1703 |
|
|
1704 |
If the password is in plain text format, it must be prefixed by |
If the password is in plain text format, it must be prefixed by |
1705 |
@samp{$0$} and if it is in MD5 format, it needs to be prefixed by the |
@samp{$0$} and if it is in MD5 format, it needs to be prefixed by the |
1706 |
string @samp{$1$}. Passwords encrypted by @code{crypt()} should have no |
string @samp{$1$}.@footnote{Some systems support even more encryption |
1707 |
prefix. |
methods. In FreeBSD, for instance, a prefix of @samp{$2$} implies |
1708 |
|
Blowfish encoding. @sc{gnats} will happily accept any encryption that |
1709 |
|
the OS supports.} Passwords encrypted by @code{crypt()} should have no |
1710 |
|
prefix. If no password is given then users can login with an empty |
1711 |
|
password string. |
1712 |
|
|
1713 |
A @code{gnats-passwd} tool to manage @file{gnatsd.user_access} files is |
A @code{gnats-passwd} tool to manage @file{gnatsd.user_access} files is |
1714 |
planned. In the meantime, @code{crypt()} passwords can be generated by |
planned. In the meantime, @code{crypt()} passwords can be generated by |
1743 |
@example |
@example |
1744 |
rickm:$0$ruckm:edit |
rickm:$0$ruckm:edit |
1745 |
pablo:$0$pueblo:view |
pablo:$0$pueblo:view |
1746 |
*:*:none |
*::none |
1747 |
@end example |
@end example |
1748 |
|
|
1749 |
@noindent And this is the same file with MD5-encrypted passwords: |
@noindent And this is the same file with MD5-encrypted passwords: |
1750 |
@example |
@example |
1751 |
rickm:$1$92388613$D7ZIYikzTUqd./dODTFrI.:edit |
rickm:$1$92388613$D7ZIYikzTUqd./dODTFrI.:edit |
1752 |
pablo:$1$92388652$QRfAhIBG5elT.FQjQKhj80:view |
pablo:$1$92388652$QRfAhIBG5elT.FQjQKhj80:view |
1753 |
*:*:none |
*::none |
1754 |
@end example |
@end example |
1755 |
|
|
1756 |
@noindent In these examples, anybody other than rickm and pablo get denied access, |
@noindent In these examples, anybody other than rickm and pablo get |
1757 |
assuming that the host access level is also @code{none}. You could set |
denied access, assuming that the host access level is also @code{none}. |
1758 |
the catch-all rule at the end to be @code{*:*:view} to allow view access |
You could set the catch-all rule at the end to be @code{*::view} to |
1759 |
to anyone. |
allow view access to anyone who does not supply a password. Note the |
1760 |
|
important detail that such a rule would allow view access only to |
1761 |
|
persons who do not supply a password at all, i.e. if rickm or pablo tries |
1762 |
|
to log in but mistypes his password, this rule would not apply and |
1763 |
|
they would be denied access entirely. This is by design, since people |
1764 |
|
might be surprised if they suddenly found themselves logged in, but with |
1765 |
|
a lower access level than they usually have. |
1766 |
|
|
1767 |
The overall user access file |
The overall user access file |
1768 |
@w{@file{@var{SYSCONFDIR}/gnats/gnatsd.user_access}}, usually |
@w{@file{@var{SYSCONFDIR}/gnats/gnatsd.user_access}}, usually |