search for: endut

...m.com> Reply-To: yamtak at b-session.com To: openssh at openssh.com Cc: yamtak at b-session.com Subject: minor bugs in openssh-2.3.0p1 Hi, I found that there are minor bugs in openssh-2.3.0p1. There are some function checking for 'entutx?ent' in configure, but its typo, it must be 'endutx?ent'. Thus endutx?ent() was never called. configure.in:line 296 entutent -> endutent configure.in:line 299 entutxent -> endutxent configure:line 2263 entutent -> endutent configure:line 2373 entutxent -> endutxent config.h.in:line 311 entutent -> endutent config.h.in:...

Hi, I found that there are minor bugs in openssh-2.3.0p1. There are some function checking for 'entutx?ent' in configure, but its typo, it must be 'endutx?ent'. Thus endutx?ent() was never called. configure.in:line 296 entutent -> endutent configure.in:line 299 entutxent -> endutxent configure:line 2263 entutent -> endutent configure:line 2373 entutxent -> endutxent config.h.in:line 311 entutent -> endutent config.h.in:...

There are conflicting reports about wether or not Red Hat 4.0 is vulnerable to the login-lockout described earlier. I have the impression that if you install the updates it will have been fixed. Approval of messages about this subject is now restricted to "here is a patch", and a vendors "We have made a patch available". Roger.

...Mailer: Red Gnus v0.71/XEmacs 19.15 The bug exists through the recently released util-linux-2.6. Here is a patch which removes the locking. --- util-linux-2.6/login-utils/login.c.orig Thu Nov 7 06:26:15 1996 +++ util-linux-2.6/login-utils/login.c Fri Nov 29 16:12:24 1996 @@ -628,9 +628,10 @@ endutent(); if((wtmp = open(_PATH_WTMP, O_APPEND|O_WRONLY)) >= 0) { - flock(wtmp, LOCK_EX); +/* Locking wtmp allows for trivial denial of service attack by nvi */ +/* flock(wtmp, LOCK_EX); */ write(wtmp, (char *)&ut, sizeof(ut)); - flock(wtmp, LOCK_UN); +/*...

...utmp old_ut; #endif + int tty; +#endif /* HAVE_PUTUTLINE */ #if defined(HAVE_UTMPX_H) && defined(USE_UTMPX) struct utmpx *old_utx; #endif /* defined(HAVE_UTMPX_H) && defined(USE_UTMPX) */ register int fd; - int tty; +#if defined(HAVE_PUTUTLINE) + old_utp = pututline(utp); + endutent(); +#else tty = ttyslot(); if (tty > 0 && (fd = open(_PATH_UTMP, O_RDWR|O_CREAT, 0644)) >= 0) { @@ -100,6 +108,7 @@ (void)write(fd, utp, sizeof(struct utmp)); (void)close(fd); } +#endif /* HAVE_PUTUTLINE */ if ((fd = open(_PATH_WTMP, O_WRONLY|O_APPEND, 0)) >= 0)...

Hi, When I tested the latest snapshot on FreeBSD 4.2, I noticed some implicit declaration warnings I didn't recall seeing on Linux. I think this is caused by the fact that if autoconf does detect the presence of some BSD capability, necessary header files and declarations may not be included (as these are assumed to be the same ~everywhere, and already included). If such capability is

...f tcgetpgrp utimes vsnprintf vhangup vis waitpid _getpty __b64_ntop) -dnl Checks for time functions -AC_CHECK_FUNCS(gettimeofday time) -dnl Checks for libutil functions -AC_CHECK_HEADERS(libutil.h) -AC_CHECK_FUNCS(login logout updwtmp logwtmp) -dnl Checks for utmp functions -AC_CHECK_FUNCS(endutent getutent getutid getutline pututline setutent) -AC_CHECK_FUNCS(utmpname) -dnl Checks for utmpx functions -AC_CHECK_FUNCS(endutxent getutxent getutxid getutxline pututxline ) -AC_CHECK_FUNCS(setutxent utmpxname) - -AC_CHECK_FUNC(getuserattr, - [AC_DEFINE(HAVE_GETUSERATTR)], - [AC_CHECK_LIB(s,...

OpenSSH-3.0p1-pre, from CVS as of about 2001-10-30 23:45 UTC. Any particular reason why configure is checking for login() in -lutil, finds it, then checks for it again in -lbsd? Here's the relevant excerpts (Red Hat Linux 6.2, , kernel-2.2.19, glibc-2.1.3, egcs-1.1.2, autoconf-2.52): $ CFLAGS='-O2 -mpentium -Wall'; export CFLAGS $ ./configure

...) salt = pw_password; --- bsd-login.c.DIST Mon May 1 06:53:53 2000 +++ bsd-login.c Fri May 5 12:30:48 2000 @@ -60,6 +60,7 @@ #include <stdio.h> #include <string.h> +#ifdef USER_PROCESS /* * find first matching slot in utmp, or "-1" for none * @@ -93,6 +94,13 @@ endutent(); return(-1); } +#else +int find_tty_slot( utp ) +struct utmp * utp; +{ + return(ttyslot()); +} +#endif #if defined(HAVE_UTMPX_H) && defined(USE_UTMPX) void @@ -127,13 +135,16 @@ } else { /* If no tty was found... */ if (tty == -1) { +#ifdef USER_PROCESS /* ... append...

