Re: flexfax: Passwd problem

[Matthias.Apitz@SOFTCON.de]

Nico Garcia wrote:
    
    -----BEGIN PGP SIGNED MESSAGE-----
    
    On Tue, 16 Dec 1997, Phil Watkinson wrote:
    
    > Worth checking is the file permissions and owners for the hosts file. The
    > man page says it should have 600 permissions and the owner and group should
    > be 'fax' ( or 'uucp' where they have the same id ). Anything else and the
    > software will not use it.
    
    Sam? Matthias? Is there a strong security reason for the hosts file
    for HylaFAX to be 600? Enough people have had difficulty
    with this that I wonder if the permissions should be, say, 644?

Nico, this doesn't match the problem. The original poster has the problem
that the hfaxd(1M) asks for a password if he/she uses faxstat(1) or
sendfax(1) and does not ask for a password if he/she uses telnet directly
to the hfaxd(1M)'s port "hylafax". This problem has nothing to do
with the permission bits of the file host(4F). Just follow the
this example:

$ faxstat -s
HylaFAX scheduler on thias: Running
Modem ttyFN01 (+49.89.xxxxxxxx): Running and idle
$ su
Password:
# chmod 0666 hosts
# $
$ faxstat -s
Login failed: 530 User guru access denied.
$ telnet localhost 4558
Trying 127.0.0.1 ...
Connected to localhost.
220 thias server (HylaFAX (tm) Version 4.0pl2beta) ready.
user guru
530 User guru access denied.
quit
221 Goodbye.
Connection closed by foreign host.
$

As you can see changing the mode will cause another message but
not the password question. You may also check the code for it.

Setting group or world read permission to the file will
also make the encrypted passwords of the people and esp.
of the adminstrator view- and crack-able.

	matthias