A Eudora and NUPOP change password server (PAM version).

Copyright by Wade Turland <w.turland@uws.edu.au>, Information Technology
Directorate, University of Western Sydney

THE UNIVERSITY OF WESTERN SYDNEY DISCLAIMS ALL WARRANTIES, EXPRESS OR
IMPLIED, WITH REGARD TO THIS SOFTWARE, INCLUDING WITHOUT LIMITATION ALL
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE,
AND IN NO EVENT SHALL THE UNIVERSITY OF WESTERN SYDNEY BE LIABLE FOR ANY
SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER
RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF
CONTRACT, TORT (INCLUDING NEGLIGENCE) OR STRICT LIABILITY, ARISING OUT OF OR
IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

Portions copyright by University of Washington.

Adapted from the original poppassd work by: John Norstad
<j-norstad@nwu.edu>, Academic Computing and Network Services, Northwestern
University.

Based on earlier versions by Roy Smith <roy@nyu.edu> and Daniel L. Leavitt
<dll.mitre.org>.

Note that unencrypted passwords are transmitted over the network.  If this
bothers you, think hard about whether you want to implement the password
changing feature.  On the other hand, it's no worse than what happens when
you run /bin/passwd while connected via telnet or rlogin.  Well, maybe it
is, since the use of a dedicated port makes it slightly easier for a network
snooper to snarf passwords off the wire.

NOTE: In addition to the security issue outlined in the above paragraph, you
should be aware that this program is going to be run as root by ordinary
users and it mucks around with the password file.  This should set alarms
off in your head.  I think I've devised a pretty foolproof way to ensure
that security is maintained, but I'm no security expert and you would be a
fool to install this without first reading the code and ensuring yourself
that what I consider safe is good enough for you.  If something goes wrong,
it's your fault, not mine.

The front-end code (which talks to the client) is directly descended from
Leavitt's original version.
       
Should be owned by root, and executable only by root.

Installation:
=============
Add an entry in /etc/inetd.conf such as the following:

    poppassd stream tcp nowait root /usr/local/bin/poppassd poppassd

and in /etc/services:

    poppassd    106/tcp

Create entries in /etc/pam.conf like this (Solaris 2.x):

    poppassd password required /usr/lib/security/$ISA/pam_unix.so.1
    poppassd password optional /opt/pam_ldap-122/lib/security/pam_ldap.so

Add an entry in /etc/syslog.conf like the following:

    local2.err    /var/adm/poppassd-log


Modification history
====================

10/10/01. Version 1.0. w.turland@uws.edu.au
Converted old pty poppassd to pam version


Steve Dorner's description of the simple protocol:
==================================================

The server's responses should be like an FTP server's responses; 
1xx for in progress, 2xx for success, 3xx for more information
needed, 4xx for temporary failure, and 5xx for permanent failure.  
Putting it all together, here's a sample conversation:

  S: 200 hello\r\n
  E: user yourloginname\r\n
  S: 300 please send your password now\r\n
  E: pass yourcurrentpassword\r\n
  S: 200 My, that was tasty\r\n
  E: newpass yournewpassword\r\n
  S: 200 Happy to oblige\r\n
  E: quit\r\n
  S: 200 Bye-bye\r\n
  S: <closes connection>
  E: <closes connection>

