Bug 1081

Summary:

AIX port does not support group allow/ deny via nss_ldap

Product:

Portable OpenSSH

Reporter:

paul moore <paul.moore>

Component:

sshd

Assignee:

Assigned to nobody <unassigned-bugs>

Status:

CLOSED FIXED

Severity:

normal

CC:

dtucker, mindrot

Priority:

Version:

-current

Hardware:

PPC

OS:

AIX

Bug Depends on:

Bug Blocks:

1353

Attachments:

Description	Flags
Implement getgrouplist() on AIX via getgrset().	none
Implement getgroupslist via getgrset (diff against 4.7p1).	none

Description paul moore 2005-09-08 07:42:08 AEST

if the platform does not support getgrouplist directly then sshd uses getgrent 
to enumerate group membership (for group allow / deny). The AIX version of this 
API only supports /etc/group and NIS and so the group features do not work with 
other naming providers (nss_ldap say).

The AIX port should use getuserattr(user, S_GROUPS, ..), this uses NSS.

We can provide a candidate fix for this if needed.

Comment 1 Darren Tucker 2005-09-08 10:22:44 AEST

(In reply to comment #0)
> The AIX port should use getuserattr(user, S_GROUPS, ..), this uses NSS.
> 
> We can provide a candidate fix for this if needed.

Sure, go ahead.  I've not looked into AIX's NIS support (I don't use it) but it
sounds like the right fix would be to implement a getgrouplist() in port-aix.c

Comment 2 Darren Tucker 2006-06-03 13:15:53 AEST

Created attachment 1144 [details]
Implement getgrouplist() on AIX via getgrset().

Attached is an implementation of getgrouplist() while looking at another problem but it may also help here.

Comment 3 Darren Tucker 2008-01-01 02:49:57 AEDT

Created attachment 1430 [details]
Implement getgroupslist via getgrset (diff against 4.7p1).

It appears that my previous patch did not get the #ifdefs right.  Updated patch attached.

Comment 4 Darren Tucker 2008-01-01 02:53:08 AEDT

If this works correctly then I would like to target 4.8.

I encourage anyone who is interested in this change, especially if you yous LDAP or NSS on your AIX boxes, to please try the patch and report success or failure.  (Preferably in this bug, but feel free to email me privately if you're allergic to bugzilla.)  Thanks.

Comment 5 Philippe April 2008-01-25 02:06:18 AEDT

Success!

We tested this patch on AIX 5.3 using "match" configuration entries too, everything is working fine, AllowGroups, DenyGroups and others now work with LDAP.

Comment 6 Darren Tucker 2008-02-28 23:16:45 AEDT

This patch has been applied and will be in the 4.8 release.  Thanks.

Comment 7 Damien Miller 2008-03-31 15:20:25 AEDT

Fix shipped in 4.9/4.9p1 release.