Date: Sun, 2 Jul 2006 05:40:26 +0400 From: Solar Designer <solar@...nwall.com> To: owl-users@...ts.openwall.com Subject: Re: tcb and friends with shadow-utils 4.0.12 On Sat, Jul 01, 2006 at 02:25:25PM -0600, Vincent Danen wrote: > I'm working towards integrating tcb fully into Annvix here ... Great! We definitely want our stuff to be accepted by other distributions. > The problem I'm having is with passwd; it's segfaulting on me when I try > to change a password. I've got my /etc/pam.d/system-auth nearly > identical to the openwall one (in Owl/packages/pam/system-auth.pam): [...skipped...] It looks OK to me. > A few things I noticed, and I was originally trying to stick pam_tcb in > there as a replacement for pam_unix, which is why I kept the last > pam_deny.so call in there. Of course, with pam_unix this works ok, but > with pam_tcb it doesn't, so I had to remove it. Does pam_tcb negate the > need for pam_deny? I don't understand why pam_deny could be needed there at all. > Anyways, my big problem here is with passwd segfaulting when I try to > change my password I'm afraid that you'll have to debug the segfault. Even if it's caused by misconfiguration, this suggests that you have a bug in some C code, perhaps in the passwd program itself. > I've changed perms, so that /etc/shadow is owned root:shadow and mode > 0440. Once you fully migrate your system to tcb, you should remove /etc/shadow. > I've used tcb_convert to enable my tcb filesl my /etc/tcb files > are owned [user]:auth, and the directories are all sgid auth. My own > shadow file (/etc/tcb/vdanen) is owned vdanen:auth and is 640. That's correct. > I'm wondering if I missed a patch to passwd perhaps? No, tcb does not require a patch to passwd. > We use a separate > passwd package that provides just passwd itself (it's the freebsd passwd > with pam support). I noticed passwd isn't in the owl shadow-utils > package (in fact, I'm at a loss as to which package in openwall is > providing passwd since I don't see it it in util-linux either). We use the implementation from SimplePAMApps with our modifications (not related to the use of tcb): http://cvsweb.openwall.com/cgi/cvsweb.cgi/Owl/packages/SimplePAMApps/ SimplePAMApps is a package that provides small PAM-only implementations of login, passwd, and su. It is essentially unmaintained upstream - so we're maintaining it ourselves. (Maybe we should be making releases of "our" SimplePAMApps separately from Owl.) > It's good that auth works... it means I'm heading in the right > direction. Hmmm... wait.. looks like it's wanting to use /etc/shadow > regardless of the USE_TCB setting in login.defs The USE_TCB setting is for the shadow suite utilities only (such as useradd, etc.) > (unless it requires the shadow file to exist still?). With proper configuration, it should not. > Hmmm... do I need to put tcb into the shadow line in /etc/nsswitch.conf? Yes, you do. We have: passwd: files nisplus nis shadow: tcb nisplus nis # To not use tcb, replace the "tcb" with "files": #shadow: files nisplus nis group: files nisplus nis > Ok, looks like I need to have "files tcb bla..." in the nsswitch.conf; Not exactly. You replace "files" with "tcb" - but you do that on the "shadow" line only. > /usr/bin/passwd is sgid shadow. That's correct. We have it like this: -rwx--s--x 1 root shadow 6884 2006-05-06 03:56 /usr/bin/passwd > Oh, all I did was add three groups: auth, shadow, and chkpwd (gid's 27, > 28, and 29 respectively). Are any users required to operate things? I > didn't notice anything looking through the slides and spec files. No, you only needed to add the groups. > The following are the patches I took and rediffed from the openwall > shadow-utils package: > > Patch4: shadow-4.0.12-avx-man.patch > Patch6: shadow-4.0.12-avx-crypt_gensalt.patch > Patch7: shadow-4.0.12-avx-usergroupname_max.patch > Patch8: shadow-4.0.12-avx-tcb.patch If those patches are derived from ours, you could want to give due credit to our project by not dropping the "-owl-" from the filenames. Under our conventions, if we were the maintainers of Annvix, the filenames would be shadow-4.0.12-owl-avx-tcb.diff and the like. Thanks, -- Alexander Peslyak <solar at openwall.com> GPG key ID: B35D3598 fp: 6429 0D7E F130 C13E C929 6447 73C3 A290 B35D 3598 http://www.openwall.com - bringing security into open computing environments
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.