Towards 2.3...

[Russ Allbery]

Bill Davidsen <davidsen at tmr.com> writes:
> On 29 Mar 2000, Russ Allbery wrote:

>> As I've not used readers.conf, I'm not really that qualified to write
>> more documentation, but I suppose I can give it a shot if no one else
>> has a chance.  Can you give some more specifics on what parts need to
>> be improved?

> I'd most like to see how to allow all connections access to one set of
> groups without asking for auth, and another if auth is offered. I seem
> to only be able to get either all users asked for auth or auth ignored
> as a no-op.

In writing up the documentation for this, the trick appeared to me to be
making sure that you have the access groups giving higher privileges to
authenticated users listed *after* the more general groups so that when
authorization is retried, it will find a later access group and override
the basic privileges.

Also note that you can't switch between auth groups; the auth group a
connection ends up in is fully determined by the host it's connecting
from.  So any applicable auth groups have to contain all the auth:
parameters needed.

-- 
Russ Allbery (rra at stanford.edu)             <http://www.eyrie.org/~eagle/>