Mailing List Archive: [Bug 633] Password authentication fails in HP-UX trusted mode due to DISABLE_SHADOW

[Bug 633] Password authentication fails in HP-UX trusted mode due to DISABLE_SHADOW

bugzilla-daemon at mindrot

Sep 24, 2003, 3:37 AM

Post #1 of 4 (536 views)

http://bugzilla.mindrot.org/show_bug.cgi?id=633

------- Additional Comments From michael_steffens@hp.com 2003-09-24 21:37 -------
Hi Darren,

now that PAM is in distress (won't reason about why here) I think having pw hash
retrieval directed to getspnam is even more desirable for all version of HP-UX.

For 10.x versions still in use (10.20 presumably the vast majority) I have
found OS patches containing the getwent family (not introducing it!) in libsec:

10.10 PHCO_11208 (published 1997/06/06)
10.20 PHCO_11214 (published 1997/06/09)

both addressing "adding/removing users can cause getspwent(3) to loop".

For 10.00 and 10.01 I had to unpack PHCO_9817 (published 1997/02/17) and
examine libsec.1 using nm:

_fgetspwent | 58032|extern|entry |
_fgetspwent | 58128|extern|code |$CODE$
_fgetspwent_r | 73892|extern|entry |
_fgetspwent_r | 73940|extern|code |$CODE$
_getspwaid | 57540|extern|entry |
_getspwaid | 57612|extern|code |$CODE$
_getspwaid_r | 73016|extern|entry |
_getspwaid_r | 73064|extern|code |$CODE$
_getspwent | 58528|extern|entry |
_getspwent | 58576|extern|code |$CODE$
_getspwent_r | 74348|extern|entry |
_getspwent_r | 74420|extern|code |$CODE$
_getspwnam | 56888|extern|entry |
_getspwnam | 56936|extern|code |$CODE$
_getspwnam_r | 71548|extern|entry |
_getspwnam_r | 71668|extern|code |$CODE$
_getspwuid | 57196|extern|entry |
_getspwuid | 57268|extern|code |$CODE$
_getspwuid_r | 72312|extern|entry |
_getspwuid_r | 72360|extern|code |$CODE$
fgetspwent | 58056|extern|entry |
fgetspwent | 58128|extern|code |$CODE$
fgetspwent_r | 73916|extern|entry |
fgetspwent_r | 73940|extern|code |$CODE$
getspent | 56576|extern|entry |
getspent | 56648|extern|code |$CODE$
getspnam | 56752|extern|entry |
getspnam | 56776|extern|code |$CODE$
getspwaid | 57564|extern|entry |
getspwaid | 57612|extern|code |$CODE$
getspwaid_r | 73040|extern|entry |
getspwaid_r | 73064|extern|code |$CODE$
getspwent | 58552|extern|entry |
getspwent | 58576|extern|code |$CODE$
getspwent_r | 74372|extern|entry |
getspwent_r | 74420|extern|code |$CODE$
getspwnam | 56912|extern|entry |
getspwnam | 56936|extern|code |$CODE$
getspwnam_r | 71572|extern|entry |
getspwnam_r | 71668|extern|code |$CODE$
getspwuid | 57220|extern|entry |
getspwuid | 57268|extern|code |$CODE$
getspwuid_r | 72336|extern|entry |
getspwuid_r | 72360|extern|code |$CODE$

So these functions are at least present. Can't test these very old ones,
however, as we don't have any of them any more.

All these patches are also the latest libsec patches for these platforms. My
two cents are:

Somebody running 10.x and not having patched OS for more than six years
is likely to have more serious vulnerabilities to care for than OpenSSH.

Cheers!
Michael

------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

[Bug 633] Password authentication fails in HP-UX trusted mode due to DISABLE_SHADOW [ In reply to ]

bugzilla-daemon at mindrot

Sep 24, 2003, 6:09 AM

Post #2 of 4 (549 views)

http://bugzilla.mindrot.org/show_bug.cgi?id=633

------- Additional Comments From mouring@eviladmin.org 2003-09-25 00:09 -------
what about:

xcrypt() section where we have:

# elif defined(__hpux) && !defined(HAVE_SECUREWARE)
if (iscomsec())
crypted = bigcrypt(password, salt);
else
crypted = crypt(password, salt);

------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

[Bug 633] Password authentication fails in HP-UX trusted mode due to DISABLE_SHADOW [ In reply to ]

bugzilla-daemon at mindrot

Sep 25, 2003, 12:07 AM

Post #3 of 4 (545 views)

http://bugzilla.mindrot.org/show_bug.cgi?id=633

------- Additional Comments From michael_steffens@hp.com 2003-09-25 18:07 -------
This remains fine in function xcrypt. Trusted systems, and only these, do use the
bigcrypt hashing.

------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

[Bug 633] Password authentication fails in HP-UX trusted mode due to DISABLE_SHADOW [ In reply to ]

bugzilla-daemon at mindrot

Sep 25, 2003, 2:25 AM

Post #4 of 4 (545 views)

http://bugzilla.mindrot.org/show_bug.cgi?id=633

dtucker@zip.com.au changed:

What |Removed |Added
----------------------------------------------------------------------------
Status|ASSIGNED |RESOLVED
Resolution| |FIXED

------- Additional Comments From dtucker@zip.com.au 2003-09-25 20:25 -------
OK, I'm convinced. Patch id #386 applied to both HEAD and 3.7 branch.

BTW, I've discovered how to convert to and from Trusted Mode via command line
(it's /usr/lbin/tsconvert if anyone wanted to know) so I can now regression test
Trusted and non-Trusted on the same box automatically.

------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.