Newsgroups: comp.os.linux.announce
From: ecarp@netcom.com (Ed Carp)
Subject: secure TELNET/FTP package available
Message-ID: <ann-20756.769887586@cs.cornell.edu>
Date: Wed, 25 May 1994 17:39:59 GMT
Approved: linux-announce@tc.cornell.edu (Matt Welsh)

-----BEGIN PGP SIGNED MESSAGE-----

A secure TELNET/FTP package is available from net.tamu.edu in the directory
/pub/security/TAMU, file srabin-1.1-i386-linux.tar.gz.  Here's the README:
- --------------------------------------------------------------------------
SRA - Secure RPC Authentication for TELNET and FTP Version 1.3

This package provides drop in replacements for telnet and ftp client
and server programs, which use Secure RPC code to provide encrypted
authentication across the network, so that plaintext passwords are not
used.  The clients and servers negotiate the availability of SRA so
that they work with unmodified versions.  These programs require no
external keyserver or ticket server, and work equally well for local or
internet wide connections.

Full sources, as well a binaries for sparc Solaris 1.x and 2.x and linux
are available. The code is based on BSD net-2 code, and should be portable
to other platforms.  This package was presented at the Fourth USENIX
Security Conference; a postscript version of that paper is available
in net.tamu.edu:pub/security/TAMU/sra.ps.  

VERSIONS:
The package announced at USENIX was version 0.9.  Version 1.0 fixed
some bugs and added the Solaris 2.x compatibility. Version 1.1 fixed yet
more bugs, and added the linux port. Version 1.2 fixed a bug with
standard telnet into a solaris2 telnetd, with ftpd allowing
non-standard user shells, and added some installation hints.
Version 1.3 fixed SunOS's braindamaged getpass(), that was restricting
passwords to eight or less characters.
LATE NEWS: the sra sources have been split into two parts -- the main
freely distributable portion, and a small des library that is available
only to US sites. There main part contains a des stub library which
can be used to roll your own version, and there is also a cookbook
for using the des library from lth.se.

INSTALLING THE BINARY VERSION:

1. get the appropriate tar file:
        net.tamu.edu:pub/security/TAMU/srabin-1.1-sparc-solaris1.tar.gz
   or
        net.tamu.edu:pub/security/TAMU/srabin-1.1-sparc-solaris2.tar.gz
   or
        net.tamu.edu:pub/security/TAMU/srabin-1.1-i386-linux.tar.gz

2. extract the binaries in a scratch directory, for example
   /usr/local/sra:
        mkdir /usr/local/sra
        cd /usr/local/sra
        gzip -cd srabin-1.0-sparc-solaris1.tar.gz|tar xvf -

3. Install the binaries over the existing ones:

        cp telnet ftp /usr/bin
        chmod 755 /usr/bin/telnet /usr/bin/ftp
        cp telnetd /usr/etc/in.telnetd
        chmod 755 /usr/etc/in.telnetd
        cp ftpd /usr/etc/in.ftpd
        chmod 755 /usr/etc/in.ftpd
        cp login /etc/sralogin
        chown root /etc/sralogin
        chmod 4755 /etc/sralogin

   (NOTE1: for solaris 2.x, the daemons go in /usr/sbin rather than /usr/etc)
   (NOTE2: there may be bsd versions of telnet and ftp in /usr/ucb, so
           either delete them, or make sure /usr/bin is earlier in your path)
   (NOTE3: the sra login *must* be installed as /etc/sralogin. Do not
           overwrite your standard login.  For linux, there is no new login
           provided, as it is not needed.)
   (NOTE4: on Solaris 2.x, root access to incoming ftp may be
           prevented by the omission of its shell (/sbin/sh) from
           /etc/shells. Similarly, incoming root access to telnet is
           controlled by the /etc/default/login "CONSOLE" line.)
   (NOTE5: telnetd doesn't like the "standard" tcp wrapper inetd.conf
           invocation line which typically looks something like: 
           ".... /usr/local/bin/tcpd /usr/etc/in.telnetd in.telnetd"
           The simple fix is to omit the final "in.telnetd" on the line.

INSTALLING THE SOURCE VERSION:

1. get the source distribution:
        net.tamu.edu:pub/security/TAMU/srasrc-1.3.tar.gz
        net.tamu.edu:pub/security/TAMU/srasrc-des-1.3.tar.gz
   or see the READ_ME in the main source's SRA/lib/libdes
   for instructions for getting a des version for non-US sites.

