Subject: 8 character password limit

From: raynkid <[email-masked]>
Date: Sun, 25 Nov 2001 12:20:58 -0800 (PST)

Hello netatalk!

I have just installed netatalk-1.4b2+asun2.1.3-22 on a
linux box of 100+ users so users can access their
files on a mac. Installation and configuration went
smoothly. Most users are able to login and access all
their files.

However, users with passwords longer than 8 characters
cannot login to netatalk. Mac OS9 complains that
passwords are limited to 8 characters. Entering the
first 8 characters and ignore the rest results in
incorrect login.

On the linux box, passwords use MD5 and are shadowed.

Is this a netatalk configuration problem, or a Mac
problem? I have not yet tested this on OS X, but I
sense that OS X might have the same problem.

Anyone know a solution to this problem, besides
forcing users to 8 character passwords?

Thanks for all your help in advance,
[email-masked]

__________________________________________________
Do You Yahoo!?
Yahoo! GeoCities - quick and easy web site hosting, just $8.95/month.
http://geocities.yahoo.com/ps/info1

---

From: Matthew Geier <[email-masked]>
Date: Mon, 26 Nov 2001 07:47:38 +1100

raynkid wrote:

> passwords are limited to 8 characters.

> Entering the
> problem? 

 Its a 'mac' problem in that 8 characters is the limit for passwords
until the 'DHX' Authentication Method in OS9/OSX came along, and a Linux
problem in that you selected MD5 password encryption that uses ALL of
the letters some one puts in their password, 'crypt' only uses the first
8, thus masks this particular problem.

 If you use a later version of NetAtalk, and enable the DHX UAM, OS9
machines, and older ones with a newer AppleShare client installed, will
use the DHX method of password exchange which does not have a 8
character limit.

---

From: Thomas Kaiser <[email-masked]>
Date: Sun, 25 Nov 2001 22:24:48 +0100

am 25.11.2001 21:20 Uhr schrieb raynkid:

> Is this a netatalk configuration problem, or a Mac problem?

It's an UAM problem.

If a mac connects to an afp server the client asks the server for a list of
supported User Authentication Modules. It then compares with his own list
(built-in and third-party modules located in the AppleShare folder inside
the System Folder) and tries to find a match.

The 'classic' UAMs 'Cleartxt Passwrd', 'Randnum exchange' and '2-Way Randnum
exchange' only supported passwords with max. 8 characters. This limitation
has gone with the newer Diffie Hellman Exchange UAM (DHX) --> up to 64
characters possible.

Recent AppleShare Clients support the DHX UAM, which older Netatalk Versions
won't. You might want to give Netatalk 1.5 a try?

Regards,

Thomas

PS: You can examine which UAMs your server supports, if you run
    'asip-status.pl [your server's ip address]'. You can get it from here:
    <http://www.jammed.com/~jwa/hacks/security/asip/>

---

From: Karen A Swanberg <[email-masked]>
Date: Mon, 26 Nov 2001 12:34:36 -0600 (CST)

> > Is this a netatalk configuration problem, or a Mac problem?

<snip>
 
> won't. You might want to give Netatalk 1.5 a try?

Apple has a list of which AppleShare clients are available for which OS
at:
http://til.info.apple.com/techinfo.nfs/artnum/n60792?OpenDocument&software
(this site requires cookies and a free registration) [I typed that URL in
by hand, sorry for any typos]. Appleshare Client 3.8.8 runs on most 8+
OS's, and supports longer passwords just fine.

Does anyone happen to know if this just encrypts username/password, or
the whole appleshare session?

-Karen

-                                                                  -
    Karen Swanberg | Sys Admin | Dept. of Geology and Geophysics    
206 Pillsbury Hall | 310 Pillsbury Ave. SE | University of Minnesota
     Minneapolis, MN 55455  (612) 624-6541  (612) 625-3819 (f)

              * <---- Tribble   . <--- Tribble.tgz

---

From: Steve Freitas <[email-masked]>
Date: Mon, 26 Nov 2001 11:07:44 -0800

> the whole appleshare session?

Just username/password.

Steve

---

From: Thomas Kaiser <[email-masked]>
Date: Mon, 26 Nov 2001 21:42:57 +0100

On Mon, 26 Nov 2001 12:34:36 -0600 (CST), Karen A Swanberg wrote:

> by hand, sorry for any typos].

These older Lotus Domino URLs aren't valid any more. Apple nowadays uses
WebObjects for their own sites, so you can search from here on for older
articles: <http://kbase.info.apple.com/cgi-bin/WebObjects/kbase.woa/> or use
the direct link: <http://docs.info.apple.com/article.html?artnum=60792>

> Appleshare Client 3.8.8 runs on most 8+ OS's, and supports longer passwords
> just fine.

But won't you allow startup mounting of remote volumes as the passwords are
stored in the keychain (which doesn't exist in MacOS 8.x)

> the whole appleshare session?

*Only* the password: <http://docs.info.apple.com/article.html?artnum=58373>

Regards,

Thomas