Subject: Still Only Cleartext

From: "Daniel E. Lautenschleger" <[email-masked]>
Date: Thu, 22 Feb 2001 20:44:07 -0600 (CST)

When using the pre4 RPM on a RH 7 box, there is no darn way for me to get
encrypted logins working. Guest and cleartext work but not dhx.

Check the logs out here:

Feb 22 10:00:38 itchy afpd[2381]: ASIP started on 144.92.19.56:548(2)
(1.5pre4)
Feb 22 10:00:38 itchy afpd[2381]: uam: uams_dhx.so loaded
Feb 22 10:00:38 itchy afpd[2381]: uam: "DHCAST128" available
Feb 22 10:00:48 itchy afpd[2381]: refused connect from 144.92.19.60
Feb 22 10:00:48 itchy afpd[2381]: dsi_getsess: Connection refused
Feb 22 10:00:57 itchy afpd[2384]: session from 44038.212:246 on
44039.103:253
Feb 22 10:01:07 itchy afpd[2384]: atp_rresp: Connection timed out
Feb 22 10:01:12 itchy afpd[2385]: session from 44038.212:246 on
44039.103:251
Feb 22 10:01:17 itchy afpd[2384]: afp_die: asp_shutdown: Connection timed
out
Feb 22 10:01:17 itchy afpd[2384]: 0.04KB read, 5.18KB written
Feb 22 10:01:17 itchy afpd[2381]: server_child[0] 2384 done
Feb 22 10:01:21 itchy afpd[2386]: session from 44038.212:246 on
44039.103:253
Feb 22 10:01:22 itchy afpd[2385]: atp_rresp: Connection timed out
Feb 22 10:01:31 itchy afpd[2386]: atp_rresp: Connection timed out
Feb 22 10:01:32 itchy afpd[2385]: afp_die: asp_shutdown: Connection timed
out

Here's another strange log after messing around with the config files in
/etc/atalk:

Feb 22 10:16:31 itchy afpd[2534]: uam: uams_guest.so loaded
Feb 22 10:16:31 itchy afpd[2534]: uam: uams_clrtxt.so loaded
Feb 22 10:16:31 itchy afpd[2534]: uam: uams_dhx.so loaded
Feb 22 10:16:31 itchy afpd[2534]: uam: "DHCAST128" available
Feb 22 10:16:31 itchy afpd[2534]: uam: "Cleartxt Passwrd" available
Feb 22 10:16:31 itchy afpd[2534]: uam: "No User Authent" available
Feb 22 10:16:39 itchy afpd[2534]: refused connect from 144.92.19.76
Feb 22 10:16:39 itchy afpd[2534]: dsi_getsess: Connection refused
Feb 22 10:16:55 itchy afpd[2537]: session from 44038.158:248 on
44038.190:253
Feb 22 10:17:06 itchy afpd[2537]: afp_die: asp_shutdown: Connection timed
out

What the heck is this???

Feb 22 10:49:25 itchy afpd[3038]: setdirowner: chown 16777216/-1
.AppleDouble/.Parent: Invalid argument
Feb 22 10:49:25 itchy afpd[3038]: setdirowner: chown 16777216/-1
.AppleDouble: Invalid argument
Feb 22 10:49:25 itchy afpd[3038]: setdirowner: chown 16777216/-1 .:
Invalid argument
Feb 22 10:49:25 itchy afpd[3038]: setdirowner: chown -1/0
.AppleDouble/.Parent: Operation not permitted
Feb 22 10:49:25 itchy afpd[3038]: setdirowner: chown 16777216/-1
.AppleDouble/.Parent: Invalid argument
Feb 22 10:49:25 itchy afpd[3038]: setdirowner: chown 16777216/-1
.AppleDouble: Invalid argument
Feb 22 10:49:25 itchy afpd[3038]: setdirowner: chown 16777216/-1 .:
Invalid argument
Feb 22 10:49:25 itchy afpd[3038]: setdirowner: chown -1/0
.AppleDouble/.Parent: Operation not permitted

TIA!

---

From: "Florian Schedler" <[email-masked]>
Date: Fri, 23 Feb 2001 23:22:15 +0100

About dhx: I couldn't make it work either.

>From what I can see in your logfiles you might not have allowed your hosts
access to your servers putting them into hosts.allow/deny. That's when I
usually got those errors from dsi_getsess: Connection refused bla bla.

> Feb 22 10:00:57 itchy afpd[2384]: session from 44038.212:246 on

About your last log. The same thing happened to me today. As a result, when
I try to move a file into that directory i get a popup telling me I don't
have enough rights, but the file gets copied anyways. How can you give afpd
enough permissions to perform this operation?

> .AppleDouble/.Parent: Operation not permitted

Bye
florian.

