Subject: SDI Auth & LDAP Auth...

From: "Marson, Hamish N" <[email-masked]>
Date: 23 Feb 1999 17:31:37 Z

OK. 

I'm almost finished putting SDI (Secure ID) authentication into wuftpd (Except changing to VR14 has meant that users now don't need to be in /etc/passwd to login... Whoops), and just starting ldap... (Looks easy as well). 

Question is, is there a better place to put these extra authentication routines into ftpd, apart from ftpd.c in the pass() function... Should they go somewhere else? I found an authentiacte function in authenticate.c, but then pass() already has BSD auth & ordinary /etc/passwd authentication in there... 

So should I make pass() big & long & complicated? or take the plunge & completely re-write the auth stuff (No thanks).... Or put it somewhere else?

I know people are asking for this, so I'd like to ge this done ASAP... (And I need it here too).

Hamish Marson.

---

From: Gregory A Lundberg <[email-masked]>
Date: Tue, 23 Feb 1999 14:49:08 -0500 (EST)

On 23 Feb 1999, Marson, Hamish N wrote:

> I'm almost finished putting SDI (Secure ID) authentication into wuftpd
> (Except changing to VR14 has meant that users now don't need to be in
> /etc/passwd to login... Whoops), and just starting ldap... (Looks easy
> as well).
> 
> Question is, is there a better place to put these extra authentication
> routines into ftpd, apart from ftpd.c in the pass() function... Should
> they go somewhere else? I found an authentiacte function in
> authenticate.c, but then pass() already has BSD auth & ordinary
> /etc/passwd authentication in there...
> 
> So should I make pass() big & long & complicated? or take the plunge &
> completely re-write the auth stuff (No thanks).... Or put it somewhere
> else?
> 

I vote for you taking the plumg and rewriting the USER/PASS morass :)
I can even put my CVS tree where you can have commit rights to it if it'll
help.

Since you're probably as afraid of that area of the code as I am, I'd
suggest that you try to make the minimum changes to the USER/PASS
functions, and put as much as possible in external source files.

I don't understand your comment about users not needing to be in
/etc/passwd for VR14.  BeroFTPD, maybe, but not VR14, unless you're doing
something special.  Not that moving away from /etc/passwd is necessarily a
bad idea.

I've not seen any requests for SecureID, but I can see that people would
want it.

LDAP is definitely a FRF dating back several years.

My suggestion for doing all this the cleanest way possible would be to use
PAM; but I'm given to understand that PAM has not made much headway in
cross-platform support.  Linux, Solaris and HP-UX, are all that support it
from what I understand.

-- 

Gregory A Lundberg              Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195

---

From: "Marson, Hamish N" <[email-masked]>
Date: 23 Feb 1999 20:02:17 Z

Ha ha... I knew someone would vote for a rewrite... I fixed the not needing to be in /etc/passwd problem. It stems from the HELP_CRACKERS code changes where it doesn't deny till the last minute... In the code I originally put the sdauth stuff into, it had kicked the user off already, so I was guaranteed to have been in /etc/passwd by the time the pass code got called... now it doesn't... That was easy to fix...

Now all I have to do is the ldap stuff...

The real change I have to thin about is MULTIPLE methods of authentication at the same time... Most OS'es have some way of saying this user does this auth, this one has this... Solaris has PAM, AIX has it's own way of doing it... I need to play with the code a bit to see if AIX's standard library calls for authentication work with ftp or not... I have a feeling they don't (Which will be a bit of a bummer).

H

lundberg/[email-masked] on 23/02/99 19:43:00
To:	Hamish N Marson
cc:	wu-ftpd
bcc:	
Subject:	Re: SDI Auth & LDAP Auth...

--