To use MySQL as CNID backend, afp.conf is written as follows.
[Global]
cnid mysql host = localhost
cnid mysql user = <mysql_user>
cnid mysql pw = <mysql_password>
cnid mysql db = <mysql_database_name></mysql_database_name></mysql_password></mysql_user>
[afp volume]
path = /exports/netatalk
cnid scheme = mysql
afp.conf contains a clear text password for MySQL.
I'd like to prevent the password from non-root users, so I executed "chmod 600 afp.conf".
However, it does not work well.
afpd will run as user's ID when an user connects from OS X, so afpd cannot read afp.conf.
Of course, when afp.conf is 644, it works well.
I think it is a security hole on afp.conf, when MySQL is CNID backend.
A sample patch is attached.
Sorry, sample of afp.conf was corrupted. Therefore, re-send it.
[Global]
cnid mysql host = localhost
cnid mysql user = {MySQL_user}
cnid mysql pw = {MySQL_password}
cnid mysql db = {MySQL_database_name}
[afp volume]
path = /exports/netatalk
cnid scheme = mysql
This seems to be missing a become_root() around
on line 1399 in the same file.
By following Ralph's advice, the complete patch would look like this:
I don't have a mysql setup to test against right now however.
Last edit: Daniel Markstedt 2023-04-11
Diff:
Actually, so for testing I figured that I can just validate that afpd is able to read a read-protected afp.conf with this patch. And yes: before the patch, a non-privileged user is refused connections, while with the patch they are able to connect.
Raised a PR https://github.com/Netatalk/netatalk/pull/300
Merged.