Subject: password lengths...

From: Casey Lewis <[email-masked]>
Date: Thu, 05 Oct 2000 17:26:44 -0700

Hi all!
I've got a Slackware 7.1 box with netatalk-1.4b2+asun2.1.4 installed. I
also have several other Slackware boxes (slack 4.0 and 7.0) with
netatalk-1.4b2+asun2.1.3p39 installed.

On our netatalk-1.4b2+asun2.1.4 install, I'm having some problems with
passwords over 8 characters. Basically they don't work. :) On the older
boxes with the older netatalk installs, passwds > 8 characters work
fine.

Here are some out-takes from the logs:

#
# > 8 character password this is what I get in /var/log/messages
#   Mac responds with 'Sorry, the password that you entered it
#    incorrect, please reenter it.'
#
Oct  4 09:11:07 lvfs afpd[10007]: ASIP session:548(1) from
x.x.x.x:49181(2)
Oct  4 09:11:07 lvfs afpd[10007]: cleartext login: caseyl
Oct  4 09:11:07 lvfs afpd[10007]: 0.08KB read, 0.07KB written
Oct  4 09:11:07 lvfs afpd[8776]: server_child[1] 10007 done

 < 8 character passwords, things work fine.
Oct  4 09:16:28 lvfs afpd[10018]: ASIP session:548(1) from
x.x.x.x:49184(2)
Oct  4 09:16:28 lvfs afpd[10018]: cleartext login: caseyl
Oct  4 09:16:28 lvfs afpd[10018]: login caseyl (uid 1000, gid 101)

I'm at a lose... any help would be greatly appreciated!
Thanks!

Also is there an easy way to verify which version of netatalk is
installed? I'm almost positive that the versions I listed above are
correct, but I want to be sure.

-casey
-- 
=====================================================================
Casey Lewis                     email:	[email-masked]
R&R Partners :: IT Manager      phone:  702.228.0222
http://www.rrpartners.com/      fax:    702.228.7885
=====================================================================

---

From: Matthew Geier <[email-masked]>
Date: Fri, 06 Oct 2000 13:34:29 +1100

> boxes with the older netatalk installs, passwds > 8 characters work

 The new system probably used MD5 hashed passwords, not the old crypt
function that only stores 8. I've been caught by this. You have to
either 'downgrade' to traditional crypt password hashing, or use <8 char
passwords. (I also belive using the DHX UAM will also solve this as it
allows >8 passwords...)

-- 
Matthew Geier			[email-masked]
Arts IT Unit			+61 2 9351 4713
Sydney University

---

From: "Alex Yu" <[email-masked]>
Date: Fri, 6 Oct 2000 09:54:01 -0400

> > passwords over 8 characters. Basically they don't work. :) On the older

You can only have password not more than 8 characters.  See how many
characters you can type in password field in AppleTalk.

Correct me if I am wrong.

Alex

---

From: Steven Karel <[email-masked]>
Date: Fri, 6 Oct 2000 10:21:28 -0400 (EDT)

> Correct me if I am wrong.

So sorry, but you are wrong. If you are using a recent linux installation
with MD5 passwords, and you are using DHX, you can have passwords more
than 8 characters.

To belatedly reply to earlier threads on this list, I see no reason for
DHX not to be the default authentication method for netatalk. It's the
default used by recent versions of the AppleShare client (3.8.6 is an
improvement over previous versions). It's also the default used by OS X
public beta.

The best thing about it is that users don't have to do any thinking to get
password encryption, and they only have to remember one password for both
the "UNIX" side and the "AppleShare" side.

steven

---

From: Crystal <[email-masked]>
Date: Fri, 06 Oct 2000 09:31:44 -0500

> with MD5 passwords, and you are using DHX, you can have passwords more
Steve,

Alex was referring specifically to the interface on the Macintosh side. Sit
at any Macintosh and and bring up the Chooser to log on and you cannot type
any more than 8 characters in the password field. If you can never type more
than 8 characters on the Mac side, then having a password LONGER than 8
chars on the Unix side will effectively render you unable to login into your
Unix box!

C.

---

From: "Alex Yu" <[email-masked]>
Date: Fri, 6 Oct 2000 10:39:27 -0400

> improvement over previous versions). It's also the default used by OS X

So you saying the new AppleShare Client allows you to key-in more than 8
characters?

