Subject: Password failure w/randnum or rand2num

From: Charles Sprickman <[email-masked]>
Date: Thu, 7 Dec 2000 23:46:12 -0500 (EST)

Hi,

I'm using netatalk-1.4b2+asun2.1.3 on FreeBSD 4.2-stable built from the
ports collection.  I'm hoping this list covers the -asun stuff as well, if
not my apologies.  From what I can see there are no searchable archives.

My problem is that it works fine (I'm running ASIP only) with a guest user
or if I use cleartext auth.  As soon as I add -nocleartxt and add -randnum
and/or -rand2num to afpd.conf, registered users can not log in.  I have a
.passwd file with a cleartext password in each user's home directories,
and it is readable/writable only by the user.  The mac client only reports
a "password incorrect".

There are no errors logged on the unix side, and if I run with "-d", the
only thing I see is:

root@bigpoop[/usr/ports/net/netatalk-asun]# /usr/local/libexec/afpd  -d
command: 18
12 06 41 46 50 32 2E 32 10 52 61 6E 64 6E 75 6D         ..AFP2.2.Randnum
20 65 78 63 68 61 6E 67 65 04 6C 69 73 61                exchange.lisa
(end)

If there is no .passwd file, afpd complains, but if I do an "ls -lua" on
the file (last access), I see that afpd is not touching it.  Odd?  Running
ktrace on afpd doesn't help as I can't get a trace on the child (yeah, -d
should not fork, but what can I say, it does..).

Any ideas?  I've been all over Google and looked over all the "usual"
mistakes...

Thanks,

Charles

| Charles Sprickman                  | Internet Channel
| INCH System Administration Team    | (212)243-5200
| [email-masked]                     | [email-masked]

---

From: Rich Winkel <[email-masked]>
Date: Fri, 8 Dec 2000 10:38:40 -0600 (CST)

> and it is readable/writable only by the user.  The mac client only reports

Are the home directories nfs-mounted on the netatalk server?  If so, 
are you mapping root to a non-root uid:
-maproot=xxxx
in /etc/exports on the nfs server?
If both of these are true then the problem is that netatalk attempts to
access the .passwd files as root, which is prohibited by the nfs server.
One solution would be to enable root nfs access.  A better one would be
for netatalk to access the .passwd file as the user in question.

Rich