---

From: "Marc J. Miller" <[email-masked]>
Date: Wed, 28 Feb 2001 09:49:09 -0800

Looks familiar to me too.

If you're using a netatalk 1.5 prerelease and you have either ADMIN_GRP or 
DROPKLUDGE turned on, I think that's my bailiwick and I need to know what 
platform and flavor you two using to fix it (e.g. Red Hat Linux 7, FreeBSD, 
Debian Linux 2.2, etc.).  That's an awfully large uid, though... 16 million 
user names is a lot.  Is it possible that the number is too big and we've 
run into a limitation of chown?

To be honest, my priorities are actually elsewhere at the moment.  That's 
the trouble with being a student employee with no one to take my place when 
I graduate; everything has to get done ASAP and left in good order and I 
only have two or maybe three weeks left.  Since this looks like it could be 
a mission-critical thing for my group as well, I'm willing to bump it up to 
the top of my list if no one else is willing to work on 
it.  (translation:  will someone *please* investigate so that I don't have to?)

---

From: Axel Bringenberg <[email-masked]>
Date: Wed, 28 Feb 2001 20:11:38 +0100

Hi Marc,

> run into a limitation of chown?

No, I don't think so. I've been fighting against the same problem too
and in my case I'm today the only user of a fresh installed rh7.0 box:

------------<snip>-----------------------------------
Feb 28 17:27:33 gromit afpd[18327]: cleartext login: bringi
Feb 28 17:27:33 gromit PAM_pwdb[18327]: (netatalk) session opened for
user bringi by (uid=0)
Feb 28 17:27:33 gromit afpd[18327]: login bringi (uid 500, gid 500)
Feb 28 17:27:36 gromit afpd[18327]: setdirowner: chown 16777216/-1
.AppleDouble/.Parent: Invalid argument
Feb 28 17:27:36 gromit afpd[18327]: setdirowner: chown 16777216/-1
.AppleDouble: Invalid argument
Feb 28 17:27:36 gromit afpd[18327]: setdirowner: chown 16777216/-1 .:
Invalid argument
Feb 28 17:27:36 gromit afpd[18327]: setdirowner: chown -1/0
.AppleDouble/.Parent: Operation not permitted
Feb 28 17:27:36 gromit afpd[18327]: setdirowner: chown 16777216/-1
.AppleDouble/.Parent: Invalid argument
Feb 28 17:27:36 gromit afpd[18327]: setdirowner: chown 16777216/-1
.AppleDouble: Invalid argument
Feb 28 17:27:36 gromit afpd[18327]: setdirowner: chown 16777216/-1 .:
Invalid argument
Feb 28 17:27:36 gromit afpd[18327]: setdirowner: chown -1/0
.AppleDouble/.Parent: Operation not permitted
Feb 28 17:28:01 gromit afpd[18327]: setdirowner: chown -1/0
.AppleDouble/.Parent: Operation not permitted
Feb 28 17:28:27 gromit afpd[18327]: logout bringi
------------<snip>-----------------------------------

This happens everytime while moving, copying or creating files -
directories are doing fine. Is it possible that some pieces of the new
(and broken) FORCE_UIDGID code is still active? Or is it maybee a
Redhat-only problem?

I've looked arround and found some similar messages in this list, all
reporting problems with
   setdirowner: chown -1/0 .: Operation not permitted
or setdirowner: chown -1/0 .AppleDouble/.Parent: Operation not permitted
or setdirowner: chown 16777216/-1 .: Invalid argument
or setdirowner: chown 16777216/-1 .AppleDouble/.Parent: Invalid argument

Most of them using rh7.0 (or mdk) and netatalk since 1.5pre3.

In my case I've ...
- build a freshly RH7.0 box with all possible updates (incl.
kernel-2.2.17-14)
- build netatalk-1.5pre4 from source w/o ADMIN_GRP, DROPKLUDGE and
FORCE_UIDGID
- I'm the first and only additional user (uid 500/gid 500)
- the volume is totaly owned by me (maximum chowned and chmoded :-)
- tested with MacOS 7.5, 8.6 and 9.0

Axel.

---

From: Keith Lamont <[email-masked]>
Date: Wed, 28 Feb 2001 13:32:20 -0600

Same here, except I tried the .rpm before building from scratch, and 
only tested against Mac OS 9. I'm not a total stranger to netatalk; 
had it running with RH 5.2 on another box.

Keith

---

From: Axel Bringenberg <[email-masked]>
Date: Wed, 28 Feb 2001 21:41:25 +0100

I'm just wondering why the _user_ process tries to set a gid of 0 or an
uid of 16777216 (0x1000000) ?! Hmm...