Alex

---

From: Steven Karel <[email-masked]>
Date: Fri, 6 Oct 2000 10:59:17 -0400 (EDT)

> chars on the Unix side will effectively render you unable to login into your

Crystal (&al) 

What Alex said IS true for older macs. It is NOT true if you use DHX on
newer AppleShare clients (use 3.8.6 and connect to a server offering DHX
login). True, the field for the password is 8 characters wide, and you
won't SEE a result of typing more than 8 characters. however, you can type
as many characters as you want into that field, and they ARE significant.

I should know -- my password on my favorite linux desktop is nine
characters long. Typing the first 8 in the AppleShare dialog box doesn't
work; typing the ninth character does.

steven

---

From: David R Bosso <[email-masked]>
Date: Fri, 06 Oct 2000 08:16:32 -0700

Is this new in 1.5?  I'm running asun-pre39 on RedHat 6.2 with DHX, and 
from my OS9 G4 client, I get an alert saying "You have entered more 
characters than the maximum number allowed" if I type more than 8.  Do you 
get this alert also?

-David

---

From: Crystal <[email-masked]>
Date: Fri, 06 Oct 2000 11:45:05 -0500

>> work; typing the ninth character does.

Well now I'm confused. I went back and re-read the original posting from
Cary Lewis below

> boxes with the older netatalk installs, passwds > 8 characters work

I think I'll just try it with our current atalk asun2.0.18 (I know, its old)
AND with our asun2.1.4 install

*pauses*

Ok, on BOTH versions I just gave myself a 9 character password and it let me
login AFTER it popped up the warning window about having too many
characters. Goofy.

So I guess its up to the admins to decide whether they want to spend all day
fielding questions about warning windows popping up from users... or just
have them use 8 char passwords. :)

FYI, AppleShare client 3.8.6 on OS 9.0.4

C.

---

From: Crystal <[email-masked]>
Date: Fri, 06 Oct 2000 11:55:48 -0500

> FYI, AppleShare client 3.8.6 on OS 9.0.4
Correction to the above statement. Since we are using DES encryption on
these systems, it doesn't care what the rest of your password is after 8
characters. Sorry for any confusion.

C.

---

From: Matthieu Cormier <[email-masked]>
Date: Fri, 6 Oct 2000 19:33:27 -0400 (EDT)

I tried netatalk several months ago and it worked great. It greatly
increased the speed of accessing a Macintosh application data file by
putting the data file on a linux box. 

Unfortunately since it was a network application when putting the data
file on linux only one user could access it at a time ( due to newly
created lock files and their permissions ).

I just wanted to inquire how stable the current RPM is, particularly with
respect to file permission control.

Cheers,

Matthieu Cormier
==============================
http://www.cs.dal.ca/~mcormier

---

From: "Marc J. Miller" <[email-masked]>
Date: Fri, 6 Oct 2000 16:05:15 -0700

netatalk is very stable, and as far as file security, the current RPMs are
pretty good.  The 1.5 prerelease (1.4.99) RPM doesn't have dropbox support,
though (or at least, it shouldn't... it's disabled by default).  It was
purposely disabled because of a known problem with dropbox support.  I also
discovered and fixed a previously unknown file permission problem today
which would only occur if dropbox support ("dropkludge") was activated when
afpd was compiled.

If you can provide me with a little more detail, I can test to make sure
that 1.5's renovated permission translation will work like it's supposed to.

---

From: Crystal <[email-masked]>
Date: Fri, 06 Oct 2000 09:31:44 -0500

Steve,

C.

---

From: David R Bosso <[email-masked]>
Date: Fri, 06 Oct 2000 08:16:32 -0700

-David

---

From: Steven Karel <[email-masked]>
Date: Fri, 6 Oct 2000 10:59:17 -0400 (EDT)

Crystal (&al) 

steven

---

From: "Alex Yu" <[email-masked]>
Date: Fri, 6 Oct 2000 10:39:27 -0400

Alex

---

From: Steven Karel <[email-masked]>
Date: Fri, 6 Oct 2000 10:21:28 -0400 (EDT)

steven