Bug 355

Summary:

No last login message with PrivSep under AIX

Product:

Portable OpenSSH

Reporter:

Heinrich.Mislik

Component:

sshd

Assignee:

OpenSSH Bugzilla mailing list <openssh-bugs>

Status:

CLOSED FIXED

Severity:

normal

CC:

genty

Priority:

Version:

-current

Hardware:

PPC

OS:

AIX

Attachments:

Description	Flags
Move loginsuccess call into auth.c so it works with privsep on	none
Move loginsuccess to auth-passwd.c	none
Enables tracking of unsuccessful logins on AIX	none

Description Heinrich.Mislik 2002-07-16 20:30:35 AEST

When a user connects to 3.4p1 on AIX with privilege separation on, no
last login message is displayed. It seems, that the message is 
retrieved by a call to loginsuccess() as root, the output of the message
is done in the nonprivileged child.

Comment 1 Darren Tucker 2002-08-25 18:10:58 AEST

It looks like the call to loginsuccess() fails because it's done as a 
non-privileged user.  This is bad because in addition to generating the message 
it also clears the failed login counter that leads to account lockout.

The following patch fixes it for me but I'm not sure this is the right approach. 
I still don't properly understand privsep...  Would someone who does please 
sanity-check this?

Comment 2 Darren Tucker 2002-08-25 18:14:29 AEST

Created attachment 140 [details]
Move loginsuccess call into auth.c so it works with privsep on

Comment 3 Darren Tucker 2002-08-25 18:17:43 AEST

*** Bug 385 has been marked as a duplicate of this bug. ***

Comment 4 Darren Tucker 2002-08-25 18:59:41 AEST

Ignore previous patch, it's plain wrong. It clears the counter whether or not 
the login was successful.

Comment 5 Darren Tucker 2002-08-25 21:56:45 AEST

Created attachment 141 [details]
Move loginsuccess to auth-passwd.c

Relocated loginsuccess call as per comments in bugid 385.
Removed unused loginmsg variable.

Comment 6 Kevin Cawlfield 2002-08-31 01:03:30 AEST

Created attachment 142 [details]
Enables tracking of unsuccessful logins on AIX

I've included a patch that adds one line to the end of the previous 
auth-passwd.c patch, #141.  Before, AIX unsuccessful logins would go unnoticed.
 

In the enclosed patch, if the AIX authenticate in unsuccessful the loginfailed
subroutine is run, which logs the unsuccessful login to
/etc/security/failedlogin as well as updates the user's attributes in
/etc/security/lastlog

Comment 7 Darren Tucker 2002-08-31 14:22:27 AEST

While that's true of 3.4p1 the loginfailed() bug has been fixed in -current for 
a while (see bug #145)

Comment 8 Ben Lindstrom 2002-09-26 09:15:36 AEST

Darren's patch applied.  Thanks.

Comment 9 Damien Miller 2004-04-14 12:24:18 AEST

Mass change of RESOLVED bugs to CLOSED