Date: Thu, 24 Jan 2002 19:29:46 -0500 (EST) From: Robert Watson <rwatson@FreeBSD.org> To: "Andrey A. Chernov" <ache@nagual.pp.ru> Cc: Dag-Erling Smorgrav <des@FreeBSD.org>, cvs-committers@FreeBSD.org, cvs-all@FreeBSD.org Subject: Re: cvs commit: src/lib/libpam/modules/pam_opieaccess pam_opieaccess.c Message-ID: <Pine.NEB.3.96L.1020124192635.67438C-100000@fledge.watson.org> In-Reply-To: <20020124212631.GA86757@nagual.pp.ru>
next in thread | previous in thread | raw e-mail | index | archive | help
On Fri, 25 Jan 2002, Andrey A. Chernov wrote: > On Thu, Jan 24, 2002 at 08:18:43 -0800, Dag-Erling Smorgrav wrote: > > des 2002/01/24 08:18:43 PST > > > > Modified files: > > lib/libpam/modules/pam_opieaccess pam_opieaccess.c > > Log: > > Correctly interpret PAM_RHOST being unset as an indicator of a local > > login. > > > if ((rhost == NULL || opieaccessfile(rhost)) > > This is not the way OPIE auth suppose. I.e. in non-PAM variant you may > don't add local host to /etc/opieaccess file, but with this change you > can't, it always there. IMHO proper way will be: > > if (rhost == NULL) > rhost = "localhost"; > > opieaccess() automatically converts "localhost" to "127.0.0.1" and search > it in /etc/opieaccess. You want to be very careful to avoid potential vulnerability to access control or denial of service issues here. Don't trust DNS strings to be "safe". For example, are there any potential negative effects if I break into your upstream nameserver (at an ISP, say), and cause localhost to resolve to my address, and likewise reverse lookup? Does opieaccess() actually convert localhost to 127.0.0.1, or does it rely on the resolver library? Will localhost actually resolve to 127.0.0.1, or might it resolve purely to ::1 on an IPv6-only system? Robert N M Watson FreeBSD Core Team, TrustedBSD Project robert@fledge.watson.org NAI Labs, Safeport Network Services To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe cvs-all" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.NEB.3.96L.1020124192635.67438C-100000>