Subject: Re: netatalk.com

From: Steve Freitas <[email-masked]>
Date: Tue, 1 Aug 2000 16:07:38 -0700

>If someone could write up documentation on how to do secure passwords or
>if that is not even possible and add it to the site.  I have wanted to do
>this for some time but have had little luck in finding that info.

This is a major reason why RPMs are such a good idea. For the 
source-expert among us, it's easy to do this, but the first time I tried 
compiling Netatalk from source with secure passwords, it took me two 
weeks, and only after Sandor wrote that up! 
(http://lindy.stanford.edu/~ssklar/netatalk-setup.html
) And then that process only works on Redhat 6.0 -- 6.1 breaks it. What a 
nightmare!

So many of us are asking the same questions over and over again. "Which 
do I use? -37b or -39?" "How do I enable encrypted passwords?" "How do I 
make it use shadow passwords?" "Do I need codepage support?" "What is 
codepage support?" "How do I make this co-exist with Samba?" "Where can I 
find rm, mv, and cp scripts which handle .AppleDouble files?"

Enough! Let's get this documentation project going!

Off-topic: JeffB, a feature request for 2.0: Make randnum and rand2num 
optionally read shadow passwords. *sigh*

Steve Freitas

---

From: BWS - Offwhite <[email-masked]>
Date: Tue, 1 Aug 2000 18:13:27 -0500 (CDT)

I am actually adminstering 4 FreeBSD systems with Netatalk and need
documentation for BSD.  If I could get a little push I may be able to
figure it out and then create the documentation for it.

I am just not sure where to start exactly.  I install Netatalk with the
FreeBSD ports collection and I am betting that all I need to do is use a
few switches to get it all in order.  I have all kinds cryptography in
place, but do not know how to tell Netatalk to use it.

If I figure it out, I would be happy to post a "How To" guide for FreeBSD.

Brennan Stehling - web developer and sys admin
projects: www.greasydaemon.com | www.onmilwaukee.com | www.sncalumni.com

---

From: Marc Miller <[email-masked]>
Date: Tue, 1 Aug 2000 16:41:22 -0700 (PDT)

I don't do encryption, so I haven't been following your discussion, but
maybe this will help:

Taking a brief look at etc/afpd/auth.c it looks like netatalk supports
Randnum encryption using the des libraries, but I haven't attempted to
turn it on.  If Randnum encryption is your goal, start with going into
auth.c and searching for UAM_RNDNUM (the flag passed from the Makefile
that activates that support), then document what it's doing as you
figure it out.  Eventually, you'll have enough of it documented that you
can trace through it and clarify your comments.  That's how I did my
patchwork in other areas of netatalk.

> > optionally read shadow passwords. *sigh*

============================================================
	/\/\arc ._|. /\/\iller ([email-masked])
	Computer Room Consultant
	Information Technology/Lab Management
============================================================
I can be contacted through the Communication Center link from
http://www.mother.com/~mjmiller/

---

From: Tom Fitzgerald <[email-masked]>
Date: Tue, 01 Aug 2000 20:10:45 -0400

> optionally read shadow passwords. *sigh*

This isn't possible with rand*num encryption, that's the reason DHX was
created.  The randnums use a 1-way hash of the password for authentication,
and the server can't validate the hash unless it has the original
cleartext password on disk.  Thus the .passwd file.

DHX authentication uses a public-key scheme to pass the cleartext
password from the client to the server, so that can be checked against
the shadow file.

Here's a deeper problem: DHX appears to be inferior to rand2num because
with rand2num, the authentication handshake doesn't succeed until the
server can prove to the client that it knows the user's password too.
This prevents a rogue server from impersonating a real server.  DHX
doesn't appear to do this, so the security level is more like randnum,
which doesn't verify the server's identity.  Am I missing something?

---

From: BWS - Offwhite <[email-masked]>
Date: Tue, 1 Aug 2000 20:10:46 -0500 (CDT)

Perhaps the best way for me to gather info would be to get my questions
listed clearly.  If anyone can answer all or any of the questions that
would be great.

1) What encryption is possible with Netatalk and what does a typical MacOS
9 system understand already?

2) How is it installed on other platforms, such as Linux?  (A URL to
documentation would help be a great deal)

3) Is DES the prefered encryption method?  Is it the same method which is
included in the rsaref-2.0?

4) Does all the software I need, beside rsaref-2.0, included in the
standard Netatalk source code distribution?

5) What does each encryption method offer?  Does it simply encrypt the
login and the password, or does it encrypt the data too, like SSH and Scp
do?

I have the A/C turned up, my ports collection is up to date and my FreeBSD
box is ready to compile.  I simply need a little heads up and I will start
cracking.