Subject: [netatalk-admins] AFS/KERBEROS Support on Solaris 2.5.1 with netatalk-1.4b2+asun2.0a13

From: "Mario L. Gonzales" <[email-masked]>
Date: Thu, 7 Aug 1997 14:12:28 -0400 (EDT)

Hi Folks,

I am having a horrible time getting AFS and Kerberos to work with
netatalk-1.4b2+asun2.0a13.

I have Kerberos 4a10, and am using afs-3.4a.516.

I can --finally-- *yea* get netatalk-1.4b2+asun2.0a13 to compile on my
Solaris 2.5.1 box (Sparc 5) with Kerberos and AFS support disabled --
and it works just fine.  actually before this last mod by Sun -- that was 
impossible.  

I am not the greatest compiler and I know just enough C to be dangerous :)

So if anyone has been able to get AFS and Kerberos Support to work with
Sun's TCP/IP mods to netatalk-1.4b2+asun2.0a13 I would be very interested
in chatting with you as soon as possible. :)

Just in case someone can see what is going wrong -- (I think it might
actually be an error in the code itself but I am not quite sure)....

Here is the last bits of output before the complie dies...

if [ x"/usr/afsws" != x ]; then \
    AFSLIBS="-lkauth -lprot -lubik -lauth -lsys -lrxkad -lrx -laudit \
        -llwp -lcmd -lcom_err /usr/afsws/lib/afs/util.a -ldes"; \
    AFSLIBDIRS="-L/usr/afsws/lib -L/usr/afsws/lib/afs"; \
    AFSINCPATH="-I/usr/afsws/include"; \
    AFSDEFS="-DAFS"; \
fi; \
make  CC="gcc" ADDLIBS="-lsocket -lnsl" DEFS="-I../../sys/solaris
-D__svr4__ -DSOLARIS" \
    OPTOPTS="-O" DESTDIR="/spare/atalk" \
    SBINDIR="/spare/atalk/etc" BINDIR="/spare/atalk/bin"
RESDIR="/spare/atalk/etc" \
    ETCDIR="/spare/atalk/etc" LIBDIR="/spare/atalk/lib"
INCDIR="/spare/atalk/include" \
    KRBLIBS="${KRBLIBS}" KRBLIBDIRS="${KRBLIBDIRS}" \
    KRBINCPATH="${KRBINCPATH}" KRBDEFS="${KRBDEFS}" \
    AFSLIBS="${AFSLIBS}" AFSLIBDIRS="${AFSLIBDIRS}" \
    AFSINCPATH="${AFSINCPATH}" AFSDEFS="${AFSDEFS}" \
    afpd
gcc -I../../sys/solaris -D__svr4__ -DSOLARIS -DAFS -DKRB -O
-I../../include -I/usr/afsws/include -I/usr/pkg/krb4-10a/include
-DAPPLCNAME -DCRLF  -c  afs.c
afs.c:40: warning: `min' redefined
/usr/afsws/include/afs/stds.h:197: warning: this is the location of the
previous definition
afs.c:62: parse error before `AFPObj'
afs.c:62: warning: data definition has no type or storage class
afs.c:65: parse error before `{'
afs.c:73: parse error before `+='
afs.c:74: parse error before `&'
afs.c:81: parse error before `&'
afs.c:104: `vi' undeclared here (not in a function)
afs.c:104: warning: initialization makes pointer from integer without a
cast
afs.c:104: initializer element is not constant
afs.c:104: warning: data definition has no type or storage class
afs.c:105: parse error before `return'
afs.c:167: parse error before `AFPObj'
afs.c:167: warning: data definition has no type or storage class
afs.c:170: parse error before `{'
afs.c:178: redefinition of `rbuflen'
afs.c:104: `rbuflen' previously defined here
afs.c:178: warning: data definition has no type or storage class
afs.c:179: conflicting types for `iend'
afs.c:174: previous declaration of `iend'
afs.c:179: warning: initialization makes integer from pointer without a
cast
afs.c:179: initializer element is not constant
afs.c:179: warning: data definition has no type or storage class
afs.c:180: parse error before `+='
afs.c:181: parse error before `&'
afs.c:188: parse error before `&'
afs.c:216: parse error before string constant
*** Error code 1
make: Fatal error: Command failed for target `afs.o'
Current working directory /spare/mario/netatalk-1.4b2+asun2.0a13/etc/afpd
*** Error code 1
make: Fatal error: Command failed for target `all'
Current working directory /spare/mario/netatalk-1.4b2+asun2.0a13/etc/afpd
*** Error code 1
make: Fatal error: Command failed for target `afpd'
Current working directory /spare/mario/netatalk-1.4b2+asun2.0a13/etc
*** Error code 1
make: Fatal error: Command failed for target `../../etc'
Current working directory
/spare/mario/netatalk-1.4b2+asun2.0a13/sys/solaris
*** Error code 1
make: Fatal error: Command failed for target `all'

