Subject: [netatalk-admins] Password Encryption

From: The Wolf <[email-masked]>
Date: Wed, 31 Mar 1999 17:55:56 -0700

Hi all,

I've looked through the archives and seen many questions, and very few
answers regarding actually making password encryption work with netatalk. I
must say, I'm a bit stumped. I've installed netatalk 1.4b2+asun-2.1.0 on
FreeBSD 3.1 and it works great .
The only problem is authentication. The only way I can get my clients to
connect is via clear text. All clients are running Mac OS 8.5.1. If I try
to force some other kind of authentication by turning off clear text, the
client reports that the authentication required by the server is not
supported, and to check the "Appleshare Folder" in the system folder and
try again.
Quite frustrating, really. The user has a ~/.passwd file and the perms are
set to 600. PAM support, DES support, were all compiled in, with no hiccups.
Does anyone have any ideas?

Thanks in advance,
Sean.

"Unix is not a "A-ha" experience, it is more of a "holy-shit" experience."
- Colin McFadyen in alt.folklore.computers

---

From: "Alex Yu" <[email-masked]>
Date: Wed, 31 Mar 1999 23:18:00 -0500

> Quite frustrating, really. The user has a ~/.passwd file and
   > set to 600. PAM support, DES support, were all compiled in,

The ~/.passwd file must be clear text without return character and not
longer than 8 characters.

Alex

---

From: The Wolf <[email-masked]>
Date: Thu, 1 Apr 1999 11:49:46 -0700

Well, there you have it.
I got the impression that the afpd.conf file was optional unless you wanted
to set up virtual servers.
As soon as I added the line as you suggested, whamm-o, I was getting 2-way
encryption accross the wire.
Your help is greatly appreciated!

Sean.

>
>$ man afpd
>..
>       -authall
>              Allow  NoUserAuthent,  Cleartxt,  AFS Kerberos, and
>              Kerberos IV authentication methods (default).
>..
>
>OK, this is not very obvious, but "-authall" does *not* include all auth
>methods, but only those listed.  In afpd.conf, add:
>-       -randnum -rand2num -noauthall -noclrtxt
>and any other option you'd like to have.
>
>Note that in this case *every* user must have a ~/.passwd.  Nobody can log
>in with cleartxt anymore.
>
>For all who are wondering where this text in the man page comes from: it's
>in the FreeBSD port for asun-2.1.3.  (I'll send you the relevant patches
>tonite, Adrian).
>
>
>Stefan
>
>--
>Mühlendamm 12           |  Voice +49-40-256848, +49-177-3504009
>D-22089 Hamburg         |  e-mail: [email-masked]
>Germany                 |          [email-masked]