Re: [cobalt-users] Qube 2 Encrypted password

[Geoff Baysinger <lists@xxxxxxxxxxxxxx>]

All Cobalt products use encrypted passwords for -storing- users' passwords 
in either /etc/passwd (in the oldest RaQ1 and Qube1 products) or 
/etc/shadow (in the Qube2, RaQ2, RaQ3 and RaQ4 products).

However, various protocols may transfer the password in clear text over the 
network. For instance, POP3 protocol sends passwords in clear text (meaning 
if you have access to one of the network points between the user and the 
Qube you could sniff the network for the password) whereas the APOP 
protocol uses a challenge-response to protect the password. The RaQ3 GUI 
itself will send the password in clear text, too, unless you turn on SSL on 
the main Virtual Site (in other words, on a RaQ3 or RaQ4 it makes a lot of 
sense to go install a self-signed certificate on the main VSite).

Additionally, if you use the Appletalk service, it will store a copy of the 
users' passwords unencrypted. The file it uses to store these passwords is 
only readable by the "root" account of the box, so users still won't have 
the ability to see each others' passwords.

At 10:29 AM 7/27/00, Bobby Nguyen wrote:
>     What kind of protocols can be used with the Qube 2?  Also is it a
> default setting that the user's password is encrypted or is it and optional
> feature?  If it's optional, how do you turn it on?
> Thanks in advance
>
> Bobby Nguyen
> Acorn Networks Inc.
> www.acorn-networks.com
>
>
> _______________________________________________
> cobalt-users mailing list
> cobalt-users@xxxxxxxxxxxxxxx
> To Subscribe or Unsubscribe, please go to:
> http://list.cobalt.com/mailman/listinfo/cobalt-users


/ Geoff Baysinger - Lists@xxxxxxxxxxxxxx
/
/ Any opinions or information expressed above is my responsibility
/ and not the result of my employer, demonic possession or any
/ other outside faculty.