Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] login.defs problem

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: "Sergey A. Lipnevich" <sergey AT optimaltec.com>
  • To: Mads Laursen <smgl AT dossen.dk>
  • Cc: Public SourceMage Discussion List <sm-discuss AT lists.ibiblio.org>
  • Subject: Re: [SM-Discuss] login.defs problem
  • Date: Fri, 29 Jul 2005 08:08:37 -0400

I think I know the answer. After yet another cast of linux-pam, your
securetty file got overwritten. The package does that during
installation. The correct file would say something like this, without
'/dev/':
tty1
tty2
tty3
...

You can try it first by removing pam_securetty from pam.d/login, or
simply fix /etc/securetty. Proof is here:
> Jul 29 00:56:31 leela PAM-securetty[23487]: access denied: tty 'tty2'
is not secure !

May I ask you about your login.defs? If you have changed it, then what
parameters specifically? The reason I ask is because the spell's
behavior may need to be improved to handle existing login.defs better.
Now it simply doesn't care what's in local login.defs before a cast.

And no, you don't have to have pam.d/other, but in security-aware setups
they suggest to deny everything in this file. I have just witnessed
somebody trying to break into my home network (from some ISP net in .tw
by trying to guess SSH login, yesterday morning), so I'm kinda
rethinking my security approach right now :-).

Sergey.

On Fri, 2005-07-29 at 01:14 +0200, Mads Laursen wrote:
> First of all, no need to be sorry about needing more info, I was in the
> middle of something else, so I did not take the time to think about which
> informations might be helpful. I hope that I can rectify this now.
>
> On 28/07/05 18.03, Sergey A. Lipnevich wrote:
> > Hey Mads,
> >
> > That would probably be my doing. I have a few questions:
> > 1. Which grimoire?
>
> test, totally up-to-date
>
> > 2. Which spell versions (gaze version shadow linux-pam)?
>
> root@leela:~# gaze version shadow linux-pam
> Grimoire Section Spell Grimoire Version Installed Version
> -------- ------- ----- ---------------- -----------------
> test security shadow 4.0.11.1 4.0.11.1
> test security-libs linux-pam 0.79 0.79
>
> > 3. When where both installed (or shadow, if PAM is not used; gaze
> > activity |
> > egrep '(shadow|linux-pam)')?
>
> root@leela:~# gaze activity | egrep '(shadow|linux-pam)' | grep -v summon
> 20050620:0151(+0000) cast linux-pam 0.79 start
> 20050620:0152(+0000) cast linux-pam 0.79 success
> 20050620:0158(+0000) cast shadow 4.0.7 start
> 20050620:0159(+0000) dispel shadow 4.0.7 success
> 20050620:0159(+0000) cast shadow 4.0.7 success
> 20050620:0341(+0000) cast linux-pam 0.79 start
> 20050620:0342(+0000) dispel linux-pam 0.79 success
> 20050620:0342(+0000) cast linux-pam 0.79 success
> 20050620:0347(+0000) cast shadow 4.0.7 start
> 20050620:0348(+0000) dispel shadow 4.0.7 success
> 20050620:0348(+0000) cast shadow 4.0.7 success
> 20050620:0518(+0000) cast shadow 4.0.7 start
> 20050620:0519(+0000) dispel shadow 4.0.7 success
> 20050620:0519(+0000) cast shadow 4.0.7 success
> 20050725:2027(+0000) cast shadow 4.0.11.1 start
> 20050725:2028(+0000) dispel shadow 4.0.7 success
> 20050725:2028(+0000) cast shadow 4.0.11.1 success
>
> > 4. What do you see in the event log immediately after successful/failed
> > login
> > attempt? I'm specifically interested in login and PAM events.
>
> One failed attempt as root and one successful as dossen:
>
> root@leela:~# tail -f /var/log/auth.log
> Jul 29 00:56:31 leela login[23487]: PAM _pam_init_handlers: no default
> config /etc/pam.d/other
> Jul 29 00:56:31 leela PAM-securetty[23487]: access denied: tty 'tty2' is
> not secure !
> Jul 29 00:56:34 leela login[23487]: FAILED LOGIN 1 FROM FOR root,
> Authentication failure
> Jul 29 00:58:47 leela login(pam_unix)[30194]: session opened for user
> dossen by (uid=0)
>
> > 5. It looks like you modified login.defs by hand, is this correct? Did
> > you try
> > renaming login.defs and recasting shadow, so that stock file is used?
> > With a
> > stock file, you should see no problems.
>
> Interesting, will try that in a second. I do not recall editing it (prior to
> today, after the problems started). Just waiting for the cast ;-)
>
> No change, the installed login.defs is identical to the one I had edited.
>
> > 6. What is in your `login' and `other' files for PAM? Do you use securetty
> > module for PAM and do you have /etc/securetty file with correct entries?
>
> root@leela:~# cat /etc/pam.d/login
> #
> # The PAM configuration file for the login' service
> #
> auth requisite pam_securetty.so
> auth required pam_unix.so
> auth optional pam_group.so
> account requisite pam_time.so
> account required pam_unix.so
> password required pam_unix.so shadow md5 nullok
> session required pam_unix.so
> root@leela:~# cat /etc/pam.d/other
> cat: /etc/pam.d/other: No such file or directory
> root@leela:~# cat /etc/securetty
> /dev/tty1
> /dev/tty2
> /dev/tty3
> /dev/tty4
> /dev/tty5
> /dev/tty6
>
> Seems I'm missing '/etc/pam.d/other'. The file for login comes from shadow,
> but gaze install shadow does not show any files for other? Where would that
> come from? gaze from does not know anything about it.
>
> > I'm running shadow 4.0.11.1 with PAM and I can login as root as well as
> > any
> > other user, so it can be done :-). I'm sorry there's too many questions,
> > your
> > description of the problem is very broad.
>
> As said, I know. Thank you for taking time to enlighten me about the needed
> info. I hope this will allow you or someone else to help me. Perhaps you
> could check which spell provided your /etc/pam.d/other and show me its
> content?
>
> Thank you in advance.
>
> /dossen
> _______________________________________________
> SM-Discuss mailing list
> SM-Discuss AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/sm-discuss
--
Sergey A. Lipnevich <sergey AT optimaltec.com>
Optimal Technologies





Archive powered by MHonArc 2.6.24.

Top of Page