Bug 355 - No last login message with PrivSep under AIX
Summary: No last login message with PrivSep under AIX
Status: CLOSED FIXED
Alias: None
Product: Portable OpenSSH
Classification: Unclassified
Component: sshd (show other bugs)
Version: -current
Hardware: PPC AIX
: P2 normal
Assignee: OpenSSH Bugzilla mailing list
URL:
Keywords:
: 385 (view as bug list)
Depends on:
Blocks:
 
Reported: 2002-07-16 20:30 AEST by Heinrich.Mislik
Modified: 2004-04-14 12:24 AEST (History)
1 user (show)

See Also:


Attachments
Move loginsuccess call into auth.c so it works with privsep on (1.52 KB, patch)
2002-08-25 18:14 AEST, Darren Tucker
no flags Details | Diff
Move loginsuccess to auth-passwd.c (1.86 KB, patch)
2002-08-25 21:56 AEST, Darren Tucker
no flags Details | Diff
Enables tracking of unsuccessful logins on AIX (708 bytes, text/plain)
2002-08-31 01:03 AEST, Kevin Cawlfield
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Heinrich.Mislik 2002-07-16 20:30:35 AEST
When a user connects to 3.4p1 on AIX with privilege separation on, no
last login message is displayed. It seems, that the message is 
retrieved by a call to loginsuccess() as root, the output of the message
is done in the nonprivileged child.
Comment 1 Darren Tucker 2002-08-25 18:10:58 AEST
It looks like the call to loginsuccess() fails because it's done as a 
non-privileged user.  This is bad because in addition to generating the message 
it also clears the failed login counter that leads to account lockout.

The following patch fixes it for me but I'm not sure this is the right approach. 
I still don't properly understand privsep...  Would someone who does please 
sanity-check this?
Comment 2 Darren Tucker 2002-08-25 18:14:29 AEST
Created attachment 140 [details]
Move loginsuccess call into auth.c so it works with privsep on
Comment 3 Darren Tucker 2002-08-25 18:17:43 AEST
*** Bug 385 has been marked as a duplicate of this bug. ***
Comment 4 Darren Tucker 2002-08-25 18:59:41 AEST
Ignore previous patch, it's plain wrong. It clears the counter whether or not 
the login was successful.
Comment 5 Darren Tucker 2002-08-25 21:56:45 AEST
Created attachment 141 [details]
Move loginsuccess to auth-passwd.c

Relocated loginsuccess call as per comments in bugid 385.
Removed unused loginmsg variable.
Comment 6 Kevin Cawlfield 2002-08-31 01:03:30 AEST
Created attachment 142 [details]
Enables tracking of unsuccessful logins on AIX

I've included a patch that adds one line to the end of the previous 
auth-passwd.c patch, #141.  Before, AIX unsuccessful logins would go unnoticed.
 

In the enclosed patch, if the AIX authenticate in unsuccessful the loginfailed
subroutine is run, which logs the unsuccessful login to
/etc/security/failedlogin as well as updates the user's attributes in
/etc/security/lastlog
Comment 7 Darren Tucker 2002-08-31 14:22:27 AEST
While that's true of 3.4p1 the loginfailed() bug has been fixed in -current for 
a while (see bug #145)
Comment 8 Ben Lindstrom 2002-09-26 09:15:36 AEST
Darren's patch applied.  Thanks.
Comment 9 Damien Miller 2004-04-14 12:24:18 AEST
Mass change of RESOLVED bugs to CLOSED