Re: ProDOS, OS X and Netatalk

[Steven Hirsch <snhirsch@gmail.com>]

DaveSchmenk wrote:

> I just recently upgraded a new Linux server with Debian testing.  My
> old server was working fine with a much older version of Debian but
> even still it took some time to get it working.  I have a GatorBox
> router and don't boot the IIe or IIgs from the Linux box - I only
> share files.  The biggest issue for me was getting the uams_* list
> right.  Having my GatorBox already configured was a big help.
>
> Note:  my server is also my internet gateway and firewall so I
> explicitly enter my home net ethernet device and IP.
>
> My afpd.conf looks like:
>
> "Blade" -transall -ipaddr 192.168.123.1 -uamlist
> uams_clrtxt.so,uams_randnum.so,uams_dhx.so  -nosavepassword -
> passwdfile ~/.passwd
>
> This way I keep the password in my local server directory and is much
> easier to manage.  Note the .passwd *must* have only user
> permissions.

For IIe clients, that works just fine.


>  I had to download the Debian package in order to build
> the missing uams_randnum.so from source.  I didn't replace the whole
> netatalk package, I just added the missing uams_* to /usr/lib/
> netatalk.  It looks like Debian testing is built using PAM, so
> uams_clrtxt.so softlinks to uams_pam.so. 

You went to more trouble than you needed to!  Here are the directions I worked 
up when working with Tony:

----------------------------------

For Apple 2 compatibility, the deb package must be build with

DEB_BUILD_OPTIONS=ssl

set in the environment.  This will additionally require that
libssl-dev be installed on the system.  By doing so, netatalk will
support so-called 'RANDNUM' authentication.  At login, the
/etc/netatalk/afppasswd file is used for lookup, NOT the underlying
PAM or Unix systems.  Plaintext login does try to work through
pam_unix, but is not functional in the few attempts I've made to use
it.

Both the IIe workstation card and IIgs built-in Appletalk are capable
of authenticating over RANDNUM.  (NOTE:  Not sure if IIe actually does support 
RandNum - need to verify)

In addition to the build pre-requisites listed in the .dsc file, the
following are needed:

cracklib2-dev (for libcrack)
libkrb53 (for libk5crypto)
libssl0.9.8 (for libcrypto)

The second and third item above AND libgssapi_krb5 require "unversioned"
symlinks to the versioned libraries, e.g. in /usr/lib:

$ ln -sf libk5crypto.so.3 libk5crypto.so
$ ln -sf libcrypto.so.4 libcrypto.so
$ ln -sf libgssapi_krb5.so.2 libgssapi_krb5.so

if any or all these links fail to exist on the system.

Procedure for build:

$ dpkg-source -x netatalk_2.0.3-4a2.dsc

$ cd netatalk_2.0.3

$ DEB_BUILD_OPTIONS=ssl dpkg-buildpackage -rfakeroot -b

Use files in netatalk_config archive as guide for setup.  Do NOT overlook
creation of /etc/netatalk/afppasswd, using the /usr/bin/afppasswd utility.

This package has been verified to work on 64-bit Ubuntu Hardy.

Update 1/2/2010:  Verified build on Karmic

---------------------------------------------------------

Build procedure:

Place these in a common directory where you have write permissions:

netatalk_2.0.3-4a2.diff.gz
netatalk_2.0.3-4a2.dsc
netatalk_2.0.3.orig.tar.gz

Then, unpack:

$ dpkg-source -x netatalk_2.0.3-4a2.dsc

change into the newly-created directory and build:

$ DEB_BUILD_OPTIONS=ssl dpkg-buildpackage -rfakeroot -b

(skip the -rfakeroot flag if you are already root at the time)

purge any existing netatalk package completely:

$ dpkg --purge netatalk

and install the new one:

$ dpkg -i netatalk_2.0.3-4a2.deb

Then, add the the appropriate 'ethN ..' line to /etc/netatalk/atalkd.conf.

Prevent a future apt-get upgrade from replacing this back-level version 
(details to be added).

---------------------------------------------------------------------

> I don't even remember why I
> needed the uam_randnum, but I think it was for the IIgs.

Yes, required for the IIgs to log in.

After the above build and install occurs, you will have the normally-missing 
afppasswd utility required to setup randnum authentication.  I keep hearing 
suggestions that PAM can somehow be used for this, but I've never been able to 
get that to work.  My suspicion is that applies strictly to cleartext login.

Steve