From b17783@achilles.ctd.anl.gov Wed Dec 18 16:01:41 1996 Received: from MIT.EDU (PACIFIC-CARRIER-ANNEX.MIT.EDU [18.69.0.28]) by rt-11.MIT.EDU (8.7.5/8.7.3) with SMTP id QAA29263 for ; Wed, 18 Dec 1996 16:01:41 -0500 Received: from achilles.ctd.anl.gov by MIT.EDU with SMTP id AA22181; Wed, 18 Dec 96 16:01:41 EST Received: from pembroke.ctd.anl.gov (pembroke.ctd.anl.gov [146.137.64.73]) by achilles.ctd.anl.gov (8.6.11/8.6.11) with ESMTP id PAA19832 for ; Wed, 18 Dec 1996 15:01:39 -0600 Received: (b17783@localhost) by pembroke.ctd.anl.gov (8.6.11/8.6.11) id PAA24050; Wed, 18 Dec 1996 15:01:32 -0600 Message-Id: <199612182101.PAA24050@pembroke.ctd.anl.gov> Date: Wed, 18 Dec 1996 15:01:32 -0600 From: DEEngert@anl.gov Reply-To: DEEngert@anl.gov To: krb5-bugs@MIT.EDU Subject: System crash with login.krb5 X-Send-Pr-Version: 3.99 >Number: 303 >Category: pty >Synopsis: System crash with login.krb5 >Confidential: no >Severity: serious >Priority: medium >Responsible: hartmans >State: open >Class: sw-bug >Submitter-Id: unknown >Arrival-Date: Wed Dec 18 16:02:01 EST 1996 >Last-Modified: Fri Sep 14 10:23:40 EDT 2001 >Originator: Douglas E. Engert >Organization: Douglas E. Engert Argonne National Laboratory 9700 South Cass Avenue Argonne, Illinois 60439 (630) 252-5444 PGP Key fingerprint = 20 2B 0C 78 43 8A 9C A6 29 F7 A3 6D 5E 30 A6 7F >Release: 1.0 >Environment: AIX 4.1.4 System: AIX pembroke 1 4 000300234600 >Description: When krlogind or telnetd exec login.krb5 the machine hangs. I have seen this in the past, and I have talked to Sam about this. I thought it was fixed. But since I have been using the IBM /usr/bin/login inplace of the login.krb5 on AIX systems, with K5b6 and K5b7 I had not tried it. it till today with the Krb5-1.0 released 12/09/96. I believe it is a problem with mixing streams and none streams routines within the pty routines. >How-To-Repeat: >Fix: For krlogind, replacing login.krb5 with a link to /usr/bin/login allows the rlogin to work. >Audit-Trail: From: Sam Hartman To: DEEngert@anl.gov Cc: krb5-bugs@MIT.EDU Subject: Re: pty/303: System crash with login.krb5 Date: 18 Dec 1996 20:08:10 -0500 >>>>> "DEEngert" == DEEngert writes: >> Description: DEEngert> When krlogind or telnetd exec login.krb5 the machine DEEngert> hangs. I have seen this in the past, and I have talked DEEngert> to Sam about this. I thought it was fixed. But since I DEEngert> have been using the IBM /usr/bin/login inplace of the DEEngert> login.krb5 on AIX systems, with K5b6 and K5b7 I had not DEEngert> tried it. it till today with the Krb5-1.0 released DEEngert> 12/09/96. I have never really been under that impression; I have received a fix that someone claimed would work but it *shouldn't* have changed things. Cygnus found an ioctl that was causing some problems; I believe they commented it out on AIX, but will confirm that made that into 1.0. However, the problems Cygnus was seeing were different from the problem I was seeing. I appear to be seeing a panic in the streams driver implementation of revoke(). DEEngert> I believe it is a problem with mixing streams and none DEEngert> streams routines within the pty routines. It is not at all clear to me what you mean by a "streams" routine. In particular, AIX4.1 does not define grantpt, unlockpt, or any of the traditional Solaris routines. I do not push any streams modules on the pty under AIX. The configure.in finds that AIX does support streams, but it should not find any streams features that it uses on AIX4.1. AIX4.2 is a totally different picture, which I am fairly certain doesn't work as I don't have access to an AIX4.2 box, nor has anyone sent reasonable patches. (There is one generic problem in telnet that gets pointed out by AIX4.2, but I think that you will have to do a bit more to get it working.) I will look at this again, and see if the Cygnus fix got integrated. >> Audit-Trail: Unformatted: From: Doug Engert To: Sam Hartman Cc: krb5-bugs@MIT.EDU Subject: Re: pty/303: System crash with login.krb5 Date: Thu, 19 Dec 1996 09:39:34 -0600 Sam Hartman writes: > >>>>> "DEEngert" == DEEngert writes: > > >> Description: > DEEngert> When krlogind or telnetd exec login.krb5 the machine > DEEngert> hangs. I have seen this in the past, and I have talked > DEEngert> to Sam about this. I thought it was fixed. But since I > DEEngert> have been using the IBM /usr/bin/login inplace of the > DEEngert> login.krb5 on AIX systems, with K5b6 and K5b7 I had not > DEEngert> tried it. it till today with the Krb5-1.0 released > DEEngert> 12/09/96. > > I have never really been under that impression; I have > received a fix that someone claimed would work but it *shouldn't* > have changed things. Cygnus found an ioctl that was causing some > problems; I believe they commented it out on AIX, but will confirm > that made that into 1.0. However, the problems Cygnus was seeing were > different from the problem I was seeing. I appear to be seeing a > panic in the streams driver implementation of revoke(). > Sam, I went back in my notes, and see that the AIX login.krb5 problem has never been fixed (sorry about the reference above), only circumvented by using the vendor's login. (A note from me to you on Jun 12 is the last I have on the subject.) With krb5-1.0 on the AIX 4.1.4 system , I have built it using these options: --with-cppopts='-DANL_DCE -DAFS524 -ULOGIN_CAP_F ' The -ULOGIN_CAP_F tells telnetd to use -f rather then -F. Then by replacing login.krb5 with a link to /usr/bin/login, both klogind and telnetd work. (I had problems with using the -DLOGIN_PROGRAM=\"/usr/bin/login\" in configure, and wanted to do the following for DCE also.) So the new circumvention for AIX with krb5-1.0 could be: configure with -ULOGIN_CAP_F and replace login.krb5 with a link to /usr/bin/login. For your information, I no longer need any mods in the src/appl routines for DCE or AFS. I have moved my klogind mods to a new routine, k5prelogin. I rename login.krb5 to login.k5 and add a link for login.krb5->k5prelogin. This now works with klogind and telnetd to use the forwarded ticket to get a DCE context and/or an AFS token. (On the AIX system k5prelogin will exec /usr/bin/login.) The -DANL_DCE only applies to the kadmin/v5passwdd routines, to not open the K5 database, but rather issue a dcecp command. So uses cau use the CNS.EXE and/or v5passwd to change their DCE passwords. The -DAFS524 only apply to the krb524 routines to use the the AFS KeyFile for the V4 keys, and to map afsx/afscellname@k5realm to afs@afscellname. This works with the ak5log. -- Douglas E. Engert Argonne National Laboratory 9700 South Cass Avenue Argonne, Illinois 60439 (630) 252-5444 PGP Key fingerprint = 20 2B 0C 78 43 8A 9C A6 29 F7 A3 6D 5E 30 A6 7F >Unformatted: