ckpasswd accepts a username and password from nnrpd and tells (8) whether that's the correct password for that username. By default, when given no arguments, it checks the password against the password field returned by (3). Note that these days most systems no longer make real passwords available via (3) (some still do if and only if the program calling (3) is running as root).
Note that ckpasswd expects all passwords to be stored
encrypted by the system (3)
function and calls (3) on
the supplied password before comparing it to the expected password.
While INN doesn't come with a program
intended specifically to create such databases, on most systems
it's fairly easy to write a Perl script to do so. Something like:
This option will not be available on systems without dbm or ndbm
libraries.
Most systems require special privileges to call (3),
so in order to use this option you may need to make ckpasswd
setgid to some group (like group ``shadow'') or even setuid root.
ckpasswd has not been specifically audited for such uses! It
is, however, a very small program that you should be able to check
by hand for security.
This configuration is not recommended if it can be avoided,
since the NNTP protocol has no way of
protecting passwords from casual interception, and using system
passwords to authenticate NNTP connections
therefore opens you up to the risk of password sniffing. If you do
use system passwords to authenticate connections, you should
seriously consider only doing NNTP through
ssh tunnels or over SSL.OPTIONS
#!/usr/bin/perl
use NDBM_File;
use Fcntl;
tie (%db, 'NDBM_File', '/path/to/database', O_RDWR | O_CREAT, 0640)
or die "Cannot open /path/to/database: $!\n";
$| = 1;
print "Username: ";
my $user = <STDIN>;
chomp $user;
print "Password: ";
my $passwd = <STDIN>;
chomp $passwd;
my @alphabet = ('.', '/', 0..9, 'A'..'Z', 'a'..'z');
my $salt = join '', @alphabet[rand 64, rand 64];
$db{$user} = crypt ($passwd, $salt);
untie %db;
Note that this will echo back the password when typed; there are
obvious improvements that could be made to this, but it should be a
reasonable start.
username:pdIh9NCNslkq6
(and each line may have an additional colon after the encrypted
password and additional data; that data will be ignored by
ckpasswd). INN does not come with a
utility to create the encrypted passwords, but it's a quick job
with Perl (see the example script under -d).
EXAMPLES
See (5)
for examples of (8)
authentication configuration that uses ckpasswd to check
passwords.
HISTORY
Written by Russ Allbery
<rra@stanford.edu> for
InterNetNews.
$Id: ckpasswd.1,v 1.1.2.1 2000/11/06 08:41:11 rra Exp $