Re: axspawn and security on the air

[Thomas Osterried <thomas@osterried.de>]

> callsign and wreak havoc. If I require a password for user login, the 
> password is transmitted plaintext, right? Same situation as before.

with our digi / mailbox db0tud, we do it this way:

users have empty passwords.

if we need to authenticate for administration (root access), we use
the package "root"
(see http://x-berg.in-berlin.de/cgi-bin/viewcvs.cgi/ampr/root/ for details).

"md5root" uses a md5-based hashing algorithm like it is used by the bbs'es
(dpbox, etc..). root is suid bit. if the challenge response is ok,
a uid-0 shell is spawned. no plaintext password is transmitted.

but be aware that ax25 sessions as well as tcp sessions could be overtaken
by another user. on the other hand, it's ham community, not inet..

73,
	- thomas