Re: [solved] INN2 set up user authentication via ckpasswd

Hi,

Authentication works with the below configuration in readers.conf.
I suppose INN is choosing the first one that applies ?

Glad to hear that!
Both authentication and access blocks are checked from the *last* one in the readers.conf file to the first one (bottom up).  As soon as one matches, the corresponding identity or access is assigned to the user.

I needed to include the full path to ckpasswd as it is not in system path.

Strange.  There's normally no need in having the full path in system path as you seem to use the default one (/usr/lib/news/bin/auth/passwd) which is hard-coded in INN:
     tmp = concatpath(innconf->pathbin, INN_PATH_AUTHDIR);
     resdir = concatpath(tmp, INN_PATH_AUTHDIR_PASSWD);
     auth_external(&Client, command, resdir, username, password);
I suppose pathbin in inn.conf is "/usr/lib/news/bin".
Then the "auth" and "passwd" subdirectories are added to this path, and your ckpasswd program is started from there by default when no full path is given.

I also needed to make sure I was entering into mode reader before authenticating.

Ah, that was it!
Indeed, you need being in reader mode.  Sorry I did not spot that as I did not know the whole NNTP session.  The greeting banner would have been of help.
FWIW, authentication in transit mode is parametered in incoming.conf (see the password parameter) and applies to your peers.

I will follow your advice for a more secure password hashing scheme.
The default one does look rather weak.

Yes.
--
Julien ÉLIE
« Ma femme prétend que je n'écoute jamais ce qu'elle dit… enfin… un truc
   comme ça. » (Chevy Chase)