Subject: How to Go About 2-Way Encrypted Passwords?

From: "Basil Hussain" <[email-masked]>
Date: Fri, 15 Sep 2000 15:45:25 +0100

Hi all,

I've been running Netatalk on a couple of Linux systems now for several
months, however the thought just crossed my mind that it was about time I
tried to tighten up security for it. So, I want to start using 2-way
encrypted passwords (as opposed to clear text, which is what I'm using at
the moment).

Before I start describing my trouble, here's some info which'll probably be
handy for you to know:

    # uname -mrsp
    Linux 2.2.5-15 i686 unknown
    [i.e. RedHat 6.0]

    # rpm -q netatalk openssl
    netatalk-1.4b2+asun2.1.3-8
    openssl-0.9.5a-1

    Testing with a 'Blueberry' iMac:
    MacOS 9.0.4
    AppleShare extension v3.8.6

I have read various parts of the mailing list archive and Anders
Brownworth's HOWTO. Below is what I've gathered so far.

* You need a DES library installed. I remember reading somewhere that
OpenSSL will suffice. I have OpenSSL installed already and working with
OpenSSH.

* You need to put a .passwd file containing the login password (no longer
than 8 characters) in clear text in your home directory. I have done this -
in my case '/home/basil/.passwd':

    # echo "mypasswd" > .passwd

* You must specify that only encrypted passwords are to be used for the
server in afpd.conf. I have done this, like so:

    "spectrum.reserve.co.uk" -randnum -rand2num -nocleartxt -noguest

Now the problem. When I make the config change to afpd.conf (it was blank
before, just using defaults) and restart netatalk, like so:

    # /etc/rc.d/init.d/atalk restart
    Shutting down AppleTalk services:
    Starting AppleTalk services: (backgrounded)

Everything appears fine, no warnings or errors. However, if I then attempt
to connect from the Mac using the Chooser, I just get an error popup after a
couple of seconds proclaiming:

    "The User Authentication Method required by this server can't be found,
please check the AppleShare folder in the Extensions folder and try again."

This what happens in /var/log/messages during this:

    Sep 15 15:27:50 spectrum afpd[765]: refused connect from 195.216.17.40
    Sep 15 15:27:50 spectrum afpd[765]: dsi_getsess: Interrupted system call

I'm fairly stumped as to what could not be right. Unless of course, it's
something really stupid like the RPM package not having encryption support
built-in...

Regards,

-------------------------------------------
Basil Hussain ([email-masked])

---

From: "Marc J. Miller" <[email-masked]>
Date: Fri, 15 Sep 2000 10:16:11 -0700

I'm finding myself in the same boat, but since we use NIS for password
validation, having thousands of .password files just isn't an option.  Can
anyone suggest a secure alternative to ClearText that doesn't require
.password files?

---

From: andrew morgan <[email-masked]>
Date: Fri, 15 Sep 2000 10:49:47 -0700 (PDT)

Use DHX encrypted passwords.  You'll need to have a reasonably current
version of AppleShare installed on your macs (3.8.3?  3.8.6?) to use it,
but it works great for me.

It is not as secure perhaps as 2-way randnum (which authenticates both the
user and the server), but it does encrypt the password, which is good
enough for most people.  The nice part is that the server gets your
cleartext password after it decrypts it, so you can use the regular PAM
authentication methods -- no .passwd file required.

To add DHX support on the server, you'll need OpenSSL installed, then
point CRYPTODIR (from the top-level netatalk Makefile) to your OpenSSL
installation and recompile.

	Andy

---

From: "Heath Henderson" <[email-masked]>
Date: Sat, 16 Sep 2000 00:25:23 -0500

I want to be able to back up my entire Home directory with Retrospect.  But
can only mount the specific directories I have permissions set to.  Is there
a way to ceate a group that can have permissions to the entire Home
directory?

Heath Henderson
unit 5 Schools

---

From: Harry Zink/Netatalk List <[email-masked]>
Date: Sat, 16 Sep 2000 06:26:17 -0700

> installation and recompile.

Does JeffB's RPM include that setting? If so, where does it assume the
OpenSSL installation is?

Harry
-- 
CAN'T SEE MAC IN CHOOSER UNDER RedHat 6.2: If you get errors starting
AppleTalk under RedHat 6.2 and Mandrake 7.1, you need to manually add "alias
net-pf-5 appletalk" to your /etc/conf.modules file.

---

From: "Basil Hussain" <[email-masked]>
Date: Mon, 18 Sep 2000 09:48:16 +0100

Hi all,

> something really stupid like the RPM package not having encryption support

I suspect that this is the case, actually, seeing as my Netatalk RPM doesn't
depend upon libdes/openssl or the like.

    # rpm -qR netatalk
    pam >= 0.56
    /bin/sh
    ld-linux.so.2
    libc.so.6
    libdl.so.2
    libnsl.so.1
    libpam.so.0
    /bin/sh
    libc.so.6(GLIBC_2.0)
    libc.so.6(GLIBC_2.1)

I saw this on the Sourceforge discussion forum for the new version 1.5:

> Andrew Morgan gave me a suggestion to test the latest pre-release
> V1.5. So I have installed the rpm one from Jeff (the testversion), but
> there is a dependencyproblem while Netatalk is asking for a
> libcrypto.so.0 library. I can't find it any where.

This sounds like an RPM that includes support for 2-way encrypted passwords
(as libcrypto.so.0 is part of OpenSSL). I'd like to give 1.5 a try, but
where can I get this RPM?

Appletalk file sharing is the primary method for accessing files on my
servers, so they're used fairly heavily, but the stability of the basic
features in v1.5 can't be worse than the current version, can they?

Oh, and by the way, the reason why I don't just go and compile my own
version, as per Anders' FAQ is because the servers this will be running on
have no development utilities installed - I like to keep my public-facing
servers stripped-out with just the bare minimum of stuff. So, I need a
pre-compiled binary RPM package...

Regards,