Conference turris::digital_unix

9289.0. "ftpd doesn't update the /tcb/files/auth/ user for unsuccesful logins under C2" by NETRIX::"[email protected]" (Roberto John Romani) Tue Mar 25 1997 20:22

hello All,

	Customer has sent me a script which explains the problem.Basically if he uses
telnet
to login the logind handles a unsuccessful or successful login correctly by
updating the 
users' /tsc/files/auth file.Whereas he the customer uses ftp to login it
doesn't 
adjust the t_time for u_unsuclog, from the man prpasswd

u_suclog  The time in this field is a time_t value that contains the system
            time of the last successful login to the account.

  u_unsuclog
            The time in this field is a time_t value that contains the system
            time of the last unsuccessful login to the account.

  u_suctty  This field is a character string that identifies the name of the
            terminal associated with the last successful login to the
            account.

  u_numunsuclog
            This field contains a number indicating the number of unsuccess-
            ful login attempts to the account.  This field is reset when a
            successful login to the account occurs.  If a login is attempted
            during the time period from u_unsuclog to u_unsuclog plus
            u_unlock, andu_numunsuclog is not less than u_maxtries, the login
            is refused.  (This check is suppressed if the u_maxtries field is
            set to zero.)

Now the script

Script started on Fri Mar 21 14:31:30 1997
% telnet bucket
Trying 128.250.146.11...
Connected to bucket.its.unimelb.EDU.AU.
Escape character is '^]'.


Digital UNIX (bucket) (ttyq1)

login: crs
Password:
Last   successful login for crs: Tue Mar 18 18:29:08 1997 from
fahn.its.unimelb
Last unsuccessful login for crs: Thu Mar  6 10:24:33 1997 on ttyp2

Digital UNIX V3.2D-2 (Rev. 41.64); Wed Dec 18 20:35:18 AEDT 1996 
Digital UNIX V3.2D-2 Worksystem Software (Rev. 41.64)

        Welcome to the wonderful world of UNIX.

*******************************************************************

 Extra code has been added to the passwd program to force users to
 select more "secure" passwords. The passwd program now calls
 cracklib to check for common dictionary words, common keystrokes
 (added to the dictionary), and other things. If you can think of
 any improvements, or find any bugs, please email crs@bucket.

 Note that after a successful trial on bucket, the same password
 checking will be enforced on the admin. boxes.

You have mail.
bucket 51% /bin/su
Password:
Mar 21 15:27:45 bucket su: SU root on /dev/ttyq1
# cat /tcb/files/auth/c/crs
crs:u_name=crs:u_id#5164:u_oldcrypt#0:\
        :u_pwd=*************:\
        :u_maxlen#10:u_succhg#856918470:u_unsucchg#855908485:\
       
:u_suclog#858918456:u_suctty=ttyq1:u_unsuclog#857604273:u_unsuctty=ttyp2:\
        :u_lock@:chkent:
       
:u_suclog#858918456:u_suctty=ttyq1:u_unsuclog#857604273:u_unsuctty=ttyp2:\
        :u_lock@:chkent:
# 
# 
telnet> z

Stopped
% ftp bucket
Connected to bucket.its.unimelb.EDU.AU.
220 bucket FTP server (Digital UNIX Version 5.60) ready.
Name (bucket:): crs
331 Password required for crs.
Password:
530 Login incorrect. 
Login failed.
ftp> u crs
331 Password required for crs.
Password: 
530 Login incorrect. 
Login failed.
ftp> u crs
331 Password required for crs.
Password: 
530 Login incorrect. 
Login failed.
ftp> quit
221 Goodbye.
% fg
telnet bucket
cat /tcb/files/auth/c/crs
crs:u_name=crs:u_id#5164:u_oldcrypt#0:\
        :u_pwd=*************:\
        :u_maxlen#10:u_succhg#856918470:u_unsucchg#855908485:\
       
:u_suclog#858918456:u_suctty=ttyq1:u_unsuclog#857604273:u_unsuctty=ttyp2:\
        :u_lock@:chkent:
# 
telnet> z

Stopped
% telnet bucket
Trying 128.250.146.11...
Connected to bucket.its.unimelb.EDU.AU.
Escape character is '^]'.



Digital UNIX (bucket) (ttyqc)

login: crs
Password:
Login incorrect


Wait for login retry ...

Login incorrect
login: crs
Password:
Login incorrect


Wait for login retry ...

Login incorrect
login: crs
Password:
Login incorrect


Wait for login retry ...

Login incorrect
login: Connection closed by foreign host.
% fg
telnet bucket
cat /tcb/files/auth/c/crs
crs:u_name=crs:u_id#5164:u_oldcrypt#0:\
        :u_pwd=************:\
        :u_maxlen#10:u_succhg#856918470:u_unsucchg#855908485:\
       
:u_suclog#858918456:u_suctty=ttyq1:u_unsuclog#858918568:u_unsuctty=ttyqc:\
        :u_numunsuclog#3:u_lock@:chkent:
# exit
bucket 52% exit
bucket 53% logout
Connection closed by foreign host.
% exit
%script done on Fri Mar 21 14:34:19 1997

any ideas, The customer has applies the C2 related patches but the problem
still exists,
any pointer would be helpful or will I need to IPMT this one.

regards
Roberto John Romani
Sydney TSC
Australia 

[Posted by WWW Notes gateway]

If you are sure they are using our ftpd, please file a qar or IPMT.

Apparently your customer has not installed all of the Enhanced security
related patches, since this patch has been available for some time.
For V3.2 D/E 2 the patch ID is OSF365-350267.  
[Posted by WWW Notes gateway]

[Posted by WWW Notes gateway]