Subject: s/key and fetch

From: Kenji Miyake <[email-masked]>
Date: Thu, 25 Feb 1999 02:01:03 +0900

Hello,

	I'm trying to use wu-ftpd-2.4.2-beta-18-vr14(with SKEY
support) between fetch 3.0.3 (macintosh ftp client) but no work.
because fetch doesn't recognize s/key challenge phrase
(wu-ftpd-2.4.2-beta-14 or early version are parse correctly)

--- ftpd.c.org	Sun Feb 21 02:38:14 1999
+++ ftpd.c	Wed Feb 24 06:01:06 1999
@@ -1382,34 +1382,6 @@
     return(&save);
 #endif
 }
-#if defined(SKEY) && !defined(__NetBSD__)
-/*
- * From Wietse Venema, Eindhoven University of Technology. 
- */
-/* skey_challenge - additional password prompt stuff */
-#ifdef __STDC__
-char   *skey_challenge(char *name, struct passwd *pwd, int pwok)
-#else
-char   *skey_challenge(name, pwd, pwok)
-char   *name;
-struct passwd *pwd;
-int    pwok;
-#endif
-{
-    static char buf[128];
-    char sbuf[40];
-    struct skey skey;
-
-    /* Display s/key challenge where appropriate. */
-
-    if (pwd == NULL || skeychallenge(&skey, pwd->pw_name, sbuf))
-	sprintf(buf, "Password required for %s.", name);
-    else
-	sprintf(buf, "%s %s for %s.", sbuf,
-		pwok ? "allowed" : "required", name);
-    return (buf);
-}
-#endif
 int login_attempts;             /* number of failed login attempts */
 int askpasswd;                  /* had user command, ask for passwd */
 #ifndef HELP_CRACKERS
@@ -1482,6 +1454,10 @@
     extern int ext_auth;
     extern char *start_auth();
 #endif
+#ifdef SKEY
+    char sbuf[40];
+    struct skey skey;
+#endif
 
 /* H* fix: if we're logged in at all, we can't log in again. */
     if (logged_in) {
@@ -1847,7 +1823,12 @@
     /* this is the new way */
     pwok = skeyaccess(pw, NULL, remotehost, remoteaddr);
 #endif
-    reply(331, "%s", skey_challenge(name, pw, pwok));
+    if (pw == NULL || skeychallenge(&skey, pw->pw_name, sbuf))
+      reply(331, "Password required for %s.", name);
+    else {
+      lreply(331, "s/key %s for %s.", pwok ? "allowed" : "required", pw->pw_name);
+      reply(331, "%s", sbuf);
+    }
 #else
     if (skey_haskey(name) == 0) {
 	char *myskey;

---

From: Ayamura Kikuchi <[email-masked]>
Date: 25 Feb 1999 02:58:00 +0900

> +      lreply(331, "s/key %s for %s.", pwok ? "allowed" : "required", pw->pw_name);

No. This is a matter of your OTP library.

-- ayamura

---

From: Kenji Miyake <[email-masked]>
Date: Thu, 25 Feb 1999 03:36:46 +0900

From: Ayamura Kikuchi <[email-masked]>
Subject: Re: s/key and fetch
Date: 25 Feb 1999 02:58:00 +0900

> No. This is a matter of your OTP library.

I'm build wu-ftpd with logdaemon-5.6 and make status code to

331 s/key 98 xx999999

was recognized but

331 s/key 98 xx999999 allowd for user.

was not.

fetch may fail to find end of challenge phrase.

---

From: Ayamura Kikuchi <[email-masked]>
Date: 25 Feb 1999 04:13:45 +0900

> 331 s/key 98 xx999999 allowd for user.

The string "s/key" should not be used as the first token of the
challenge. The syntax of the challenge should be:
	otp-<algorithm identifier> <sequence integer> <seed>

An example of an OTP challenge is:
	otp-md5 123 bar

-- ayamura

---

From: Kenji Miyake <[email-masked]>
Date: Thu, 25 Feb 1999 04:41:02 +0900

From: Ayamura Kikuchi <[email-masked]>
Subject: Re: s/key and fetch
Date: 25 Feb 1999 04:13:45 +0900

> An example of an OTP challenge is:

These require for OPIE options.

s/key require string "s/key".

---

From: Gregory A Lundberg <[email-masked]>
Date: Wed, 24 Feb 1999 14:56:53 -0500 (EST)

OPIE is not S/Key.  Your patch was for S/Key authentication.

VR15 will include fixes for OPIE along the lines you're talking about.

-- 

Gregory A Lundberg              Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195

---

From: Ayamura Kikuchi <[email-masked]>
Date: 25 Feb 1999 05:06:13 +0900

> s/key require string "s/key".

See RFC2243 (Standards Track) and so on.

-- ayamura