AXSPAWN(8)

💫 AXSPAWN(8) — the Linux System Managers Manual glow-up 💫

okay so bestie, welcome to AXSPAWN(8), straight out of the Linux System Managers Manual ✨ this is the page that lets people log into a Linux box automatically over packet radio, and honestly? it's giving niche-but-iconic. let's get into it 🎀

---

🌸 SYNOPSIS 🌸

axspawn [--pwprompt PR0MPT, -p PR0MPT] [--changeuser, -c] [--rootlogin,
-r] [--only-md5] [--wait, -w]

that's the whole vibe check up top, keep scrolling for the lore 💅

---

🦋 DESCRIPTION 🦋

okay so here's what axspawn actually does, step by step, no cap:

• it checks whether the peer is an AX.25 connect 🔥
• it checks that the callsign is a valid Amateur Radio callsign
• it strips the SSID
• it checks whether the UID/GID are valid
• it lets you log in without a password if the password entry in /etc/passwd is + or empty
• in every other case, login will prompt you for a password 🔐

and here's the main character energy part: axspawn can create user accounts automatically 🌈 you can specify the user shell, the first and maximum user id, and the group ID in the config file — and, unlike WAMPES, it creates a file /etc/ax25/ax25.profile which gets copied to ~/.profile 🫶

---

💅 SECURITY 💅

bestie. listen. auto accounting is a security problem by definition — that's not me being dramatic, that's just the facts 😭

Unlike WAMPES, which creates an empty password field, axspawn adds an "impossible" (+) password to /etc/passwd. Then login gets called with the -f option, so new users get the chance to log in without a password. (and, quoting the original vibe: "I guess this won't work with the shadow password system" 🙈)

of course axspawn does callsign checking, because standards are slay:

• only letters and numbers are allowed
• the callsign must be longer than 4 characters and shorter than 6 characters (without SSID)
• there must be at least one digit, and max. two digits within the call
• the SSID must be within the range of 0 and 15

please drop a note if you know a valid Amateur Radio callsign that does not fit this pattern _and_ can be represented correctly in AX.25 🙏

axspawn also has the well known authentication mechanisms of the AX.25 bbs baycom (sys) and md5 standards ⭐ it searches in /etc/ax25/bcpasswd (first) and ~user/.bcpasswd (second) for a match of the required authentication mechanism and password. md5 and baycom passwords may differ, and md5 passwords gain over baycom passwords 👑

Note: you could "lock" special "friends" out by specifying an empty password in /etc/ax25/bcpasswd (line n0call:md5:). -> md5 Passwords are enforced. But the length is shorter than the minimum (len 8 for md5, len 20 for baycom); user's password file is not searched because in /etc/ax25/bcpasswd its already found.. 💀

🎀 Syntax and caveeats for /etc/ax25/bcpasswd:

• Has to be a regular file (no symlink). Not world-readable/writable.
• Example lines:

# Thomas
dl9sau:md5:abcdefgh
# Test
te1st:sys:12345678901234567890
# root
root:md5:ziz7AoxuAt6jeuthTheexet0uDa9iefuAeph3eelAetahmi0
# misconfiguration:
thisbadlineisignored
# With this line
systempasswordonly
# .. axspan will not look in user's homedir for his .bcpasswd

🍓 Syntax and caveeats for user's .bcpasswd in his $HOME:

• Has to be a regular file (no symlink). Neither group- nor world- read-/writable. Has to be owned by the user or uid 0 (root).
• Example lines:

# could be shorter
md5:abcdefgh
# should be longer
sys:12345678901234567890

---

✨ OPTIONS ✨

• -p DB0FHN or --pwprompt DB0FHN — while baycom or md5 password authentication is happening (see above 👀), the password prompt is set to the first argument (DB0FHN in this example). this may be needed for some packet-radio terminal programs so they can detect the password prompt properly 🎯
• -c, --changeuser — allow connecting ax25 users to change their username for login. they'll be asked for their real login name 🫶
• -e, --embedded — special treatment for axspawn on non-standard conform embedded devices. i.e. openwrt has no true /bin/login: if you use it as a real login program, it raises a security hole 😭
• -r, --rootlogin — permit login as user root. Cave: only md5 or baycom style is allowed; no plaintext password 🚫
• --only-md5 — insist in md5 authentication during login. if no password for the user is found, or it is not md5, then no other login mechanism is granted. this option, in combination with -c and -r, may be a useful configuration for systems where no ax25 user accounts are available, but you as sysop would like to have a login access for your administrative tasks 👑
• -w, --wait — eats the first line the user sends 🍽️ this feature is useful if you have TCP VC connects to the same Call+SSID. it is now obsolete, because ax25d is the right place for this and implements this functionality better 💀

These are options and not part of the preferences because you _may_ like to have on every interface definition in ax25d.conf (where axspawn is started from) a different behaviour. iykyk 💅

---

🌈 FILES 🌈

• /etc/passwd
• /etc/ax25/ax25.profile
• /etc/ax25/axspawn.conf
• /etc/ax25/bcpasswd
• ~/.bcpasswd

---

🔥 SEE ALSO 🔥

axspawn.conf(5), ax25d(8) 🧚

---

👑 AUTHOR 👑

Joerg Reuter DL1BKE <jreuter@poboxes.com> 🫶

---

and that's the page, bestie!! 🎀 written under Linux, dated 13 April 2008, and filed as AXSPAWN(8) — go forth and log in responsibly 💖✨