Subject: An UAM question

From: "Jimmy" <[email-masked]>
Date: Wed, 20 Feb 2002 17:06:55 +0800

I make and install netatalk 1.5.2 on redhat 6.2.
It works properly. But after I modify afpd.conf to

- -transall -uamlist uams_passwd.so -nosavepassword

I cannot login from mac. The error message is as following:

afpd[2372]: ASIP started on 127.0.0.1:548(2) (1.5.2)
afpd[2372]: uam_load(uams_passwd.so): mod_symbol error for symbol
uams_passwd
afpd[2372]: uam: uams_passwd.so load failure

What's wrong? But with uams_clrtxt.so, it works.
Does that mean I must use PAM?

Thanks.

Jimmy

---

From: Thomas Kaiser <[email-masked]>
Date: Wed, 20 Feb 2002 15:51:24 +0100

On Wed, 20 Feb 2002 17:06:55 +0800, Jimmy wrote:

> I cannot login from mac.

Correct. You must specify UAMs, not the underlying modules for the backend
mechanisms.

> [...]

Once again (as we discussed this in the 'logging in' thread already):

There are 4 'standard' UAMs:

No User Authent        --> uams_guest.so (no authentication, guest login)

Cleartxt Passwrd       --> uams_clrtxt.so (password transmission in
                               cleartext between macintosh and server)

Randnum exchange       \_  uams_randnum.so (password encrypted equivalent
2-Way Randnum exchange /       to 56 bit DES)

DHCAST128              --> uams_dhx.so (password transmission strong
                               encrypted -- equivalent to 128 bit SSL)

(A detailled description from Leland Wallace can be found here:
<ftp://terminator.rsug.itd.umich.edu/unix/netatalk/archive/netatalk-admins-m
ail/0647.html>)

uams_guest.so has naturally no authentication features as it just enables
guest login.

uams_randnum.so handles the passwords itself, eg. via a file ~/.passwd (one
per user) with the password stored in cleartext _or_ via one central
afppasswd file (see 'man afppasswd' for details how to create/maintain this)

(BTW: the comments in afpd.conf regarding '-passwdfile' are _wrong_! The
default is not ~/.passwd and you won't see any messages in your logs if you
have a wrong formatted central afppasswd file on your system -- maybe this
will be fixed by the developers -- both the wrong comment and the lack of
logging in case something went wrong with parsing the afppasswd file -- IMO
it's inappropriate to get a 'wrong password' alert on the mac when afpd just
isn't able to parse the afppasswd file -- without logging this fact)

uams_clrtxt.so and uams_dhx.so can use different authentication backends,
actually uams_(dhx_)passwd.so or uams_(dhx_)pam.so

So both uams_clrtxt.so and uams_dhx.so are just symlinks to the
authentication backends, you want to use (either PAM or files like
/etc/passwd or /etc/shadow).

If it's a link to uams_passwd.so' then you will authenticate against
/etc/shadow or /etc/passwd and if it's linked to uams_pam.so then you will
use PAM (and in consequence that what you configured PAM to use for
authentication --> NIS, LDAP, Kerberos, whatever)

There is a difference between the UAM mechanism between AFP client and
server and the used authentication backend mechanism on the server itself.

Someone on this list is preparing an illustration regarding this (hopefully
he will be finished soon :-).

I supplied him with a sample chart regarding DHX:

+--------------------------------------------------+ .......................
| DHX UAM (built-in since AppleShare client 3.8.4, |     client-side UAM
|         available as a plug-in for 3.8.3)        |        support
+--------------------------------------------------+ .......................
|   Password (up to 64 bytes in length) will be    |
|    encrypted with 128 bit SSL, user will be      |     encryption and
|  authenticated against the server, but not vice  |     authentication
|  versa. Therefor weak against man-in-the-middle  |  between mac and server
|                    attacks                       |
+--------------------------------------------------+ .......................
|              DHX UAM --> uams_dhx.so             |     server-side UAM
|     (this has to be specified in afpd.conf)      |        support
+------------------------+-------------------------+ .......................
|    uams_dhx_pam.so     |   uams_dhx_passwd.so    |  authentication backend
+------------------------+-------------------------+ .......................
PAM                      |  either /etc/shadow or  |
-----+------------+------+  /etc/passwd depending  |  authentication scheme
LDAP |  Kerberos  |  NIS |  on configure settings  |
-----+------------+------+-------------------------+ .......................

Regards,

Thomas