Subject: [netatalk-admins] Can't log on with MacOS 9.0 and RedHat 6.0...

From: "TJ Snider" <[email-masked]>
Date: Wed, 17 Nov 1999 21:21:43 -0800

Hi Folks,

I'm hoping you can help me.

I have a small home network with a Mac running MacOS 9 and a Linux Redhat
6.0 upgraded to the 2.12 kernel running netatalk 1.4b2+asun2.1.3.  Appletalk
is loaded and I can get afpd up and running fine.

I can select the server "cedar" from the chooser, however I can't log on to
the server, as a I get a message "The connect to this server has been
unexpectedly broken." When running afpd under gdb, I get a debug message
comming out;

command: 18
..AFP2.2.Cleartxt passwrd.timsn.XXXXXX where XXXXXX is the password I
entered.

tail /var/log/messages reveals 

afpd[1006]: ASIP session:548(7) from 192.168.2.2:49195(8)
afpd[1000]: server_child[1] 1006 done
afpd[1007]: ASIP session:548(7) from 192.168.2.2:49196(8)
afpd[1000]: server_child[1] 1007 killed

I have shadow passwords turned on in my system and the -DSHADOWPW included
in the etc/afpd/Makefile but I do note that in the root Makefile the
PAMDIR=/usr which I'm not certain is correct. I have put a .passwd file into
the correct directory /home/timsn so that should have that angle covered...

I can log on to "cedar" via telnet so it's not a matter of hosts.allow.

I've tried a variety of strategies and am stumped.... I've read through the
man pages and most of the website at least once... Does anyone have any
suggestions for what might be the problem?

I am a developer, just not that skilled under Linux yet, so if there is a
particular place I can stop and check stuff inside afpd with gdb, feel free
to let me know...

Thanks,

TJ

---

From: Thierry Michalowski <[email-masked]>
Date: Thu, 18 Nov 1999 12:40:40 +0100

Hello everyone,
remember my "cannot login" problem?
I could only log on using the guest account on my fresh RedHat and every
attempt to log in with a user resulted in a "Bad password" message.
I tried the latest netatalk+asun package today (pre-asun2.1.4-36a.tar.gz) and
that did nothing to my problem.
I still tried some things dealing with PAM...
And I finally found the solution!
I changed my password (Linux one) to a password ****that is less than 9
characters long**** (exactly 8)!
Now I can log on to my linux box as this user!

Note that using the "md5" token at the end of the lines in the
/etc/pam.d/netatalk file changes nothing.

So, some thoughts:
a Mac (through MacOS8.6 at least) doesn't allow to type in a password that is
more than 8 characters long in a login box from the Chooser.
I assumed that netatalk counted only on the 8 first characters of the typed
password to authenticate a user: this must be false...and I suppose this should
be the case until the Mac chooser supports more than 8-characters passwords!
If this _is_ the case, then I'd like to know how it could be - still - a
configuration problem...

Hope this helps someone

--
Thierry Michalowski                                     /
Edipresse Publications S.A                 \\\' ,      / //
Informatique de Production                  \\\//    _/ //'
33,av. de la gare                            \_-//' /  //'
1001 LAUSANNE SUISSE                           \ ///  //'
phone: +41 21 349 46 26                        /  >>   \\\`
mailto:[email-masked]       /,)-^>>  _\`
                                              (/   \\ / \\\
"Unix is user-friendly...                           //  //\\\
It is just selective about who its friends are"    ((`
============================================================================
This message has been checked with GRIMEsweeper which has detected a virus
embedded in this plain text message. You should now delete your entire hard
drive and rinse your eyes with soapy water to ensure it doesn't spread.

---

From: Ryan Cleary <[email-masked]>
Date: Thu, 02 Dec 1999 21:10:53 -0500

> If this _is_ the case, then I'd like to know how it could be - still - a

(sorry for replying to this so late, but I'm behind in the mailing list)

You've almost got it right.  Before md5 passwords, using the standard
crypt passwords, Linux only cared what the first 8 characters were in
creating the /etc/passwd hash.  So the fact that MacOS only uses 8
characters didn't matter.  Now, with md5, your whole password (IIRC) is
used to create the hash in /etc/passwd, and if your password is more
than 8 chars, it'll never match from netatalk.

What you mistook as netatalk only comparing the first 8 characters we
actually Linux only caring about the first 8 characters.

A solution is to use the DHX UAM (with pam), which encrypts the full
password, bypassing the 8 character limitation of Apple cleartext and
randnum/rand2num passwords.

That's what I use at my site, where I have a PAM module which
authenticates against a Kerberos database.

--Ryan Cleary
sysadmin, interdimensions