...g for utimes... (cached) yes checking for vhangup... yes checking for vsnprintf... yes checking for waitpid... yes checking for __b64_ntop... no checking for _getpty... no checking for dirname... yes checking for libgen.h... yes checking for gettimeofday... yes checking for time... yes checking for endutent... yes checking for getutent... yes checking for getutid... yes checking for getutline... yes checking for pututline... yes checking for setutent... yes checking for utmpname... yes checking for endutxent... yes checking for getutxent... yes checking for getutxid... yes checking for getutxline.....

...} + + setutent(); + count = 0; + while ((ut = getutent())) { +// if (ut->ut_type != USER_PROCESS) +// continue; + if (ut->ut_user[0] == '\0') + continue; + if (strncmp(name, ut->ut_user, sizeof(ut->ut_user)) != 0) + continue; + if (++count > limit) + break; + } + endutent(); + /* + * This is called after setutmp(), so the number of logins counted + * includes the user who is currently trying to log in. + */ + + if (count > limit) { + printf("Too many logins (max %d).\n",count); + syslog(LOG_WARNING, "Too many logins (max %d) f...

...checking for _getpty... no checking for dirname... yes checking for libgen.h... yes checking for gettimeofday... yes checking for time... yes checking for libutil.h... no checking for login... (cached) no checking for logout... no checking for updwtmp... yes checking for logwtmp... no checking for endutent... yes checking for getutent... yes checking for getutid... yes checking for getutline... yes checking for pututline... yes checking for setutent... yes checking for utmpname... yes checking for endutxent... yes checking for getutxent... yes checking for getutxid... yes checking for getutxline.....

...is... no checking for waitpid... yes checking for _getpty... no checking for __b64_ntop... no checking for gettimeofday... yes checking for time... yes checking for libutil.h... no checking for login... no checking for logout... no checking for updwtmp... yes checking for logwtmp... no checking for endutent... yes checking for getutent... yes checking for getutid... yes checking for getutline... yes checking for pututline... yes checking for setutent... yes checking for utmpname... yes checking for endutxent... yes checking for getutxent... yes checking for getutxid... yes checking for getutxline.....

...for __b64_ntop... (cached) no checking for gettimeofday... (cached) yes checking for time... (cached) yes checking for libutil.h... (cached) no checking for login... (cached) no checking for logout... (cached) no checking for updwtmp... (cached) yes checking for logwtmp... (cached) no checking for endutent... (cached) yes checking for getutent... (cached) yes checking for getutid... (cached) yes checking for getutline... (cached) yes checking for pututline... (cached) yes checking for setutent... (cached) yes checking for utmpname... (cached) yes checking for endutxent... (cached) yes checking for...

...or library containing nanosleep... none required checking for library containing basename... no checking whether strsep is declared... yes checking for strsep... yes checking for dirname... no checking for dirname in -lgen... no checking for gettimeofday... yes checking for time... yes checking for endutent... no checking for getutent... no checking for getutid... no checking for getutline... no checking for pututline... no checking for setutent... no checking for utmpname... no checking for endutxent... no checking for getutxent... no checking for getutxid... no checking for getutxline... no check...

...s... yes checking for waitpid... yes checking for _getpty... no checking for __b64_ntop... no checking for gettimeofday... yes checking for time... yes checking for libutil.h... no checking for login... no checking for logout... no checking for updwtmp... yes checking for logwtmp... no checking for endutent... yes checking for getutent... yes checking for getutid... yes checking for getutline... yes checking for pututline... yes checking for setutent... yes checking for utmpname... yes checking for endutxent... yes checking for getutxent... yes checking for getutxid... yes checking for getutxline.....

...ed... no checking whether strsep is declared... yes checking for strsep... yes checking whether tcsendbreak is declared... yes checking whether h_errno is declared... yes checking for setresuid... no checking for setresgid... no checking for gettimeofday... yes checking for time... yes checking for endutent... no checking for getutent... no checking for getutid... no checking for getutline... no checking for pututline... no checking for setutent... no checking for utmpname... no checking for endutxent... yes checking for getutxent... yes checking for getutxid... yes checking for getutxline... yes c...

...whether tcsendbreak is declared... yes checking whether h_errno is declared... yes checking for setresuid... yes checking if setresuid seems to work... yes checking for setresgid... yes checking if setresgid seems to work... yes checking for gettimeofday... yes checking for time... yes checking for endutent... no checking for getutent... no checking for getutid... no checking for getutline... no checking for pututline... no checking for setutent... no checking for utmpname... no checking for endutxent... no checking for getutxent... no checking for getutxid... no checking for getutxline... no check...

...ther O_NONBLOCK is declared... yes checking whether writev is declared... yes checking whether MAXSYMLINKS is declared... yes checking whether offsetof is declared... yes checking for setresuid... no checking for setresgid... no checking for gettimeofday... yes checking for time... yes checking for endutent... yes checking for getutent... yes checking for getutid... yes checking for getutline... yes checking for pututline... yes checking for setutent... yes checking for utmpname... yes checking for endutxent... no checking for getutxent... no checking for getutxid... no checking for getutxline... n...

...r waitpid... yes checking for library containing nanosleep... -lposix4 checking for library containing basename... -lgen checking whether strsep is declared... no checking for dirname... yes checking for libgen.h... (cached) yes checking for gettimeofday... yes checking for time... yes checking for endutent... yes checking for getutent... yes checking for getutid... yes checking for getutline... yes checking for pututline... yes checking for setutent... yes checking for utmpname... yes checking for endutxent... yes checking for getutxent... yes checking for getutxid... yes checking for getutxline.....