

From: Osma Ahvenlampi <[email-masked]>
Date: 05 Oct 1998 10:56:00 +0300

> were feeling masochistic :-)

Actually, I could use such a module, if it would enable on-the-wire
encrypted passwords for both Netatalk and Samba. I would be willing to
manually enter a passphrase during server restart if that would also
allow the PAM module to store the passwords in an encrypted form on
the disk (I'm aware that the server would have to keep this encryption
key in memory while running, but at least if someone stole the
machine, it wouldn't have plaintext passwords on disk).

I'd actually prefer to have one password for LAN file sharing (Samba
and Netatalk) and another for mail access, as long as I could write
some kind of Web interface or something that allowed both to be
changed (in addition to the password changing facilities of the file
sharing protocols themselves).

-- 
She is numb from her toes down.
Osma Ahvenlampi <[email-masked]>