Re: Progress with netatalk on Seagate DockStar

[pitz <pitz.wong@gmail.com>]

On Oct 21, 7:09 am, pitz <pitz.w...@gmail.com> wrote:
> On Oct 21, 4:55 am, Steven Hirsch <snhir...@gmail.com> wrote:
>
>
>
> > On 10/20/2010 05:40 PM, pitz wrote:
>
> > > I've been working on this the past several nights and just wanted to
> > > provide some progress info.
>
> > > I'm using the Debian "squeeze" (testing) distribution because it has
> > > support for the armel processor that the Seagate DockStar has.  Debian
> > > installation notes onhttp://peterwong.net/blog/?p=115
>
> > > The netatalk package (2.1.2) "worked" right after installation.  I did
> > > have to enable the atalkd service in the netatalk configuration. Using
> > > Marsha's modified AppleShare CDEV in an Apple IIgs allowed me to mount
> > > the share using cleartext authentication.  Randnum authentication (if
> > > you're concerned about plaintext passwords going through your network)
> > > is not supported because the randnum UAM is not built in the netatalk
> > > package.
>
> > You might want to include my one-liner fix for file date propagation.  Check
> > the packages I put on the a2 mail account (or send private e-mail if you
> > cannot access that).  Without it, file dates are not preserved from P8 clients.
>
> > Steve
>
> randnum auth (using libgcrypt) now kinda works.  Only if I use
> ~/.passwd instead of afppasswd as the password file.  afppasswd again
> relies on openssl.  I'll try to see if I can make randnum go through
> PAM instead of afppasswd.
>
> /pitz

As it turns out, because of the nature of randnum auth, I cannot make
it go through PAM.  Randnum auth needs access to the plaintext
password because it uses it as the encryption key to the randnum.  PAM
will not let applications retrieve the authentication token
(password); only PAM modules have access to it.  I respect this
restriction for security reasons; token encryption should generally be
one-way and only the encrypted forms should be compared during
authentication.

So aside from uams_randnum, I'll have to convert afppasswd to use
libgcrypt as well.

/pitz