openssh unix dev - Aug 2002 - [Bug 355] No last login message with PrivSep under AIX

http://bugzilla.mindrot.org/show_bug.cgi?id=355





------- Additional Comments From dtucker at zip.com.au  2002-08-25 18:10 -------
It looks like the call to loginsuccess() fails because it's done as a 
non-privileged user.  This is bad because in addition to generating the message 
it also clears the failed login counter that leads to account lockout.

The following patch fixes it for me but I'm not sure this is the right
approach.
I still don't properly understand privsep...  Would someone who does please 
sanity-check this?



------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

http://bugzilla.mindrot.org/show_bug.cgi?id=355





------- Additional Comments From dtucker at zip.com.au  2002-08-25 18:14 -------
Created an attachment (id=140)
 --> (http://bugzilla.mindrot.org/attachment.cgi?id=140&action=view)
Move loginsuccess call into auth.c so it works with privsep on




------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

http://bugzilla.mindrot.org/show_bug.cgi?id=355

dtucker at zip.com.au changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |genty at us.ibm.com



------- Additional Comments From dtucker at zip.com.au  2002-08-25 18:17 -------
*** Bug 385 has been marked as a duplicate of this bug. ***



------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

http://bugzilla.mindrot.org/show_bug.cgi?id=355





------- Additional Comments From dtucker at zip.com.au  2002-08-25 18:59 -------
Ignore previous patch, it's plain wrong. It clears the counter whether or
not
the login was successful.



------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

http://bugzilla.mindrot.org/show_bug.cgi?id=355

dtucker at zip.com.au changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
 Attachment #140 is|0                           |1
           obsolete|                            |



------- Additional Comments From dtucker at zip.com.au  2002-08-25 21:56 -------
Created an attachment (id=141)
 --> (http://bugzilla.mindrot.org/attachment.cgi?id=141&action=view)
Move loginsuccess to auth-passwd.c

Relocated loginsuccess call as per comments in bugid 385.
Removed unused loginmsg variable.



------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

http://bugzilla.mindrot.org/show_bug.cgi?id=355

cawlfiel at us.ibm.com changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
 Attachment #141 is|0                           |1
           obsolete|                            |



------- Additional Comments From cawlfiel at us.ibm.com  2002-08-31 01:03
-------
Created an attachment (id=142)
 --> (http://bugzilla.mindrot.org/attachment.cgi?id=142&action=view)
Enables tracking of unsuccessful logins on AIX

I've included a patch that adds one line to the end of the previous 
auth-passwd.c patch, #141.  Before, AIX unsuccessful logins would go unnoticed.
 

In the enclosed patch, if the AIX authenticate in unsuccessful the loginfailed
subroutine is run, which logs the unsuccessful login to
/etc/security/failedlogin as well as updates the user's attributes in
/etc/security/lastlog




------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

http://bugzilla.mindrot.org/show_bug.cgi?id=355





------- Additional Comments From dtucker at zip.com.au  2002-08-31 14:22 -------
While that's true of 3.4p1 the loginfailed() bug has been fixed in -current
for
a while (see bug #145)



------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

http://bugzilla.mindrot.org/show_bug.cgi?id=355

dtucker at zip.com.au changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
 Attachment #141 is|1                           |0
           obsolete|                            |





------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.