Re: [owl-users] tcb and friends with shadow-utils 4.0.12

From: Solar Designer (solar@private)
Date: Sat Jul 01 2006 - 18:40:26 PDT


On Sat, Jul 01, 2006 at 02:25:25PM -0600, Vincent Danen wrote:
> I'm working towards integrating tcb fully into Annvix here ...

Great!

We definitely want our stuff to be accepted by other distributions.

> The problem I'm having is with passwd; it's segfaulting on me when I try
> to change a password.  I've got my /etc/pam.d/system-auth nearly
> identical to the openwall one (in Owl/packages/pam/system-auth.pam):
[...skipped...]

It looks OK to me.

> A few things I noticed, and I was originally trying to stick pam_tcb in
> there as a replacement for pam_unix, which is why I kept the last
> pam_deny.so call in there.  Of course, with pam_unix this works ok, but
> with pam_tcb it doesn't, so I had to remove it.  Does pam_tcb negate the
> need for pam_deny?

I don't understand why pam_deny could be needed there at all.

> Anyways, my big problem here is with passwd segfaulting when I try to
> change my password

I'm afraid that you'll have to debug the segfault.  Even if it's caused
by misconfiguration, this suggests that you have a bug in some C code,
perhaps in the passwd program itself.

> I've changed perms, so that /etc/shadow is owned root:shadow and mode
> 0440.

Once you fully migrate your system to tcb, you should remove /etc/shadow.

> I've used tcb_convert to enable my tcb filesl my /etc/tcb files
> are owned [user]:auth, and the directories are all sgid auth.  My own
> shadow file (/etc/tcb/vdanen) is owned vdanen:auth and is 640.

That's correct.

> I'm wondering if I missed a patch to passwd perhaps?

No, tcb does not require a patch to passwd.

> We use a separate
> passwd package that provides just passwd itself (it's the freebsd passwd
> with pam support).  I noticed passwd isn't in the owl shadow-utils
> package (in fact, I'm at a loss as to which package in openwall is
> providing passwd since I don't see it it in util-linux either).

We use the implementation from SimplePAMApps with our modifications (not
related to the use of tcb):

	http://cvsweb.openwall.com/cgi/cvsweb.cgi/Owl/packages/SimplePAMApps/

SimplePAMApps is a package that provides small PAM-only implementations
of login, passwd, and su.  It is essentially unmaintained upstream - so
we're maintaining it ourselves.  (Maybe we should be making releases of
"our" SimplePAMApps separately from Owl.)

> It's good that auth works... it means I'm heading in the right
> direction.  Hmmm... wait.. looks like it's wanting to use /etc/shadow
> regardless of the USE_TCB setting in login.defs

The USE_TCB setting is for the shadow suite utilities only (such as
useradd, etc.)

> (unless it requires the shadow file to exist still?).

With proper configuration, it should not.

> Hmmm... do I need to put tcb into the shadow line in /etc/nsswitch.conf?

Yes, you do.  We have:

passwd:     files nisplus nis
shadow:     tcb nisplus nis
# To not use tcb, replace the "tcb" with "files":
#shadow:    files nisplus nis
group:      files nisplus nis

> Ok, looks like I need to have "files tcb bla..." in the nsswitch.conf;

Not exactly.  You replace "files" with "tcb" - but you do that on the
"shadow" line only.

> /usr/bin/passwd is sgid shadow.

That's correct.  We have it like this:

-rwx--s--x 1 root shadow 6884 2006-05-06 03:56 /usr/bin/passwd

> Oh, all I did was add three groups:  auth, shadow, and chkpwd (gid's 27,
> 28, and 29 respectively).  Are any users required to operate things?  I
> didn't notice anything looking through the slides and spec files.

No, you only needed to add the groups.

> The following are the patches I took and rediffed from the openwall
> shadow-utils package:
> 
> Patch4:         shadow-4.0.12-avx-man.patch
> Patch6:         shadow-4.0.12-avx-crypt_gensalt.patch
> Patch7:         shadow-4.0.12-avx-usergroupname_max.patch
> Patch8:         shadow-4.0.12-avx-tcb.patch

If those patches are derived from ours, you could want to give due
credit to our project by not dropping the "-owl-" from the filenames.
Under our conventions, if we were the maintainers of Annvix, the
filenames would be shadow-4.0.12-owl-avx-tcb.diff and the like.

Thanks,

-- 
Alexander Peslyak <solar at openwall.com>
GPG key ID: B35D3598  fp: 6429 0D7E F130 C13E C929  6447 73C3 A290 B35D 3598
http://www.openwall.com - bringing security into open computing environments



This archive was generated by hypermail 2.1.3 : Sat Jul 01 2006 - 18:42:24 PDT