search for: getuserattr

Hi. New (2.1.1p1) login code is nicer on AIX (4.2.1.0.06). Thanks. A couple of issues, though, which I haven't really dug into yet. I'm wondering if anyone else has seen them? If not, I'll investigate & report. 1. If I set "UseLogin" to "yes", everything seems fine except that the authentication agent forwarding doesn't work. The "SSH"

Hi, we're in the process of setting up large-page support on IBM regattas, but for large-page support the users have to have a set of extra capabilities (CAP_BYPASS_RAC_VMM,CAP_PROPAGATE). This are configured on a per user basis by listing which capability each user have in /etc/security/user. Unfortunately they don't get set when the users log in via OpenSSH (3.1p1). Does anybody know

...platform does not support getgrouplist directly then sshd uses getgrent to enumerate group membership (for group allow / deny). The AIX version of this API only supports /etc/group and NIS and so the group features do not work with other naming providers (nss_ldap say). The AIX port should use getuserattr(user, S_GROUPS, ..), this uses NSS. We can provide a candidate fix for this if needed. ------- You are receiving this mail because: ------- You are the assignee for the bug, or are watching the assignee.

...logwtmp) -dnl Checks for utmp functions -AC_CHECK_FUNCS(endutent getutent getutid getutline pututline setutent) -AC_CHECK_FUNCS(utmpname) -dnl Checks for utmpx functions -AC_CHECK_FUNCS(endutxent getutxent getutxid getutxline pututxline ) -AC_CHECK_FUNCS(setutxent utmpxname) - -AC_CHECK_FUNC(getuserattr, - [AC_DEFINE(HAVE_GETUSERATTR)], - [AC_CHECK_LIB(s, getuserattr, [LIBS="$LIBS -ls"; AC_DEFINE(HAVE_GETUSERATTR)])] -) - -AC_CHECK_FUNC(login, - [AC_DEFINE(HAVE_LOGIN)], - [AC_CHECK_LIB(bsd, login, [LIBS="$LIBS -lbsd"; AC_DEFINE(HAVE_LOGIN)])] -) - -AC_CHECK_FUNC(daemon, - [A...

...AIX, if an LDAP user authenticates through SSH, the user's registry info is not updated. For instance, if an LDAP user enters an incorrect password while logging in through SSH, the LDAP user's unsuccessful_login_count is not increased. This is solved by adding calls to setuserdb(), getuserattr(), and setauthdb() in auth.c. I will be submitting a patch that adds these calls for 3.6p1. If anyone sees something in the patch that isn't kosher, let me know... ------- You are receiving this mail because: ------- You are the assignee for the bug, or are watching the assignee.

...GIN ^^^^^^^^^^^^^^^^^^^^^^^^ checking for deflate in -lz... yes ... checking for libutil.h... no checking for login... (cached) no ^^^^^^^^^^^^^^^^^^^^^^ checking for logout... yes checking for updwtmp... yes checking for logwtmp... yes ... checking for getuserattr... no checking for getuserattr in -ls... no checking for login... (cached) no ^^^^^^^^^^^^^^^^^^^^^^ checking for login in -lbsd... yes <--- #define HAVE_LOGIN ^^^^^^^^^^^^^^^^^^^^^^^ checking for daemon... yes ... OpenSSH has been configured with the f...

...r pututline... yes checking for setutent... yes checking for utmpname... yes checking for entutxent... no checking for getutxent... yes checking for getutxid... yes checking for getutxline... yes checking for pututxline... yes checking for setutxent... yes checking for utmpxname... yes checking for getuserattr... no checking for getuserattr in -ls... no checking for login... (cached) no checking for login in -lbsd... no checking for daemon... no checking for daemon in -lbsd... no checking for getpagesize... yes checking whether snprintf correctly terminates long strings... configure: error: can not run t...

...isable FallBackToRsh by default - (djm) Replace in_addr_t with u_int32_t in bsd-inet_aton.c. Report from Ben Lindstrom <mouring at pconline.com> - (djm) Make building of X11-Askpass and GNOME-Askpass optional in RPM spec file. - (djm) Released 2.1.1p3 20000711 - (djm) Fixup for AIX getuserattr() support from Tom Bertelson <tbert at abac.com> - (djm) ReliantUNIX support from Udo Schweigert <ust at cert.siemens.de> - (djm) NeXT: dirent structures to get scp working from Ben Lindstrom <mouring at pconline.com> - (djm) Fix broken inet_ntoa check and ut_user/ut_nam...

...isable FallBackToRsh by default - (djm) Replace in_addr_t with u_int32_t in bsd-inet_aton.c. Report from Ben Lindstrom <mouring at pconline.com> - (djm) Make building of X11-Askpass and GNOME-Askpass optional in RPM spec file. - (djm) Released 2.1.1p3 20000711 - (djm) Fixup for AIX getuserattr() support from Tom Bertelson <tbert at abac.com> - (djm) ReliantUNIX support from Udo Schweigert <ust at cert.siemens.de> - (djm) NeXT: dirent structures to get scp working from Ben Lindstrom <mouring at pconline.com> - (djm) Fix broken inet_ntoa check and ut_user/ut_nam...

...t at http://www.mindrot.org/misc/junk/openssh-SNAP-2000071102.tar.gz It contains quite a few fixes for small problems that have been reported in the last few weeks. Pending feedback it is going to become 2.1.1p3 Regards, Damien Miller --------------- Changelog: 20000711 - (djm) Fixup for AIX getuserattr() support from Tom Bertelson <tbert at abac.com> - (djm) ReliantUNIX support from Udo Schweigert <ust at cert.siemens.de> - (djm) NeXT: dirent structures to get scp working from Ben Lindstrom <mouring at pconline.com> - (djm) Fix broken inet_ntoa check and ut_user/ut_nam...

