similar to: Locked account checks and PAM

Hi. I have found a error of openssh-2.1.1p2 port on systems with a mixture of shadowed and non-shadowed passwords. I reported a same type of error to Mr. Miller when openssh-1.2.1pre23 was released. On our systems, our local machines have shadowed /etc/passwd (and /etc/shadow) and our NIS server distributes non-shadowed password of general users. We have to use

Hi Damien, I noticed you merged a couple of ifdefs in the fix for bug #442. The cvs comment says "Fix Bug #442 for PAM case". The code is now roughly: #if !defined(USE_PAM) && defined(HAVE_SHADOW_H) && \ !defined(DISABLE_SHADOW) && defined(HAS_SHADOW_EXPIRE) spw = getspnam(pw->pw_name); passwd = spw->sp_pwdp; #else passwd =

This is an attempt to simplify the AIX expiry-via-passwd stuff and make it more generic. (There's actually a net reduction in #ifdefs). Patch against CVS: 1) configure finds passwd. 2) sshd uses passwd during session if required. 3) sshd uses passwd for PAM change if privsep disabled. 4) sshd uses Buffers for expire and post-login messages (no longer AIX specific). 5) password_change_required

This is based on openssh-2.0.0beta1. There are a few rough spots: 1) SunOS doesn't have ut_type in struct utmp so I just whacked in the old login() from openssh-1.2.3. 2) There is a SUNOS4 section added to defines.h -- this could probably be a bit cleaner. 3) sigaction on SunOS is implemented via #defines to sigvec, thus there is no SA_RESTART (this is the default behavior).

Hi All. After one false start, I now have a Tinderbox up and running for the OpenSSH portable tree. For those not familiar with it, Tinderbox is a tool for automatically displaying the status of builds and tests. At the moment, I do 1 update and 4 builds hourly. It's not fully functional yet but the basics work. It can be found at http://dodgynet.dyndns.org/tinderbox/OpenSSH_Portable/ (I

Hi All, After finding out my AIX boxes haven't been updating their tinderbox[0] test trees (grr) and fixing that, I found that recent changes caused build errors on AIX 4.3.3 & 5.1. 4.2.1 appears OK. The error is: gcc -g -O2 -Wall -Wpointer-arith -Wno-uninitialized -I. -I.. -I../../openbsd-compat -I../../openbsd-compat/.. -I/usr/local/ssl/include -I/usr/local/include -DHAVE_CONFIG_H

Hi All. Damien merged a bunch of changes today which caused compile errors on a few platforms (which you can see live and in colour at [0]). a) Solaris, early AIX: ../crc32.c:100: `u_int32_t? undeclared (first use in this function) On these platforms u_int32_t is defined in defines.h which is not included by crc32.c. Fixed by attached patch. b) PAM platforms (Redhat, Solaris once a) is

Hi All. Attached is a patch which adds AIX native password expiry support to sshd. It will only apply to -current and is a subset of the patch I have been working on in the last few months (see bug #14 [1]). It contains code by Pablo Sor, Mark Pitt and Zdenek Tlusty and fixes for bugs reported by many others (see [2] for a full list). It adds a do_tty_change_password function that execs

Hi All. Attached is a patch introduces password expiry handling for AIX (other platforms to follow). It is more or less the same as the previous patch but has been updated to reflect recent changes to auth-passwd.c I'm wondering if the AIX parts of auth.c should be moved to port-aix.c and if the generic password change functions (currently at the end of auth-passwd.c) belong in a separate

Hi All. The recent changes to scp caused build failures on Solaris and AIX 4.2 which showed up on the tinderbox[1]. I mentioned the first to djm in email yesterday but I'm posting after finding the second, in case anyone else has seen similar problems. Solaris' nanosleep is in librt (or libposix4 in older versions) which is not linked. Adding them to configure works fine, however ldd

Hi All. There are still build errors for scp on AIX 4.2.1 due to lack of nanosleep (which you can see them live and in colour at [1]). The attached patch fixes this by using the equivalent nsleep function on AIX if it exists and nanosleep doesn't. The patch is mostly the same as the AIX portion of the previous patch for the nanosleep issue, the major difference being that the #define is in

I'm looking at the password aging and account lock checks in auth.c:allowed_user(), and specifically their behaviour on HP-UX. First, should this code be ifdef'd away if we're using PAM? Next: /* Check account expiry */ if ((spw->sp_expire > 0) && (days > spw->sp_expire)) return 0; If I lock an account by entering too many incorrect passwords, sp_expire

Hello! Today I've found, downloaded and compiled openssh-2.2.0-p1. It basically worked, except that users other than root were not allowed to login. My system is a Linux-2.4.0-test7 with glibc-2.1.3. No PAM is installed/used. It uses MD5 passwords and shadow with account expiration feature. In handling of the latter, a probable bug was found. In auth.c, allowed_user(), there is a code at

Hi All. I noticed that xcrypt.c now has some variable declarations after code within a block (for some sets of #ifdef's). Won't that choke some compilers? Should it do something like the attached? -- Darren Tucker (dtucker at zip.com.au) GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4 37C9 C982 80C7 8FF4 FA69 Good judgement comes with experience. Unfortunately, the experience usually

i'm working on this. this is what i have now. sp_inact is not handled consistently across shadow platforms, so i'm going to not address that right now. the following is the predecessor to bug14. what is the timeframe for 3.2.1p1? markus suggested a few more weeks. Index: auth.c =================================================================== RCS file: /var/cvs/openssh/auth.c,v

Hello All, We have been successfully using PAM_LDAP authentication with OpenSSH-3.6 on our HP-UX 11.11. When OpenSSH-3.7.1p2 is installed [with Darrens' password expiry patch 26], and when Shadow password bundle is installed on the system, our ssh authentication failed. Even, when the source is compiled without Darren's patch, the same bahaviour is seen and there is no success. When

Hi Openssh developers, Attached please find patch to support long passwords (> 8-char) on UnixWare 7. Thanks, Ahsan -- Ahsan Rashid Escalations Research Group arms at sco.com The SCO Group Inc., Murray Hill, NJ 908 790 2279 -------------- next part -------------- --- openssh/CREDITS.old 2004-05-26 16:59:31.000000000 -0700 +++ openssh/CREDITS 2005-08-25 13:53:08.602447006 -0700 @@ -3,6 +3,7

The primary purpose of the attached patches is for portable OpenSSH to support changing expired passwords as specified in shadow password files. To support that, I did a couple enhancements to the base OpenBSD OpenSSH code. They are: 1. Consolidated the handling of "forced_command" into a do_exec() function in session.c. These were being handled inconsistently and allocated

QNX Neutrino does not support the shadow password database properly. Apart from misdocumenting /etc/shadow as having 4 fields when in fact it has 5 (including the "last changed" field), its getspnam() fills in the sp_expire field of the spwd structure with 0. And since by default, shadow support is enabled and the configure script turns on HAS_SHADOW_EXPIRE when it finds that field,

Details of installation attached. Effect: when I build and test (with full path names) ssh in the openssh... directory, everything works fine. When I "install" it as per attached file into a test-directory and run it from there, there are 2 phenomena: either it just hangs, eating 96% of CPU or it dies with a Segmentation fault (this is what happens most often) Help needed