- Axel

-- 
Satz-Rechen-Zentrum Berlin - Systemgruppe

---

From: Marc Miller <[email-masked]>
Date: Wed, 28 Feb 2001 14:36:05 -0800 (PST)

Is it always the same uid (16777216)?  Does that uid correspond to anyone
registered on your system?  I have seen chown #/-1 and chown -1/# errors,
but not with that UID.

> - tested with MacOS 7.5, 8.6 and 9.0

============================================================
	/\/\arc ._|. /\/\iller ([email-masked])
	Computer Room Consultant
	Information Technology/Lab Management
============================================================
I can be contacted through the Communication Center link from
http://www.mother.com/~mjmiller/

---

From: Keith Lamont <[email-masked]>
Date: Wed, 28 Feb 2001 16:56:18 -0600

Here's some entries from my log. Owner is 500, group is 500, and both 
are the highest numbered ids in the system.

messages.1:Feb 24 10:29:19 fred afpd[5232]: setdirowner: chown 
16777216/-1 .AppleDouble/.Parent: Invalid argument
messages.1:Feb 24 10:29:19 fred afpd[5232]: setdirowner: chown 
16777216/-1 .AppleDouble: Invalid argument
messages.1:Feb 24 10:29:19 fred afpd[5232]: setdirowner: chown 
16777216/-1 .: Invalid argument
messages.1:Feb 24 10:29:19 fred afpd[5232]: setdirowner: chown -1/0 
.AppleDouble/.Parent: Operation not permitted
messages.1:Feb 24 10:29:19 fred afpd[5232]: setdirowner: chown 
16777216/-1 .AppleDouble/.Parent: Invalid argument
messages.1:Feb 24 10:29:19 fred afpd[5232]: setdirowner: chown 
16777216/-1 .AppleDouble: Invalid argument
messages.1:Feb 24 10:29:19 fred afpd[5232]: setdirowner: chown 
16777216/-1 .: Invalid argument
messages.1:Feb 24 10:29:19 fred afpd[5232]: setdirowner: chown -1/0 
.AppleDouble/.Parent: Operation not permitted
messages.1:Feb 24 10:31:44 fred afpd[5232]: setdirowner: chown -1/0 
.AppleDouble/.Parent: Operation not permitted

Keith

---

From: Thomas Schierle <[email-masked]>
Date: Thu, 01 Mar 2001 01:27:03 +0100

I see (saw -- I didn't complete the update to pre4 yet) the
"setdirowner: chown xxxxxxx/-1 -- .AppleDouble/.Parent: Invalid argument"
once per login.

Suse 7.0, netatalk pre2, pre3, installed from RPM
sharepoints root level write protected,
folders within sharepoint owned by user admin,
group users, gid set.

further information available on request next weekend (hopefully!)

-Thomas

-- 
Thomas Schierle, Munich, Germany

PGP key [DSS/DH] 0xA23CDA1D available at various public key servers

---

From: Axel Bringenberg <[email-masked]>
Date: Thu, 01 Mar 2001 11:01:48 +0100

> registered on your system?  I have seen chown #/-1 and chown -1/# errors,

Yes, in case of "[...]: invald argument" it is always uid 16777216 and
in case of "[...]: Operation not permitted" it's always gid 0. 

Axel.

---

From: Axel Bringenberg <[email-masked]>
Date: Thu, 01 Mar 2001 11:06:32 +0100

> in case of "[...]: Operation not permitted" it's always gid 0.

Oh, and no: This uid does correspond not to anyone registered on my
system. As I described in my little test results, I'm the only "normal"
user. Highest uid/gid is 500.

Axel.

---

From: Axel Bringenberg <[email-masked]>
Date: Mon, 05 Mar 2001 18:39:44 +0100

Hi,

inspired by the bug report
http://sourceforge.net/tracker/index.php?func=detail&aid=405434&group_id=8642&atid=108642
I have diff'ed the source of ./libatalk from 1.5pre4 against 1.5pre3:
Someone has changed line 617 of ./libatalk/adouble/ad_open.c from 
	admode = ad_mode( ad_p, mode );
to
	admode = ad_mode( ad_p, O_RDWR );
This is the only difference in the c source of libatalk.

I have changed the line back to the old version and now my problems are
partly gone: I have still log entries like "chown 16777216/-1" and
"chown -1/0" with . and .AppleDouble/.Parent while drag'n'drop files to
the server folder, but no more "access denied" error messages on the
clients side and the file permissions are looking imho fine to me.

Can someone explain the change in libatalk?

- Axel

---

From: Axel Bringenberg <[email-masked]>
Date: Mon, 05 Mar 2001 21:45:02 +0100

And here is the next:

I found that in ./etc/afpd/volume.c the line
	#define  VOLOPT_MAX        9
was changed to
	#define  VOLOPT_MAX        11

Changing back to 9 fixes the "chown 16777216/-1" problem, but the "chown
-1/0" still remains. Can someone check this?

Still hunting,
- Axel