Subject: Does wu-ftp support DCE?

From: [email-masked]
Date: Wed, 14 Jul 1999 17:18:43 +0000

Hello all,

I installed wu-ftp 2.5.0 on AIX 4.3. wu-ftp should replace normal ftp function
plus addon of anonymous ftp service. All works besides the authentication
of DCE users on that machine.

With other words a normal ftp session to a DCE user on that system fails with:
  Name (aix:zdv045):
  331 Password required for zdv045.
  Password:
  530 Login incorrect.
  Login failed.
For non DCE users in the normal Unix shadow password table login is OK.

Has someone experience with this?

Greetings

-- 
Mit freundlichen Gruessen
Ulrike Schmidt

+----------------------------------------------------------------------+
| Ulrike Schmidt                                                       |
| Zentralinstitut fuer Angewandte Mathematik                           |
| Forschungszentrum Juelich GmbH                                       |
| D-52425 Juelich                                                      |
|                                           Phone: +49 02461 61-6577   |
| Email: [email-masked]            Fax:   +49 02461 61-6656   |
+----------------------------------------------------------------------+

---

From: Rainer Schoepf <[email-masked]>
Date: Thu, 15 Jul 1999 09:41:51 +0200 (MEST)

> Has someone experience with this?

Appended are patches for wu-ftpd-2.4.2-vr16 to authenticate against
AFS and/or DCE. Note that I never really tested DCE alone, without
AFS, so there might be some problems. Just replace -DAFS_AUTH by
-DDCE_AUTH and ${LAFS} by -ldce in the Makefile.

-- 
   Rainer Schöpf
   Zentrum für Datenverarbeitung           A point of view can be a dangerous
    der Universität Mainz                  luxury when substituted for insight
   Anselm-Franz-von-Bentzel-Weg 12         and understanding.
   D-55099 Mainz
   Germany                                  Herbert Marshall McLuhan:
   <[email-masked]>                          The Gutenberg Galaxy

===================================================================
RCS file: RCS/ftpd.c,v
retrieving revision 1.1
diff -c -r1.1 ftpd.c
*** 1.1 1999/03/09 15:47:43
--- ftpd.c      1999/03/10 11:24:57
***************
*** 150,155 ****
--- 150,167 ----
  #define lstat stat
  #endif
  
+ #ifdef AFS_AUTH
+ #include <afs/stds.h>
+ #include <afs/kautils.h>
+ #endif
+ 
+ #ifdef DCE_AUTH
+ #include <dce/rpc.h>
+ #include <dce/sec_login.h>
+ #include <dce/dce_error.h>
+ #endif
+ 
+ 
  #ifdef HAVE_DIRENT
  #include <dirent.h>
  #else
***************
*** 2279,2284 ****
--- 2291,2309 ----
  #ifdef ULTRIX_AUTH
      int numfails;
  #endif /* ULTRIX_AUTH */
+ 
+ #ifdef AFS_AUTH
+     char *reason;
+ #endif /* AFS_AUTH */
+ 
+ #ifdef DCE_AUTH
+     sec_passwd_rec_t pwr;
+     sec_login_handle_t lhdl;
+     boolean32 rstpwd;
+     sec_login_auth_src_t asrc;
+     error_status_t status;
+ #endif /* DCE_AUTH */
+ 
      if (logged_in || askpasswd == 0) {
  #ifdef VERBOSE_ERROR_LOGING
          syslog (LOG_NOTICE, "FTP LOGIN REFUSED (PASS before USER) FROM %s",
***************
*** 2370,2375 ****
--- 2395,2412 ----
  #ifdef ULTRIX_AUTH
          if ((numfails = ultrix_check_pass(passwd, xpasswd)) >= 0) {
  #else
+         if (pw != NULL) {
+ #ifdef AFS_AUTH
+       if (!strcmp(pw->pw_passwd,"!")) {
+         if (ka_UserAuthenticateGeneral(KA_USERAUTH_VERSION | KA_USERAUTH_DOSETPAG,
+                                        pw -> pw_name,
+                                        "", 0, passwd, 0, 0, 0,
+                                        &reason) == 0) {
+           rval = 0;
+           } else
+             printf("230-AFS: %s",reason);
+         } else
+ #endif /* AFS_AUTH */
          /* The strcmp does not catch null passwords! */
        if (pw !=NULL && *pw->pw_passwd != '\0' &&
  #ifdef HAS_PW_EXPIRE
***************
*** 2378,2384 ****
            strcmp(xpasswd, pw->pw_passwd) == 0) {
  #endif
            rval = 0;
!            } 
          if(rval){
          reply(530, "Login incorrect.");
  
