Re: AUTHENTICATION IN UNIX

Pascal Bourguignon <pjb@xxxxxxxxxxxxxxxxx> wrote:
sethukr@xxxxxxxxx writes:

Hi all,

I have implemented a sample FTP Server.

But it allows any user.

I need to implement a "Authendication Module" in my FTP Server( in
C lang).

Help me by giving ur suggestions. How can i authenticate a valid
user?????????????

The first question to answer, is what authentication database you want
to use.

For example, you could keep a list of user/password specific to your
ftp server, or you could use /etc/passwd, or you could use NIS or PAM
or LDAP, etc).

The second question is how the authentication protocol works. The
standard FTP just sends the user name and the password in clear to the
server, but this allow anybody with access to the network to listen
and collect the password. In some protocols, for example POP-3,
instead of sending the password in clear, we can send a md5 hash of
the user name + password + a token send by the server.

In any case, the server just needs to be able to find a password given
a user name, and then to do the processing it needs to do to authenticate.

If you keep your user/password in a simple file (or a db file), you
can just compare a password sent in clear with the password found in
the database.

If you want to use /etc/passwd(/etc/shadow), you need to encrypt the
password send it clear with the same salt as in
/etc/passwd(/etc/shadow), and compare the encrypted versions.

Or.... you could read up on PAM, do authentication through PAM
functions, and leave all the details to the provided modules so that
you don't have to re-invent the wheel.

--

Steve Stringer
sillybanter@xxxxxxxxx

.

Relevant Pages

  • [UNIX] AFTPd Core Dump Vulnerability
    ... might be also affected (AFTPd is not the offical FreeBSD FTP server), ... accessed prior to the core dump, the password file will be found inside ... Issuing an authentication request followed ...
    (Securiteam)
  • User being LOCKED!
    ... I have a FTP Server that I access via Internet Explorer, and asking for authentication. ... But, everytime I access and the IE ask for user and password, I put the information right and can´t log in becouse my user is lockout!!! ...
    (microsoft.public.inetserver.iis.ftp)
  • Re: Why does FTP work this way?
    ... |authentication and I am placed in the /srv/ftp folder. ... When you access a ftp site with a web browser, ...
    (alt.os.linux.suse)
  • Re: .NET and FTP on IIS question
    ... The FTP server in Windows Server is using Windows accounts for ... authentication. ... not possible with Windows' FTP server. ... > - Allow them to download specific files once they are authenticated through> FTP ...
    (microsoft.public.inetserver.iis)
  • Authentication in Unix
    ... I have implemented a sample FTP Server. ... I need to implement a "Authendication Module" in my FTP Server(in ... C lang). ...
    (comp.unix.programmer)