
	spwauth

	This is a sample implementation of an RPC-based password
	authentication mechanism suitable for shadow passwords. It
	works without ever giving away the encrypted (or plaintext,
	for that matter) password to clients. For details on the
	algorithm, please refer to spwauth.doc.

	The reason I wrote this is a suggestion by Miquel van
	Smoorenburg brought up on the NYS mailing list in Mar 96
	involving identd lookups to determine a client's access rights
	to the shadow map. I think we can do better (No offense meant,
	Miquel:-)

	The reason why I didn't simply implement sun's pwauthd is that
	I don't have sufficient documentation on it, and what little
	documentation I have suggests that the encrypted password *does*
	seem to be passed over the network.

	WARNING: This is a hacker's release. I'm not going to answer
	any questions dealing with `why doesn't it compile' and `will
	it work with Foobar 5.7'.

	In order to make this code work, you have to have an /etc/shadow
	file installed on the NIS server where you keep your master copy
	of shadow.byname (passwd.byname when DEBUG is defined).

	In a full-featured version, the NIS server would have a NIS
	map called shadow.byname, generated from /etc/shadow, which
	is made accessible only to queries originating from 127.0.0.1.
	Since I don't have the time to hack ypserv just to make this demo
	work, spwauthd will do just a simple lookup in /etc/shadow.

	To use it, install rpc.spwauthd on the server machine, and
	invoke spwauthtest on any NIS client. It will prompt you
	for your password and send a request to the spwauth daemon,
	and check your password against the information returned
	by the server. Both server and client will print the encrypted
	passwords and SHA seeds used, so either direct spwauth's output
	to a log fie or /dev/null.

	NB: I have not tested this package for portability. The most
	critical question is whether the XDR encoding of SHA checksums
	is immune against differences in byte order on client and server
	machine. It should be, but I wouldn't vouch for it.


	Please let me know what you think of this.

	Cheers
	Olaf, <okir@monad.swb.de>
	Mar 14 1996
