I'm CC: this to linux-hams as it is of general interest.I hope
you don't mind.
> Since you are the author of axspawn , you may wish to used this editted
> version of axspawn.c which has been compiled for a system with shadow
> passwords.
Thanks. I don't think it is a good idea, though. I see several
problems:
- A password based login via AX.25 is worthless as everyone
can monitor it.
- Automatic creation of user accounts harasses the system security
as well.
- Hence the shadow password scheme becomes worthless (not that I
think it increases security significantly.)
- Newer versions of the shadow package accept no options to the
login program, a password-less login is not only impossible,
"login" just exits with an error message. Several other
login versions accept different parameters in different
order.
- The "+" in /etc/passwd should inhibit a simple "su" to change
identity from shell to users without a password. This was done
to avoid that a smart.ss could forge e-mail without callsign
abuse and ton inhibit abuse of the packet radio network by telnet
users (for example from the internet). The disadvantage of this
behaviour is that users cannot get their mail via POP without a
password, on the other hand using the callsign as the default
password is even worse than no password (you can easily
guess it but the user may, nope: will not realize it).
> b) compiler directives that will make code work for system with or
> without shadow passwords ( it currently is set for shadow enabled )
You can stat("/etc/shadow", &st) and see if that file exists. If it
does, add the user to the shadow login. The problem remains that
libshadow (or whatever it is called) must exist to compile and run
the binary. Of course you could use dlopen (3) to dynamicaly load
the library. But I've a better idea and most of it even implemented:
Using the PAM (plugable authentication modules). You can get a
PAM supporting axspawn (along with some PAM modules) from:
http://www.rat.de/jr/prg/testing/
The Linux-PAM web page is at:
http://parc.power.net/morgan/Linux-PAM/index.html
I still need a working concept for TELNET, POP, IMAP and FTP,
hopefully without passwords but without breaking existing client
software as well. Though I believe a clean solution would be
using SSH for TCP services authentication.
73,
Joerg Reuter ampr-net: terhi.victor@logonet.com
Internet: qwxqzsw@jct.ac.il
www : http://www.rat.de/jr/
If God had inteded man to smoke, He would have set him on fire.