ckpasswd - nnrpd password authenticator
SYNOPSIS
ckpasswd [-s] [-d database] [-f filename]
DESCRIPTION
ckpasswd is the basic password authenticator for nnrpd,
suitable for being run from an auth stanza in
readers.conf(5). See readers.conf(5) for more information
on how to configure an nnrpd authenticator.
ckpasswd accepts a username and password from nnrpd and
tells nnrpd(8) whether that's the correct password for
that username. By default, when given no arguments, it
checks the password against the password field returned by
getpwnam(3). Note that these days most systems no longer
make real passwords available via getpwnam(3) (some still
do if and only if the program calling getpwnam(3) is run
ning as root).
Note that ckpasswd expects all passwords to be stored
encrypted by the system crypt(3) function and calls
crypt(3) on the supplied password before comparing it to
the expected password.
OPTIONS
-d database
Read passwords from a database (ndbm or dbm format
depending on what your system has) rather than by
using getpwnam(3). ckpasswd expects database.dir and
database.pag to exist and to be a database keyed by
username with the encrypted passwords as the values.
While INN doesn't come with a program intended specif
ically to create such databases, on most systems it's
fairly easy to write a Perl script to do so. Some
thing like:
use NDBM_File;
use Fcntl;
tie (%db, 'NDBM_File', '/path/to/database', O_RDWR | O_CREAT, 0640)
or die "Cannot open /path/to/database: $!\n";
$| = 1;
print "Username: ";
my $user = <STDIN>;
chomp $user;
print "Password: ";
my $passwd = <STDIN>;
chomp $passwd;
my @alphabet = ('.', '/', 0..9, 'A'..'Z', 'a'..'z');
my $salt = join '', @alphabet[rand 64, rand 64];
$db{$user} = crypt ($passwd, $salt);
untie %db;
Note that this will echo back the password when typed;
there are obvious improvements that could be made to
this, but it should be a reasonable start.
This option will not be available on systems without
dbm or ndbm libraries.
-f filename
Read passwords from the given file rather than using
getpwnam(3). The file is expected to be formatted
like a system password file, at leat vaguely. That
means each line should look something like:
username:pdIh9NCNslkq6
(and each line may have an additional colon after the
encrypted password and additional data; that data will
be ignored by ckpasswd). INN does not come with a
utility to create the encrypted passwords, but it's a
quick job with Perl (see the example script under -d).
-s Check passwords against the result of getspnam(3)
instead of getpwnam(3). This function, on those sys
tems that supports it, reads from /etc/shadow or simi
lar more restricted files. If you want to check pass
words supplied to nnrpd(8) against system account
passwords, you will probably have to use this option
on most systems.
Most systems require special privileges to call
getspnam(3), so in order to use this option you may
need to make ckpasswd setgid to some group (like group
"shadow") or even setuid root. ckpasswd has not been
specifically audited for such uses! It is, however, a
very small program that you should be able to check by
hand for security.
avoided, since the NNTP protocol has no way of pro
tecting passwords from casual interception, and using
system passwords to authenticate NNTP connections
therefore opens you up to the risk of password sniff
ing. If you do use system passwords to authenticate
connections, you should seriously consider only doing
NNTP through ssh tunnels or over SSL.
EXAMPLES
See readers.conf(5) for examples of nnrpd(8) authentica
tion configuration that uses ckpasswd to check passwords.
HISTORY
Written by Russ Allbery <rra@stanford.edu> for InterNet
News.
$Id: ckpasswd.1,v 1.1.2.1 2000/11/06 08:41:11 rra Exp $
SEE ALSO
readers.conf(5), nnrpd(8)
Man(1) output converted with
man2html