Subject: Netatalk security aspects?

From: [email-masked] (Georg Schwarz)
Date: Sat, 28 Jun 1997 02:05:06 +0200

Are there any measures one should take in order to diminish the risk of
a NetaTalk server getting hacked? For example, is it possible to
restrict access to an explicite list of ethernet addresses only?
Could and should one prevent users from exporting arbitrary directories?
Thanks.
-- 
Georg Schwarz     [email-masked], [email-masked]
Institut für Theoretische Physik       +49 30 314-24254, FAX -21130
Technische Universität Berlin        http://home.pages.de/~schwarz/

---

From: Bill Studenmund <[email-masked]>
Date: Fri, 27 Jun 1997 18:29:05 -0700 (PDT)

> Could and should one prevent users from exporting arbitrary directories?

I'm not sure about the host restrictions, but users can't export arbitrary
directories. Well, they can try, but the afpd process will run as them
when it tries to access these directories. Thus if the user doesn't have
access, they can't use netatalk to gain access.

---

From: Jason Luther <[email-masked]>
Date: Mon, 30 Jun 1997 08:21:33 -0500 (CDT)

xinetd and tcpwrappers (afaik) control connections to a host based on IP
address. xinetd is a replacement for inetd.

---

From: "Yannai A. Gonczarowski" <[email-masked]>
Date: Mon, 30 Jun 1997 16:49:43 +0300

> > Could and should one prevent users from exporting arbitrary directories?

However, if you have a router, or another firewall, etc..., you can
authenticate by hardware addresses.

Bye,
Yannai.

--
Yannai A. Gonczarowski     System Administrator    
[email-masked]
The Hebrew University High School     
http://www.leyada.jlm.k12.il/~yannaigo/

"Do you want to know something? Everybody's human."
"I find that remark insulting."
  - Kirk and Spock, "Star Trek VI: The Undiscovered contry", stardate
9529.1

---

From: Georg Schwarz <[email-masked]>
Date: Mon, 30 Jun 1997 15:58:44 +0200 (MEST)

> address. xinetd is a replacement for inetd.

will this really work for AppleTalk, which is *not* based on TCP/IP?

-- 
Georg Schwarz                             [email-masked]
Institut für Theoretische Physik    Tel. +49 30 314-24254, FAX -21130
Technische Universität Berlin          http://home.pages.de/~schwarz/
Sekr. PN 7-1, Hardenbergstr. 36, D-10623 Berlin            IRC: kuroi

---

From: Georg Schwarz <[email-masked]>
Date: Mon, 30 Jun 1997 16:05:51 +0200 (MEST)

> authenticate by hardware addresses.

can I let Linux do that directly, without additional hardware?

---

From: cyerkes <[email-masked]>
Date: Mon, 30 Jun 1997 11:20:00 -0400 (EDT)

But the mac's don't necessarily HAVE an IP address - they just
need to run appletalk.  An inetd is used where in this
equation?  What tcp/udp ports am I using?

I'd think that one correct answer about security is that if the
cracker is on you LAN, your life is pretty miserable anyway.

If it's I'net security as an issue, well, servers shouldn't
be exposed to the Internet and the router(s) should not allow
direct access to them in general.

chuck
--------------------