AFP548 Changing the world one server at a time.

Force AFP over SSH on Server 10.2?

Home › Forums › OS X Server and Client Discussion › File Serving › Force AFP over SSH on Server 10.2?

Viewing 2 posts - 1 through 2 (of 2 total)
  • Author
    Posts
  • June 17, 2004 at 5:54 pm #358279
    C. J. Moof
    Participant

    Hi folks,

    I’m searching for the best way to secure AFP connections over the internet. I’m looking for a way to have what equates to a “only accept Secure Connections over SSH when an AFP connection is NOT from the 192.168.1.0 network” I also don’t want to open unnecessary shell accounts on my Xserve, since these users just need file access, not shell. So it seems to come down to 2 needs:

    1)Learning where to set up the rules to require outside the LAN AFP to run over SSH.

    2) Having a shell that isn’t good for anything but an SSH connection. I’ve already learned that /dev/null, None and /sbin/nologin won’t work…..

    Does anyone here have a good idea where to start with this?

    Thanks,

    C. J.

    June 17, 2004 at 7:50 pm #358283
    C. J. Moof
    Participant

    Since I posted this, I did learn that perhaps my goal isn’t as necessary as I thought- it seems that AFP doesn’t send the user/pass pair in any easily readable form thanks to it’s challenge-response authentication. That means when one of my users takes their laptop to a public wireless point, they’re not as succeptable to sniffing as I thought. The contents of directory listings are somewhat intelligeable, but that doesn’t concern me as much as someone grabbing login credentials.

    How secure is the AFP authentication scheme when it’s not wrapped up in SSH?

    I’ll try a shell of sshd tomorrow when I get back in the office.

  • Author
    Posts
Viewing 2 posts - 1 through 2 (of 2 total)
  • You must be logged in to reply to this topic.