Date: Thu, 28 Jun 2001 00:12:22 -0700 (PDT) From: "Oleg Y. Ivanov" <oleg_y_ivanov@mailru.com> To: freebsd-gnats-submit@FreeBSD.org Subject: ports/28474: incorrect permissions on log files created by tacacs+ daemon v4 Message-ID: <200106280712.f5S7CMo66476@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 28474
>Category: ports
>Synopsis: incorrect permissions on log files created by tacacs+ daemon v4
>Confidential: no
>Severity: serious
>Priority: low
>Responsible: freebsd-ports
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: change-request
>Submitter-Id: current-users
>Arrival-Date: Thu Jun 28 00:20:01 PDT 2001
>Closed-Date:
>Last-Modified:
>Originator: Oleg Y. Ivanov
>Release: 4.3-stable
>Organization:
>Environment:
FreeBSD votan.dwec.ru 4.3-STABLE FreeBSD 4.3-STABLE #0: Wed Jun 27 12:44:08 MSD 2001 root@votan.dwec.ru:/usr/src/sys/compile/VOTAN i386
>Description:
tacacs+ as built from port creates it's log file (by default /var/tmp/tac_plus.log) with permissions 666.Path can be changed with -l switch ,permissions are hardcoded.
The problem is when I log on to Cisco's access server,tacacs+ logs password as clear text.
Wed Jun 27 12:38:23 2001 [25815]: verify daemon <password> == NAS <password>
Wed Jun 27 12:38:23 2001 [25815]: Password is correct
By the way , tacacs+ also can write down wtmp-style file (as specified with -w switch), and it's permissions are also hardcoded as 666( see stock /usr/ports/net/tac_plus4/files/patch-ae file)
Both files , if created , will contain sensitive information, so I think permissions should be changed.
>How-To-Repeat:
make ; make install ; /usr/local/sbin/tac_plus -C<your conf file>
-d<debugging flags>
file /var/tmp/tac_plus.log or
>Fix:
--- report.c.bad_perm Fri Jun 15 12:30:09 2001
+++ report.c Fri Jun 15 12:30:37 2001
@@ -160,7 +160,7 @@
if (debug) {
int logfd;
- logfd = open(logfile, O_CREAT | O_WRONLY | O_APPEND, 0666);
+ logfd = open(logfile, O_CREAT | O_WRONLY | O_APPEND, 0600);
if (logfd >= 0) {
char buf[512];
time_t t = time(NULL);
>Release-Note:
>Audit-Trail:
>Unformatted:
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-ports" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200106280712.f5S7CMo66476>