...w; + + /* + * Check if password has been expired too long. In this case, + * passwdexpired still returns 1 but /bin/passwd will fail + * while still returning a successiful status, allowing the + * login. So, we deny these login attempts here. + */ + upw = getuserpw(user); + result = getuserattr(user, S_MAXEXPIRED, &maxexpired, SEC_INT); + result2 = getuserattr(user, S_MAXAGE, &maxage, SEC_INT); + if (upw != NULL && result == 0 && result2 == 0) { + time_t now, lastup = upw->upw_lastupdate; + + now = time(NULL); + debug3("%s lastupdate %lu maxage %d w...

...-lutil 1>&5 configure:2168: checking for utmpxname configure:2196: gcc -o conftest -I/usr/local/ssl/include -Wall -static -L/lib/security -L/lib -L/usr/local/ssl/lib -L/lib -L/lib/security -L/lib -L/usr/local/ssl -L/lib conftest.c -lnsl -lz -lutil 1>&5 configure:2222: checking for getuserattr configure:2250: gcc -o conftest -I/usr/local/ssl/include -Wall -static -L/lib/security -L/lib -L/usr/local/ssl/lib -L/lib -L/lib/security -L/lib -L/usr/local/ssl -L/lib conftest.c -lnsl -lz -lutil 1>&5 /tmp/ccZL8HV4.o: In function `main': /tmp/ccZL8HV4.o(.text+0x4): undefined reference...

...w; + + /* + * Check if password has been expired too long. In this case, + * passwdexpired still returns 1 but /bin/passwd will fail + * while still returning a successiful status, allowing the + * login. So, we deny these login attempts here. + */ + upw = getuserpw(user); + result = getuserattr(user, S_MAXEXPIRED, &maxexpired, SEC_INT); + result2 = getuserattr(user, S_MAXAGE, &maxage, SEC_INT); + if (upw != NULL && result == 0 && result2 == 0) { + time_t now, lastup = upw->upw_lastupdate; + + now = time(NULL); + debug3("%s lastupdate %lu maxage %d w...

...pututline... yes checking for setutent... yes checking for utmpname... yes checking for endutxent... yes checking for getutxent... yes checking for getutxid... yes checking for getutxline... yes checking for pututxline... yes checking for setutxent... yes checking for utmpxname... yes checking for getuserattr... no checking for getuserattr in -ls... no checking for daemon... no checking for daemon in -lbsd... no checking for getpagesize... yes checking whether snprintf correctly terminates long strings... yes checking for ANSI C header files... yes checking for sys/types.h... yes checking for sys/stat.h...

...the global int rlogin): --- openssh-4.3p2/openbsd-compat/port-aix.c Sat May 28 19:54:28 2005 +++ 52/openbsd-compat/port-aix.c Sun May 14 05:19:43 2006 @@ -231,231 +231,234 @@ debug3("%s: not checking", __func__); return 1; } + if (getuserattr(pw->pw_name, S_RLOGINCHK, &rlogin, SEC_BOOL) == -1) + rlogin=1; - result = loginrestrictions(pw->pw_name, S_RLOGIN, NULL, &msg); + result = loginrestrictions(pw->pw_name, 0, NULL, &msg); if (result == 0) permitted = 1;...

...OpenSSL lib."! So I need to install the OpenSSL lib before run the configuration? where is the OpenSSL lib ? Would I download from the Internet ? Attached the config.log file Thanks Perrin [root at perrin openssh-3.1p1]# ./configure ..................... ..................... checking for getuserattr in -ls... no checking for daemon... yes checking for getpagesize... yes checking whether snprintf correctly terminates long strings... yes checking whether getpgrp takes no argument... yes checking for OpenSSL directory... configure: error: Could not find working OpenSSL library, please install or...

...pututline... yes checking for setutent... yes checking for utmpname... yes checking for endutxent... yes checking for getutxent... yes checking for getutxid... yes checking for getutxline... yes checking for pututxline... yes checking for setutxent... yes checking for utmpxname... yes checking for getuserattr... no checking for getuserattr in -ls... no checking for login... (cached) no checking for login in -lbsd... no checking for daemon... no checking for daemon in -lbsd... no checking for getpagesize... yes checking whether snprintf correctly terminates long strings... yes checking for ANSI C header...

...pututline... yes checking for setutent... yes checking for utmpname... yes checking for endutxent... yes checking for getutxent... yes checking for getutxid... yes checking for getutxline... yes checking for pututxline... yes checking for setutxent... yes checking for utmpxname... yes checking for getuserattr... no checking for getuserattr in -ls... theno checking for login... (cached) no checking for login in -lbsd... no checking for daemon... no checking for daemon in -lbsd... no checking for getpagesize... yes checking whether snprintf correctly terminates long strings... yes checking whether getpgrp...

...ns which it implements to always fail with ENOSYS. Some functions are actually named something starting with __ and the normal name is an alias. */ #if defined (__stub_utmpxname) || defined (__stub___utmpxname) choke me #else utmpxname(); #endif ; return 0; } configure:3637: checking for getuserattr configure:3665: cc -o conftest -g conftest.c -lz -lsecurity -ldb -lm -laud -lutil 1>&5 ld: Unresolved: getuserattr configure: failed program was: #line 3642 "configure" #include "confdefs.h" /* System header to define __stub macros and hopefully few prototypes, whi...

https://bugzilla.mindrot.org/show_bug.cgi?id=1583 Summary: User principal name in AIX Product: Portable OpenSSH Version: 5.2p1 Platform: PPC OS/Version: AIX Status: NEW Severity: normal Priority: P2 Component: Kerberos support AssignedTo: unassigned-bugs at mindrot.org ReportedBy: