Subject: [netatalk-admins] Change Passwords

From: "ian reinhart geiser" <[email-masked]>
Date: Thu, 28 Jan 1999 01:25:09 -0600

can you change user passwords through the chooser under ANY version of 
Netatalk?

thanks in advance

-ian reinhart geiseri

---

From: PayPC System Mail Subscriber <[email-masked]>
Date: Thu, 28 Jan 1999 19:23:14 +1000

ian reinhart geiser said in [netatalk-admins] Change Passwords at 28/Jan/1999 
(Thu) 17:25:09.

> can you change user passwords through the chooser under ANY version of 

With the netatalk-asun versions, it's been functional for a long time now.  
(Via both appletalk and afp/tcp connections).  So the answer is an 
unqualified yes.

Be sure you enable the -setpassword option on the share. I also highly 
recommend you use the 2-way randnum exchange method of 
passwords/authentication, which makes use of the "look-aside" ~/.passwd files 
in each user's home directory (rather than using the /etc/passwd or 
/etc/shadow [normal unix account] password.  In fact, because of this 
plaintext-stored .passwd file, I *FORCE* my users to keep their afp passwords 
different from their unix ones.

=R=

---

From: Stephen Waters <[email-masked]>
Date: Thu, 28 Jan 1999 11:03:57 -0600

> different from their unix ones.

is there someplace where i can get documentation on how to do this? i've
just been using cleartext, but this would make things at least feel a
little
safer. i mean, do you need a UAM, how does this work w/ PAM, etc.

my version of netatalk: netatalk-1.4b2+asun2.1.2-1.rpm for RH5.2/i386

the documentation is ok, but seems dated and doesn't enlighten one as to
how all the auth stuff works.

URLs, long emails, appreciated,

thanks,

stephen

---

From: PayPC System Mail Subscriber <[email-masked]>
Date: Sat, 30 Jan 1999 22:21:06 +1000

Stephen Waters said in Re: [netatalk-admins] Change Passwords at 29/Jan/1999 
(Fri) 03:03:57.

> little safer. i mean, do you need a UAM, how does this work w/ PAM, etc.
> 

I have no idea about PAM or UAM stuff, but assuming you link against a crypto 
library (mentioned in the top-level makefile for netatalk), the rand2num 
authentication method just works.  (I use Slack 2.0.33+ Linux myself, though 
I have SSLeay, whose shared libs I have about 7 or 8 different things using 
[fast optimised crypto routines, which I replace the normal system crypt() 
with]).  The AFP authentication scheme relies on DES to encrypt randum 
numbers as part of the login process.

Alas, since the /etc/shadow (or /etc/passwd) scheme in UNIX is a one-way 
hashstore encrypted with salted data, it cannot be used in rand2num 
authentication schemes.  So...  the passwords for the accounts *must* be 
stored on the server.  Netatalk+asun stores the (in-the-clear) password in 
each user's home directory. (~/.passwd)  Netatalk has extremely strict 
requirements about how that file's permissions are setup.  It *MUST* be 0600, 
owned by the user, and the group must be the user's primary GID.  (This last 
requirement is a bit of a puzzler, since the file's 0600).

Anynow, I'm sure someone could whip up a quickie script to pre-create these 
.passwd files in each user's home directory, if you have many users.  But if 
you only have a few, it's probably simpler to do something like this:

su
(enter root pw)
echo "temppass" > /home/user1/.passwd
chown user1:hisgroup /home/user1/.passwd
chmod 0600 /home/user1/.passwd

And so on... I don't know if Adrian's included a batch .passwd file setter 
upper or not...

But anyhow, do FORCE your users to change their passwords, and while it may 
be a bit of a pain, ensure they do not match their unix account passwords.  
(With samba, this isn't a worry, since the passwords are stored encrypted, 
though NT "security" has other problems which make me ask the same of my 
Winbloze users.)

Anyhow.  Once that's done, be sure your shares are -rand2num.  I recommend 
-noguest and -setpassword.  Voila!  You're done.  All Appleshare clients 
PREFER that UAM over the inferior cleartext UAM, and it's been a part of 
Appleshare since Day One (I think).

The *BIG* problem with AFP logins, is that it can't really "backdown" in 
authentication.  If the server advertises rand2num, it cannot "fallback" to 
cleartext if rand2num fails.

=Rob=

---

From: Jamie Biggar <[email-masked]>
Date: Tue, 9 Feb 1999 16:02:45 -0500 (EST)

Hi all,
  This feels like a dumb question since no one else has been asking about
it, but I can't make -setpasswd work.

I've got both -randnum and -rand2num authentication working just fine, but
from the OS 8.5 Chooser (I think I've tried everything from 7.6.1 up), the
"Change Password" button always stays greyed.

My current afpd.conf looks like this (though I've tried many
permutations:

	"Spanky" -transall -rand2num -setpasswd -savepasswd

(as I said, I can login fine)

The suggested libdes files are installed in the right locations,
compilation seems to work fine, during the 'make', I can see that the
if/thens in the etc/afpd/Makefile triggered properly to set -DUAM_RNDNUM,
afpd is running as root...  This is with asun2.1.1 (on RH5.1 and 5.2),
though I've tried with earlier builds as well with similar results.

Any suggestions are much appreciated.  I'll happily digest any responses
for inclusion in the FAQ-O-Matic... :-)

Jamie Biggar
The Dominion
http://www.scifi.com

---

From: Jamie Biggar <[email-masked]>
Date: Wed, 10 Feb 1999 09:53:51 -0500 (EST)

> it, but I can't make -setpasswd work.
                       ~~~~~~~~~~
The reason why (with much gratitude to Adrian for his help) is that it's
actually -setpasswORd...  To much time in Unix makes the mind over-abbrv8.

Jamie