2. extract the sources in any desired location:
        gzip -cd srasrc-1.3.tar.gz|tar xf -
        gzip -cd srasrc-des-1.3.tar.gz|tar xf -
   This will create an SRA subdirectory.

3. The top level Makefile has some lines defined for Solaris1,
   Solaris2, and linux. Make sure the appropriate set is uncommented.

3a. IMPORTANT NOTE: the telnet sources depend on using the /usr/ucblib
   version of libtermcap.a, NOT sun's /usr/ccs/lib version. This means
   that the bsd compatibility package needs to be installed, and that
   LD_LIBRARY_PATH needs to include /usr/ucblib. (For csh, do:
        setenv LD_LIBRARY_PATH /lib:/usr/lib:/usr/ucblib )

4. make >& make.log &
   This will create the four or five binaries in the bin directory.
   Then follow step 3 of the binary installation.


USING SRA TELNET and FTP:

The SRA telnet and ftp clients are invoked in exactly the same way
as the original bsd versions.  They attempt to negotiate the SRA
authentication protocol with the remote server.  If either side
noes not support SRA, the authentication reverts to the standard
user/password prompts.  If both sides support SRA, a statement to
that effect is printed, and local user/password prompts are
given to effect the authentication.  If the SRA authentication
fails, telnet reverts to the standard login protocol, while ftp
reverts to the command mode, (not logged in), from which traditional
USER commands can be issued.

For example: 

    (TELNET, successful SRA login)
        host# telnet host
        Trying 128.194.177.5...
        Connected to host.tamu.edu.
        Escape character is '^]'.
        Trying SRA secure login:
        User (user): 
        Password: 
        [ SRA accepts you ]
        Last login: Fri Oct 22 14:08:51 from host.tamu.ed
        Warning: no Kerberos tickets issued.
        Copyright (c) 1980,1983,1986,1988,1990,1991 The Regents of the 
        University of California.  All rights reserved.
        SunOS Release 4.1.3 (GENERIC) #3: Mon Jul 27 16:43:54 PDT 1992
        host# 

    (TELNET, unsuccessful SRA login)
        host# telnet host
        Trying 128.194.177.5...
        Connected to host.tamu.edu.
        Escape character is '^]'.
        Trying SRA secure login:
        User (user): 
        Password: 
        [ SRA refuses authentication ]
        Trying plaintext login:
        Password:
        Last login: Fri Oct 22 14:23:14 from host.tamu.ed
        SunOS Release 4.1.3 (GENERIC) #3: Mon Jul 27 16:43:54 PDT 1992
        host# 

    (FTP, successful SRA login)
        host# ftp host
        Connected to host.tamu.edu.
        220 host FTP server (Version 5.60) ready.
        Name (host:user): 
        334 AUTH SRA OK.
        331 Password required.
        Password:
        230 User logged in.
        Remote system type is UNIX.
        Using binary mode to transfer files.
        ftp> 

    (FTP, unsuccessful SRA login)
        host# ftp host
        Connected to host.tamu.edu.
        220 host FTP server (Version 5.60) ready.
        Name (host:user): 
        334 AUTH SRA OK.
        331 Password required.
        Password:
        530 Login incorrect.
        Login failed.
        ftp> 

Questions/comments to:
        dave.safford@net.tamu.edu
- -- 
Ed Carp, N7EKG/VE3			Ed.Carp@linux.org, ecarp@netcom.com
Finger ecarp@netcom.com for PGP 2.3a public key		an88744@anon.penet.fi
If you want magic, let go of your armor.  Magic is so much stronger than
steel!        -- Richard Bach, "The Bridge Across Forever"

-----BEGIN PGP SIGNATURE-----
Version: 2.5

iQCVAgUBLeOMHyS9AwzY9LDxAQFktgP9H6FF+hohc3eA5N9vvtCJYTvhjhJD4Mj/
fbYiUVk8zdIk5gr1J/ZYoSsmDpJfWxmucZglEx7A9AQcccM1hKN/6QSOZvwkpe2w
rmAAURFLEfzhtmm+ykQNhPKoOe6UAzWCjIJ7DOGBYa6dauSrzHbfNVF+lCLYvkzT
6/esZlahqDY=
=/K1B
-----END PGP SIGNATURE-----

--
Mail submissions for comp.os.linux.announce to: linux-announce@tc.cornell.edu
Be sure to include Keywords: and a short description of your software.
