From owner-freebsd-current@FreeBSD.ORG Fri Mar 27 12:24:53 2009 Return-Path: Delivered-To: current@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id C60E21065689; Fri, 27 Mar 2009 12:24:53 +0000 (UTC) (envelope-from rwatson@FreeBSD.org) Received: from cyrus.watson.org (cyrus.watson.org [65.122.17.42]) by mx1.freebsd.org (Postfix) with ESMTP id A2C6C8FC25; Fri, 27 Mar 2009 12:24:53 +0000 (UTC) (envelope-from rwatson@FreeBSD.org) Received: from fledge.watson.org (fledge.watson.org [65.122.17.41]) by cyrus.watson.org (Postfix) with ESMTPS id 417FD46B3C; Fri, 27 Mar 2009 08:24:53 -0400 (EDT) Date: Fri, 27 Mar 2009 12:24:53 +0000 (GMT) From: Robert Watson X-X-Sender: robert@fledge.watson.org To: Barney Cordoba In-Reply-To: <370833.32038.qm@web63903.mail.re1.yahoo.com> Message-ID: References: <370833.32038.qm@web63903.mail.re1.yahoo.com> User-Agent: Alpine 2.00 (BSF 1167 2008-08-23) MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed Cc: mail25@bzerk.org, ed@FreeBSD.org, current@freebsd.org Subject: Re: Telnet root login X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 27 Mar 2009 12:24:54 -0000 On Thu, 26 Mar 2009, Barney Cordoba wrote: > Ok, I have some critical info here. When I set up ttys with the proper pts/0 > setting, I can login are root using > > login localhost > > however when telnet in from my iMAC, it doesn't work. It also doesn't give > me the "Trying SRA secure login" from the mac. So it seems its using a > different authentication when I telnet from the MAC. Hi Barney (and now also Ed!), This indeed appears to be the key. getttyent(3) appears to properly return the /etc/ttys entry for pts devices, and the TTY_SECURE flag is properly returned. However, pam_securetty isn't using a valid tty name string -- it turns out login, invoked by telnet in the non-SRA case, assumes it can run the following code to get back the tty name: /* * Get current TTY */ ttyn = ttyname(STDIN_FILENO); if (ttyn == NULL || *ttyn == '\0') { (void)snprintf(tname, sizeof(tname), "%s??", _PATH_TTY); ttyn = tname; } if ((tty = strrchr(ttyn, '/')) != NULL) ++tty; else tty = ttyn; The resulting string ("2" in my case) is passed on to PAM as the tty, and then pam_securetty looks that up without any success. Ed, is this something you could take a look at? It's not clear to me if the above logic just needs fixing, or if there are more subtle considerations. Thanks, Robert N M Watson Computer Laboratory University of Cambridge