I didn't see this, or anything similar to it in the archives, but please forgive me if it's well known: If a Solaris 2.6 host is a NIS+ client, and any user other than root is running CDE at the console, CDE's screen locking feature does not work. Any random string is sufficient to unlock to console. Obviously, this is not a root-compromise-from-the-network sort of bug, but it can be a problem if your machine is located somewhere physically insecure (university labs, for example). I made Sun aware of this a month ago, and there seems to be a bug ID opened by someone else even farther back (bug id 4115685). This is not fixed in any current release (up through Hardware 5/98 w/current patches). I don't have older versions to test this on, but I can reproduce it running 2.6 on a variety of hardware (email me if you care). Workaround: use /usr/openwin/bin/xlock instead of CDE's screenlock, stop using NIS+, stop using CDE. -- Daniel Bell Heuer's Law: Any feature is a bug unless it can be turned off.
This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 14:19:20 PDT