Subject: User authentication

From: Stephan Weibelzahl <[email-masked]>
Date: Thu, 07 Jun 2001 14:29:46 +0200

Hi,

I've trouble with encrypted user authentication.

Filesharing with cleartext password works well. But if I disable
cleartext passwords (-nocleartxt) and enable the other authentication
methods (-krbiv -randnum -rand2num) in afpd.conf, the Mac says that no
authentication method is available.

I am using the SuSE rpm, thus shadowed password support is compiled in
and I provided .passwd files for every user in their home-directories
which are set to the correct permission status.

Moreover, the Mac uses 2-way encryption when connecting to other
AppleShare servers automatically, thus this box seems to be configured
perfect.

Anything else that I missed to enable encrypted authentication? Any
ideas what's going wrong?

I am running 1.4b2+asun2.1.3 (SuSE rpm) on SuSE 7.0.

Thanks for your help.

Earl.

---

From: jeff <[email-masked]>
Date: Thu, 07 Jun 2001 09:25:51 -0400

> I am running 1.4b2+asun2.1.3 (SuSE rpm) on SuSE 7.0.

First suggestion: try 1.5pre6. The UAMs are known to work with that
version.

2-way encryption is supported by uams_randnum.so.

DHX encryption is supported by uams_dhx.so (which is really a symbolic
link to uams_dhx_pam.so or uams_dhx_passwd.so, depending on your
installation). Please upgrade your AppleShare Client to the newest
version for your platform (usually 3.8.8, I think) to allow it to
properly detect DHX authentication.

Thanks,
Jeff

---

From: Rich Lafferty <[email-masked]>
Date: Thu, 7 Jun 2001 09:48:04 -0400

> authentication method is available.

Okay, if your site's not running Kerberos (and you'd know if it was!),
-krbiv doesn't need to be there.
 
> which are set to the correct permission status.

I suspect that netatalk wasn't built against libdes.

  -Rich

-- 
Rich Lafferty --------------+-----------------------------------------------
 Montreal, Quebec, Canada   |  "Do not dangle the mouse by the cord or
 http://www.lafferty.ca/    |   throw it at coworkers."  -- SGI Indy manual
[email-masked] -----------+-----------------------------------------------

---

From: Stephan Weibelzahl <[email-masked]>
Date: Thu, 07 Jun 2001 16:51:02 +0200

Hi,

> First suggestion: try 1.5pre6. The UAMs are known to work with that

Great, it works. Setup of 1.5pre6 was pretty simple, and I could get it
run instantly.

Thanks very much,

Earl.

---

From: Olaf Hering <[email-masked]>
Date: Thu, 7 Jun 2001 19:49:48 +0200

> I suspect that netatalk wasn't built against libdes.

Do you think its possible to sell such a copy? 
The crypto stuff is somewhat problematic for a distributor...

Gruss Olaf

-- 
 $ man clone

BUGS
       Main feature not yet implemented...

---

From: jeff <[email-masked]>
Date: Thu, 07 Jun 2001 14:27:07 -0400

> The crypto stuff is somewhat problematic for a distributor...

The major linux distributions have been packaging OpenSSL for a while
now; I don't think it's that much of a problem.

Jeff

---

From: Olaf Hering <[email-masked]>
Date: Thu, 7 Jun 2001 20:33:34 +0200

> now; I don't think it's that much of a problem.

Is it a replacement for des? We have at least a des.rpm, but I'm not
sure if its still needed.

I'm currently write a short README.encryption, maybe its helpful.
At least my MacOS 8.5 doesnt allow encrypted passwords in the default
configuration.

Gruss Olaf

-- 
 $ man clone

BUGS

---

From: Rich Lafferty <[email-masked]>
Date: Thu, 7 Jun 2001 14:48:59 -0400

> Do you think its possible to sell such a copy? 

Netatalk's free, and so is libdes. Anyone's allowed to download it,
and download libdes, and link them together, if their country allows
the use of light crypto. And both, IIRC, give you the right to resell
it. So I'm not sure why it wouldn't be.

> The crypto stuff is somewhat problematic for a distributor...

I'm not familiar enough with German cryptography law to comment on
whether or not that would be a problem for SuSE. But they distribute
OpenSSL. I suspect it's just a case of not knowing what options
netatalk users tend to use.

  -Rich

---

From: Sebastian Rittau <[email-masked]>
Date: Thu, 7 Jun 2001 21:06:34 +0200

> netatalk users tend to use.

AFAIK there aren't any problems with German laws. But SuSE also has
a US branch and they probably have the same concerns as the Debian
project, which distributes all SSL stuff in its non-US section. Servers
that carry non-US are all located outside the US. (non-US does not mean
that it's forbidden to use that software in the US or to download it
to the US.)

But then, as jeff pointed out, all major distributions include SSL.
I think, you have to register with the US government somehow if you
want to export crypto stuff. (It's possible to do that by e-mail
and you only have to state the location where you're offering the
software, AFAIK.)

 - Sebastian

---

From: "Brandon Caudle" <[email-masked]>
Date: Thu, 7 Jun 2001 17:32:31 -0400

How much trouble can the averge joe like me get in.  My friend back in
Saudia Arabia wants W2K Server./ Suse 7.1 (US Edition)

Brandon Caudle