🚀 go-pugleaf

Adam Carheden <carheden@holly.colostate.edu> wrote:
: I have a Linux box running an ftp server, and I need to give the users
: of my NT domain access.  The samba server does a great job of
: authenticating them this way, and I've set up a script to add a record
: to my unix password db if that user can be authenticated via my NT
: server.  This it creates an entry with ! as the password, so these users
: can't login to my unix box via telnet or ftp though.  I have two
: solutions, neither of which seem to work:

Uhhh... how are you doing this?  Are you just sharing the FTP directory
with Samba, and telling samba to use your NT domain controller as a
password server?  This would allow them access without FTP and telnet --
indeed, they wouldn't even need an entry in the passwd list, if I read
this all correctly.  But anyway...  We do something like this at work.

: 1) Have the scrip assign them their NT password when a new user is
: created.  I don't think passwords can be assigned with the useradd
: command, which is what the script uses though.  Plus, I don't know how
: to get at the password from samba to pass it to the scrip in the first
: place.

I think password /can/ be defined with useradd, but you don't give it the
password -- you give it the pre-crypted password string.  This is, obviously,
kind of a pain, since I don't think crypt hangs out in the open.  Here's
the C-code I use -- modify as needed - its pretty ugly.

*
 * Encrypt - Run a password through the UNIX Crypt system
 * and see what comes out.  Useful for filling out InterNIC
 * forms. :)
 *
 * Compile like this:
 * gcc -c encrypt.c
 * gcc -o encrypt encrypt.o -lcrypt
 */
 
#define _XOPEN_SOURCE
#include <unistd.h>
 
int main()
   {
   char passwd[256];
   char salt[3];
 
   printf ("NOTE: I'm not gonna hide your password, so it\n");
   printf ("is going to appear on the screen.  Suck it up.\n");
   printf ("Enter Your Password:");
   scanf ("%s", passwd); 
   printf ("\nSalt is the name for the two characters used to\n");
   printf ("perturb the encoder.  Its sometimes the first two\n");
   printf ("chars of a passwd string.\n");
   printf ("Enter Your Salt:");
   scanf ("%s", salt);
   printf ("\nCrypted String is: %s\n", crypt(passwd, salt));
   }     

: 2) Use a PAM module.  I've have pam_smb_auth, but it simply doesn't work
: (yes, I have a pam_smb.conf file).  Just for kicks, I used the following
: line in pam.d/ftp

Uhhh... I dunno how to use PAM... Sorry.

-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Michael J. Dwyer                      I doubt, therefore I might be.
mdwyer@holly.ColoState.edu       http://WWW.CS.ColoState.EDU/~dwyer/
Computer Science Major                      Amateur Radio Tech N0ZAP

Michael Dwyer wrote:
> Uhhh... how are you doing this?  Are you just sharing the FTP directory
> with Samba, and telling samba to use your NT domain controller as a
> password server?  This would allow them access without FTP and telnet --
> indeed, they wouldn't even need an entry in the passwd list, if I read
> this all correctly.  But anyway...  We do something like this at work.

Yes, and that does work, but some people want UNIX logins too.  Can you
blame them?

> I think password /can/ be defined with useradd, but you don't give it the

What version of useradd do you have?  I've read the man page backwards
and forwards, but no mention of setting a password.  passwd also seems
to be interactive only.  How non-unix.  And of course even if I do solve
this problem, how do I get samba to report the password?  I can use %u
to pass the username to my addsmbuser script, but I can't find any
documentation for the password.  I guess %p is a good guess, but...

-- 
Adam Carheden
carheden@holly.ColoState.EDU

Adam Carheden <carheden@holly.colostate.edu> wrote:
:> I think password /can/ be defined with useradd, but you don't give it the

: What version of useradd do you have?  I've read the man page backwards
: and forwards, but no mention of setting a password.  passwd also seems
: to be interactive only.  How non-unix.  And of course even if I do solve

Make sure you try both USERADD and ADDUSER.  They appear to be different.
This is on Slackware, by the way.  I'll take another look at it and 
see what I find.  I may be horribly mistaken, and may have dreamed the
whole thing...

I found out the interactive-only passwd, too.  What a pain.  Since I
didn't want to encode them all (I hadne't written that code yet), I
just started typing them all in by hand.  Wheee!

-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Michael J. Dwyer                      I doubt, therefore I might be.
mdwyer@holly.ColoState.edu       http://WWW.CS.ColoState.EDU/~dwyer/
Computer Science Major                      Amateur Radio Tech N0ZAP