Comment 14 for bug 26452

Netatalk "ships" with the default configuration, which not only allows
clear-text auth, but it is the ONLY auth mechanism available to MacOS clients
connecting. This is grossly insecure; the password is transmitted in
clear-text. Please mark this an urgent security bug.

This can most likely be fixed by recompiling netatalk with openssl/openssl-dev
installed and confirming the presence of:
uams_randnum.so
uams_dhx.so

in /usr/lib/netatalk/

(According to the netatalk build instructions, the encrypted auths are not built
if openssl is not installed.)

As a result, openssl obviously needs to be marked as a dependency for netatalk.

Additionally, I recommend the configuration for afpd.conf contain the default
line, but with the cleartext UAM --REMOVED-- and the random-number library
added. There are -extremely few- legitimate reasons admins would need
clear-text auth, and they should be required to enable it if they truly do need it.