Mailing List Archive

Patch to allow use of password file as auth DB (from USENET)
Patch originally from Kevin Ruddy, smiles@powerdog.com. Note that it
uses YP routines directly, rather than using getpwnam (which invokes
YP on machines that use it, and *works* on machines that don't).
Still, the idea may be worth considering...




OK, actually, this is specifically for 1.4 but I had originally put it into
1.3, so you can do that too if you want. It probably would fit fine into
Apache as well, but I haven't tried that yet.

What his patch does is permit people to say "AuthUserFile +" and then
it will allow the use of NIS to find username-password information
instead of special password files for httpd.

Regarding copyright: you can do anything you want with this patch. A
mention of my name would satisfy my ego but I won't require it. Guess
that makes it public domain.

Enjoy!!


*** http_config.c.orig Thu Apr 27 17:15:40 1995
--- http_config.c Fri May 5 17:38:01 1995
***************
*** 22,27 ****
--- 22,31 ----
#include "httpd.h"
#include "new.h"

+ #ifdef NIS
+ #include <rpcsvc/ypclnt.h>
+ #endif
+
/* Server config globals */
int standalone;
int port;
***************
*** 970,975 ****
--- 974,1001 ----
num_sec_config = num_sec;
}

+ #ifdef NIS
+ static int
+ init_nis(char **dom)
+ {
+ static int init = 0;
+ static char *domain;
+ int yperr;
+
+ if (init == 0) {
+ yperr = yp_get_default_domain(&domain);
+ if (yperr == 0)
+ init++;
+ }
+
+ if (init) {
+ *dom = domain;
+ return 0;
+ }
+ return 1;
+ }
+ #endif /* NIS */
+
int get_pw(char *user, char *pw, FILE *errors) {
FILE *f;
char errstr[MAX_STRING_LEN];
***************
*** 976,981 ****
--- 1002,1030 ----
char l[MAX_STRING_LEN];
char w[MAX_STRING_LEN];

+ #ifdef NIS
+ if (strncmp(auth_pwfile, "+", 1) == 0) {
+ char *domain,
+ *resptr;
+ int yperr,
+ resize;
+
+ if (init_nis(&domain) != 0)
+ return 0;
+
+ yperr = yp_match(domain, "passwd.byname", user, strlen(user),
+ &resptr, &resize);
+ if (yperr == 0) {
+ getword(w, resptr, ':');
+ if (strcmp(w, user) == 0) {
+ getword(w, resptr, ':');
+ (void) strcpy(pw, w);
+ return 1;
+ }
+ }
+ return 0;
+ }
+ #endif /* NIS */
if(!(f=fopen(auth_pwfile,"r"))) {
sprintf(errstr,"Could not open user file %s",auth_pwfile);
die(SERVER_ERROR,errstr,errors);
--
Kevin Ruddy
Powerdog Industries
Re: Patch to allow use of password file as auth DB (from USENET) [ In reply to ]
> What his patch does is permit people to say "AuthUserFile +" and then
> it will allow the use of NIS to find username-password information
> instead of special password files for httpd.

Ummmm, just to pick a little nit, this is a really bad idea from
the point of security. The Basic AA is bad enough, but to encourage
users to pass their real system passwords through HTTP en claire is
quite irresponsible.

.....Roy
Re: Patch to allow use of password file as auth DB (from USENET) [ In reply to ]
Date: Mon, 08 May 1995 01:23:06 -0700
From: "Roy T. Fielding" <fielding@avron.ics.uci.edu>

Ummmm, just to pick a little nit, this is a really bad idea from
the point of security. The Basic AA is bad enough, but to encourage
users to pass their real system passwords through HTTP en claire is
quite irresponsible.

Hmmm... just as a reality check, support for encrypted rlogin, telnet
and ftp is hardly universal yet, so many sites are still sending
passwords 'en claire' through those rather more prominent protocols.
On the other hand, I suppose I can see the point to keeping out a
feature which makes the problem worse...

rst
Re: Patch to allow use of password file as auth DB (from USENET) [ In reply to ]
On Mon, 8 May 1995, Roy T. Fielding wrote:
> > What his patch does is permit people to say "AuthUserFile +" and then
> > it will allow the use of NIS to find username-password information
> > instead of special password files for httpd.
>
> Ummmm, just to pick a little nit, this is a really bad idea from
> the point of security. The Basic AA is bad enough, but to encourage
> users to pass their real system passwords through HTTP en claire is
> quite irresponsible.

I would agree. Include the patch in /contrib, maybe, but let's not
encourage that, at least until we've done the dirty work and put in
message-digest authentication.

Brian

--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--
brian@organic.com brian@hyperreal.com http://www.[hyperreal,organic].com/
Re: Patch to allow use of password file as auth DB (from USENET) [ In reply to ]
On Mon, 8 May 1995, Robert S. Thau wrote:
> Hmmm... just as a reality check, support for encrypted rlogin, telnet
> and ftp is hardly universal yet, so many sites are still sending
> passwords 'en claire' through those rather more prominent protocols.
> On the other hand, I suppose I can see the point to keeping out a
> feature which makes the problem worse...

Remember that unline telnet, ftp, or rlogin, which send it only once
per session, this password is sent with *every* HTTP request.

Brian

--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--
brian@organic.com brian@hyperreal.com http://www.[hyperreal,organic].com/
Re: Patch to allow use of password file as auth DB (from USENET) [ In reply to ]
Date: Mon, 8 May 1995 13:05:34 -0700 (PDT)
From: Brian Behlendorf <brian@organic.com>

Remember that unline telnet, ftp, or rlogin, which send it only once
per session, this password is sent with *every* HTTP request.

Coming from MIT, where the packet sniffer has joined the cockroach in
the environmental niche of "endemic vermin", I'm afraid I don't see
this as terribly significant; they only *need* you to send it once.

rst
Re: Patch to allow use of password file as auth DB (from USENET) [ In reply to ]
>What his patch does is permit people to say "AuthUserFile +" and then
>it will allow the use of NIS to find username-password information
>instead of special password files for httpd.

I'm against this patch, for two reasons.
Firstly, as Roy has said, it would encourage sloppy security.
Secondly, this patch is very unportable. It is NIS specific, but is tied
to using the passwd.byname table. Letting NIS (or especially NIS+) near apache
can have severe performance effects.

David.