Subject: Reality check on authentication notes

From: "Chris Herrmann" <[email-masked]>
Date: Tue, 31 Jul 2001 15:43:38 +1000

Hi all,

I've included most of Thomas' notes in the url below. There's a question
still about how authentication works/doesn't work if pam passes
authentication off to an ldap server etc. Anyone got any experience here?

<snip>
>
> http://gemini.faredge.com.au/netatalk/authentication.html
>
Well, there is an open issue: integrating authentication against external
services like ldap, smb, etc. as Harald wrote.

| am 30.07.2001 11:45 Uhr schrieb Harald Wagener:
|
| > But You cannot use DHX if authentication is passed to some external
| > mechanism by PAM. And if You put uams_dhx.o in the list of allowable
| > methods, the chooser (appleshare client) will choose that of it´s own,
| > and authentication against the ldap server won't work anymore.
| > Or am I wrong here?

I don't have any spare time to check this out. Maybe somebody asks this on
the Netatalk-devel lists whether there is a way to combine the pam uam with
dhx authentication. This would improve things much.

<unsnip>

Cheers,

Chris

---

From: Harald Wagener <[email-masked]>
Date: Tue, 31 Jul 2001 11:02:56 +0200

> authentication off to an ldap server etc. Anyone got any experience here?

It can be done. You have to configure pam to use the ldap auth module for
netatalk,
and use uams_cleartext.so as uam, since pam passes the password to the ldap server
and needs it in clear text for this.

down side: uams_cleartext.so only works with passwords up to 8 characters long
up side: it also supports groups defined in the ldap directory, i.e. You don't
need
to pollute Your *nix setup with entries in the group definition file.

By the way: We use netatalk on xfs, and are having only minor problems (see other
posting).

This is on RedHat 7.1, with a 2.4.2-XFS kernel, on a dual PIII-800 machine with a
redundantly
controlled raid array over a intel eepro gigabit network card.

-- 
Harald Wagener      |                                Systemadministrator 
FCB/Wilkens GmbH    |                              Tel.:+49-40-2881-1252 
An der Alster 42    |                              Fax.:+49-40-2881-1263 
20099 Hamburg       |                         http://www.fcb-wilkens.com

---

From: Thomas Kaiser <[email-masked]>
Date: Tue, 31 Jul 2001 12:33:21 +0200

on Tue, 31 Jul 2001 11:02:56 +0200, Harald Wagener wrote:

> You have to configure pam to use the ldap auth module for netatalk, and use
> uams_cleartext.so as uam, since pam passes the password to the ldap server

What about uams_dhx_pam.c?

<http://cvs.sourceforge.net/cgi-bin/viewcvs.cgi/netatalk/netatalk/etc/uams/>

Regards,

Thomas

---

From: Jeff <[email-masked]>
Date: Tue, 31 Jul 2001 09:12:08 -0400

> dhx authentication. This would improve things much.

You just have to use the DHX PAM module, then set up your PAM file for
netatalk to authenticate off of whatever you want.

Also, you have to compile the 1.5pre series with --enable-pam to allow
PAM to work with cleartext and DHX.

Jeff

---

From: "Jonathan Newman" <[email-masked]>
Date: Tue, 31 Jul 2001 09:47:27 -0700

> and needs it in clear text for this.

We use DHX with PAM.  If netatalk is built with pam support and DHX support
you should end up with a symlink from uams_dhx_pam.so to uams_dhx.so.

This should allow dhx authentication through your ldap server (assuming you
configure the PAM settings correctly), without the need for cleartext
passwords.

Jon

---

From: Harald Wagener <[email-masked]>
Date: Wed, 01 Aug 2001 10:20:45 +0200

> <http://cvs.sourceforge.net/cgi-bin/viewcvs.cgi/netatalk/netatalk/etc/uams/>

Seems I haven't seen it before, must check on it. Will report on success/failure.

Greetings,
	Harald