Subject: Why no root login

From: TimY <[email-masked]>
Date: Wed, 8 Nov 2000 15:36:12 -0800

I can't get root to login.  Is it blocked for some reason.  Anyone 
have any ideas as to how to change this.  I have changed my afpd.conf 
all around with no luck.  There is no single option to allow root 
logins in afpd.conf.
The version is netatalk-1.4b2+asun2.1.4.  Really need to get this to 
work or all is lost.

Thank You,
Tim Yardley
Dark Horse Comics, Inc.

---

From: Christian Schmidt <[email-masked]>
Date: Thu, 9 Nov 2000 17:42:14 +0100

TimY schrieb am 08.11.2000:

>  I can't get root to login.  Is it blocked for some reason.

Yes, it is. And the reason is security.

On many systems, a remote root login is generally forbidden.

Try logging in as "normal" user.

Vai AFP, root can't do anything worthy anyway...

Yours,
Christian
-- 
Made with a Macintosh...
[email-masked]
http://home.t-online.de/home/chrischmi/

---

From: Ryan McBeth <[email-masked]>
Date: Thu, 9 Nov 2000 12:51:32 -0500

Well, you could edit /etc , but the thought of all of those 
.AppleDouble files in /etc ...

	Ryan

>Vai AFP, root can't do anything worthy anyway...

__________________________________
Ryan McBeth
Systems Administrator, Mobius New Media
Voice: (302) 475-9880 x11
FAX: (302) 475-9894
www.mobiusnm.com
__________________________________
If you want to achieve excellence, you can get there today. As of 
this second, quit doing less-than-excellent work.
-Thomas Watson, founder of IBM

---

From: Matthew Temple <[email-masked]>
Date: Thu, 09 Nov 2000 13:24:43 -0500

All,

	I assume the reason you would want root login would be to create
a volume administrator.   UI received the following messagein response
to
a question concerning this issue several weeks ago:  (I haven't yet
checked the syntax here, and with the huge amount of discussion around
newer versions of netatalk I'm a little nervous about upgrading.)

	Does anyone know the status of the "Volume Administrator" fix?

						Matthew Temple

============================================================================

FYI, I'm putting the finishing touches on administrator group access in
netatalk 1.5 right now.  It will allow someone in a particular group
(which
you specify in afpd.conf) to have root priviledges.  But I'd say we're
still
at least a week away from having a release candidate that includes a
fully
functional version of it.

----- Original Message -----
From: "Temple, Matthew H." <[email-masked]>
To: <[email-masked]>
Sent: Thursday, September 14, 2000 7:12 PM
Subject: volume administrator

> All,
>
> We have two issues that we constantly bump into with
> Netatalk, largely around backup.   Although we can backup
> and restore our Netatalk volumes with Legato Networker or
> dump, we'd like to be able to use Retrospect.   But since
> Netatalk, unlike Cap, doesn't have the notion of an
> "afp adminstrator" there's no way to mount several volumes owned
> by different labs (we're a research organization).   I've figured
> out how to use the "Redhat private group" scheme to create a
> volume administrator, but this scheme won't work if there are
> different administrators across the machine.   And, of course,
> this won't help to back up individual users who aren't part of a
> volume.
>
> I do see how root can log in via a simple hack to afpd, but it
> doesn't appear to have rootly privileges.
>
> What do people do for backing up their shared netatalk volumes?
>
> Matthew Temple
>
=================================================================

-- 
=============================================================
Matthew Temple                Tel:    617/632-2597
Director, Research Computing  Fax:    617/632-4012
Dana-Farber Cancer Institute  [email-masked]
44 Binney Street, Smith 345   http://research.dfci.harvard.edu
Boston, MA 02115              IMAP LIVES!
=============================================================

---

From: "Robert B. Bell" <[email-masked]>
Date: Thu, 09 Nov 2000 10:49:48 -0800

I am sorry for not following the discussion completely, but

If you are talking about why netatalk doesn't allow root access,

I believe it is because in AFP terms, user id (uid) zero (0)
is used for special access (I forget the actual details [see etc/afpd/unix.c]),
and the software could not tell between the special access and root access;
therefore root is blocked so the feature in AFP is provided.

  Robert.

---

From: Brian Reid <[email-masked]>
Date: Thu, 09 Nov 2000 10:47:30 -0800

I use netatalk in schools. We let students have accounts. Students 
graduate. I've always wanted root login so that I can make a CD Rom with 
student files on them without needing to know student passwords and without 
logging out and in hundreds of times. There are deep technical reasons 
related to our computing environment why we cannot use group permissions to 
do this.

---

From: "Robert B. Bell" <[email-masked]>
Date: Thu, 09 Nov 2000 10:58:44 -0800

> > What do people do for backing up their shared netatalk volumes?

I use Amanda 
http://www.cs.umd.edu/projects/amanda/
to backup up my netatalk volumes remotely from another unix computer
over the network.
I actually back it up twice per night from two different unix computers
on two different tape drives.
Once via Amanda using dump,
and once via Amanda using GNU Tar.

I have ran rsync 
http://rsync.samba.org
to "backup" to another disk every few hours during the day
so that when a user deletes a file, I can just copy the file
from the "backup" disk instead of using the backup tape.

  Robert.

---

From: "Alex Yu" <[email-masked]>
Date: Thu, 9 Nov 2000 14:07:12 -0500

> > >>I can't get root to login.  Is it blocked for some reason.

Just a suggestion.  If you want a superuser access, make that user have
write access to all groups.

Alex

---

From: "Marc J. Miller" <[email-masked]>
Date: Thu, 09 Nov 2000 11:10:38 -0800

It's done.  The afpd.conf file specifies what group will be seen as root 
for a particular volume.  I think I even updated the comments in afpd.conf 
on SourceForge to specify exactly how to do it.

---

From: jeff <[email-masked]>
Date: Thu, 09 Nov 2000 14:25:39 -0500

> related to our computing environment why we cannot use group permissions to

Try using netatalk with the "admin group" option, which grants a group
of users root access. (This is implemented in the 1.5pre series of
netatalk on sourceforge)

jeff

---

From: Steven Karel <[email-masked]>
Date: Thu, 9 Nov 2000 14:50:59 -0500 (EST)

> related to our computing environment why we cannot use group permissions to 

You don't need root access to netatalk to create a CD. If you can get root
access to a shell,  use mkhybrid and cdrecord to make your CDs.

For all the reasons cited by others, I'd have to agree that allowing root
to have access via Appleshare is probably a bad idea.

steven