---------------------------------------------------------------------------
                            |   Systems Administration Group, O.I.T.
  phone://919.660.7037/     |   Duke University, 412 North Building 
    fax://919.660.7029/     |   Durham, NC  27708 
 mailto:[email-masked]  |   http://www.oit.duke.edu/~mario/
---------------------------------------------------------------------------
    FOR MY PGP PUBLIC KEY: "finger -m [email-masked] | pgp -fka"

---

From: "Mario L. Gonzales" <[email-masked]>
Date: Thu, 7 Aug 1997 16:49:07 -0400 (EDT)

Hello Folks,

I am trying to find some resources to help me understand how the
Kerberos and AFS support are implemented in netatalk.

I am very concerned about security and the possible violation of the
Kerberos/AFS security models (ie trusting a non-trusted source,
clear text passwords, unauthenticated acccess to afs file systems, 
key theft, ticket theft, etc).

Does anyone have any information on what Security model netatalk uses?
What steps are taken to not allow unauthenticated access to afs data?

Is netatalk a proxy for the client to talk to the afs servers?
Does netatalk authenticate for you and how?  

I guess I am paranoid and cannot seem to find any information 
via the FAQ's.  Also went so far as to AltaVista Search for tidbits
and could not find anything.

Thanks again,

		Mario

---

From: Everette G Allen <[email-masked]>
Date: Fri, 8 Aug 1997 10:19:50 -0400

Hi,
For netatalk 1.3.3 there exsists two  schemes for kerberos authentication
and AFS authorization:

1) Via the Authman User Authentication Method (UAM) which is to my
knowledge not documented except to read the source code (even the document
from apple about UAM's in general is obscure and not available unless you
beg one of the developers inside apple).  For AFP Spec 2.2 one the
AppleShare IP developers (Leland Wallace) is working on a UAM SDK and there
is a proposed afp url scheme (see http://www.opendoors.com/asip/ for
details).  See the technical docs at http://appleshareip.apple.com for
details on AFP 2.2 and how to join the appleshare ip 5.0 list to get info
on implemention and testing.  There used to be source for the mac part of
the UAM on ftp://terminator.rs.itd.umich.edu but I have not been able to
find it and Wes Craig has not to my knowledge had time to document it or
make the code available.  What about it Wes??

2) The folks at Stanford did a project called netatalk 1.3.3su which is
available as source and sunos binary from
ftp://networking.stanford.edu/pub/andy/Macleland.  This mod impements a
callback routine over appletalk (in version 1 and 2) initially and latter
(version 3) over tcp/ip using the S/Ident protocol RFC (now expire in ietf,
check with Bob Morgan at Stanford) and a generalized call back routine
detailed at http://www-leland.stanford.edu/~torg/WWW-security.doc.html.
This latter version is still in developement at Stanford and is not in the
binary or source in the ftp site listed above.  Look at
http://www-leland.stanford.edu/~maas/macleland/ and
http://www-dccs.stanford.edu/macleland/ for details.  Feel free to have a
look at http://www4.ncsu.edu/~ega/macleland/netatalk.html for setup and
install documentation details for the setup we use here at ncsu.  This mod
requires that a listener be running on  every mac client (MacLeland).  Some
folks at Duke already run macleland (see
http://www.duke.edu/~jwk3/kerberos/ if you didn't already know :-).

So the difference in  the two:
a) UAM is plugin (file://System Folder/AppleShare Folder) to the AppleShare
connection scheme which is (now, again) supported by Apple.  Currently UAMs
are supported only over appletalk with tcp/ip RSN.
Authman is required to be installed(ftp://monet.ccs.itd.umich.edu/pub/).
The callback is a Stanford home grown which they are using for web
authentication as well.
b) UAM should work with 1.4.x netatalk.  To my knowledge no one has ported
the Stanford mods to the netatalk 1.4.x beta yet.  Anyone game??
c) Neither support kerberos V5 native and neither are interoperatable.  So
the UAM can not be used with MacLeland nor Kclient and the Callback can not
be used with Kclient nor Authman.  (its much worse with samba on pc).

If anyone else has additional or better information please post or send to
me and I will summarize.

>and could not find anything.

Everette Gray Allen                               Consultant IV
Box 7109 NCState Campus                     Computing Services
Raleigh, NC 27695-7109                       919-515-2517