--- 2415,2463 ----
            strcmp(xpasswd, pw->pw_passwd) == 0) {
  #endif
            rval = 0;
!            }
! 
! #ifdef DCE_AUTH
! #ifndef ALWAYS_TRY_DCE
!           else
! #endif
!             {
!             sec_login_setup_identity ((unsigned_char_p_t) pw->pw_name,
!                                       sec_login_no_flags,&lhdl,&status);
!             if (status == error_status_ok) {
!               printf ("230-sec_login_setup_identity OK\n");
!               pwr.key.tagged_union.plain = (idl_char *) passwd;
!               pwr.key.key_type = sec_passwd_plain;
!               pwr.pepper = 0;
!               pwr.version_number = sec_passwd_c_version_none;
!               /* validate password with login context */
!               sec_login_valid_and_cert_ident (lhdl,&pwr,&rstpwd,&asrc,&status);
!               if (!rstpwd && (asrc == sec_login_auth_src_network) &&
!                   (status == error_status_ok)) {
!              printf ("230-sec_login_valid_and_cert_ident OK\n");
!                 sec_login_set_context (lhdl,&status);
!                 printf("230-sec_login_set_context finished\n");
!                 if (status != error_status_ok) {
!                   int pstatus;
!                     dce_error_string_t s;
!                   printf("230-Error status: %d:\n",status);
!           
!                   dce_error_inq_text(status,s,&pstatus);
!                   printf("230-%s\n",s);
!                   fflush(stderr);
!                   sec_login_purge_context(lhdl, &status);
!                 } else {
!                   /*sec_login_get_pwent(lhdl, &pw, &status);*/
!                   rval = 0;
!                 }
!               }
!             }
!           }
! 
! #endif
! 
!       }
! 
          if(rval){
          reply(530, "Login incorrect.");
  
===================================================================
RCS file: makefiles/RCS/Makefile.aix,v
retrieving revision 1.1
diff -c -r1.1 makefiles/Makefile.aix
*** 1.1 1999/03/10 12:44:00
--- makefiles/Makefile.aix      1999/03/10 12:44:46
***************
*** 6,21 ****
  CC_        = cc
  CC_YES     = xlc
  CC         = ${CC_${LF}}
! IFLAGS     = -I.. -I../support
! LFLAGS     = -L../support
! CFLAGS_    = -O2 -D_NO_PROTO ${IFLAGS} ${LFLAGS}
! CFLAGS_YES = -O2 -D_AIX42 ${IFLAGS} ${LFLAGS}
  CFLAGS     = ${CFLAGS_${LF}}
  XOBJS      = 
! LIBES      = -lsupport -ls
  LIBC       = /lib/libc.a
  LINTFLAGS  =
  LKERB      = -lauth -lckrb -lkrb -ldes
  XLIBS      = ${LIBES}
  MKDEP      = ../util/mkdep
  
--- 6,28 ----
  CC_        = cc
  CC_YES     = xlc
  CC         = ${CC_${LF}}
! IFLAGS     = -I.. -I../support -I/usr/afsws/include
! LFLAGS     = -L../support-L/usr/afsws/lib -L/usr/afsws/lib/afs
! CFLAGS_    = -g -DDEBUG -DAFS_AUTH -DUSE_ETC_FTPD -D_NO_PROTO ${IFLAGS} ${LFLAGS}
! CFLAGS_YES = -g -DDEBUG -DAFS_AUTH -DUSE_ETC_FTPD -D_AIX42 ${IFLAGS} ${LFLAGS}
  CFLAGS     = ${CFLAGS_${LF}}
  XOBJS      = 
! LIBES      = -lsupport -ls ${LAFS}
  LIBC       = /lib/libc.a
  LINTFLAGS  =
  LKERB      = -lauth -lckrb -lkrb -ldes
+ LAFS     = -lkauth -lubik \
+              -lprot \
+              -lrxkad -lrx -llwp \
+              -lauth   -lsys \
+              -lrxkad -ldes \
+              -lcmd -lcom_err -laudit \
+              /usr/afsws/lib/afs/util.a -lc
  XLIBS      = ${LIBES}
  MKDEP      = ../util/mkdep

---

From: Gregory A Lundberg <[email-masked]>
Date: Thu, 15 Jul 1999 08:47:46 -0400

On Thu, Jul 15, 1999 at 09:41:51AM +0200, Rainer Schoepf wrote:

> Appended are patches for wu-ftpd-2.4.2-vr16 to authenticate against AFS
> and/or DCE. Note that I never really tested DCE alone, without AFS, so
> there might be some problems. Just replace -DAFS_AUTH by -DDCE_AUTH and
> ${LAFS} by -ldce in the Makefile.

Thank you for your submission; I will clean them up and submit the patches
to the development group for review and possible inclusion in the base-line
daemon.

Instructions for submitting patches directly to the development group are
included in the FAQ.

-- 

Gregory A Lundberg              WU-FTPD Development Group
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195