Subject: Re: which S/KEY code to use?

From: [email-masked] (Stan Barber)
Date: 11 Apr 1997 19:47:00 GMT

In article <[email-masked]> [email-masked] writes:
>I am trying to get S/KEY & wuftp 2-4-2 beta 12/13 to work
>together.  

I do not formally test skey support in the beta, so it could be broken.
If someone will do that testing for me before I release beta-14, I will be able
to consider the fixes. Otherwise, it will not be fixed in beta-14.
-- 
Stan   | Academ Consulting Services        |internet: [email-masked]
Olan   | For more info on academ, see this |uucp: {mcsun|amdahl}!academ!sob
Barber | URL- http://www.academ.com/academ |Opinions expressed are only mine.

---

From: [email-masked]
Date: Fri, 11 Apr 1997 21:44:05 -0400

Thanks to all.

I am now using logdaemon.5.6. and wuftp beta 12.

The version of skey was not the problem, nor did I want
to force pwok=1.

ftpd.c needs a call to skeyaccess() to turn on the
use of the /etc/skey.access file.  This allows unix passwords,
but not in the wide open manner of the previous suggestions.

I want to use this file to allow unix passwords from certain
logins, and from certain IP addresses only.   

It would be nice if the wuftp/skey combination would also check against
the IP address bound to the local end of the socket, to
further reduce IP spoofing possibilities. But its already
been a long day.

-------------

The fix to ftpd.c is:

1204a1205
>     pwok = skeyaccess( pw, (char *)0, remotehost, remoteaddr);

Starting at line 1203 of ftpd.c, the code looks like:

#ifdef SKEY
/* 0 means we found the user and the skeykeys file is open for update. */
    pwok = skeyaccess( pw, (char *)0, remotehost, remoteaddr); /* NEWLINE */
    if (skeychallenge (&skey_blk, name, chbuff) == 0)
        reply (331, "[%s] required for %s.", chbuff, name);
    else
#endif

pwok is set to 1 only if the parameters given to skeyaccess fit within
the rules in /etc/skey.access.

Chris

---

From: [email-masked]
Date: Fri, 11 Apr 1997 22:12:49 -0400

My apologies.

Beta 13 has the fix.

It's been a BAAAAD day.

Beta 13 and skey from logdaemon.5.6 work just fine.
I have no idea what screwy thing I did to get
so confused.

Chris