Content-Type: text/plain Content-Disposition: inline Content-Transfer-Encoding: binary MIME-Version: 1.0 X-Mailer: MIME-tools 5.411 (Entity 5.404) X-RT-Original-Encoding: iso-8859-1 Content-Length: 4236 From thomas@pongo.cs.wisc.edu Tue Sep 5 15:27:18 2000 Received: from MIT.EDU (SOUTH-STATION-ANNEX.MIT.EDU [18.72.1.2]) by rt-11.mit.edu (8.9.3/8.9.3) with SMTP id PAA25874 for ; Tue, 5 Sep 2000 15:27:17 -0400 (EDT) Received: from pongo.cs.wisc.edu by MIT.EDU with SMTP id AA24848; Tue, 5 Sep 00 15:26:45 EDT Received: from pongo.cs.wisc.edu (localhost [127.0.0.1]) by pongo.cs.wisc.edu (8.9.2/8.9.2) with ESMTP id OAA07234 for ; Tue, 5 Sep 2000 14:27:16 -0500 (CDT) Message-Id: <200009051927.OAA07234@pongo.cs.wisc.edu> Date: Tue, 05 Sep 2000 14:27:16 -0500 From: David Thompson To: krb5-bugs@MIT.EDU Subject: telnetd doesn't chown ticket file >Number: 883 >Category: telnet >Synopsis: telnetd doesn't chown ticket file >Confidential: yes >Severity: serious >Priority: medium >Responsible: tlyu >State: open >Class: sw-bug >Submitter-Id: unknown >Arrival-Date: Tue Sep 5 15:28:01 EDT 2000 >Last-Modified: Wed Feb 07 15:45:00 EST 2001 >Originator: Dave Thompson >Organization: Dave Thompson Associate Researcher Department of Computer Science University of Wisconsin-Madison http://www.cs.wisc.edu/~thomas 1210 West Dayton Street Phone: (608)-262-1017 Madison, WI 53706-1685 Fax: (608)-262-6626 >Release: >Environment: >Description: On a linux build of krb5-1.2.1, using the -l option of telnet causes problems. For example, with a ticket for 'usera', running: % telnet -a -F -l userb fails with: Trying a.b.c.d... Connected to .cs.wisc.edu (a.b.c.d). Escape character is '^]'. [ Kerberos V5 accepts you as ``usera@CS.WISC.EDU'' ] [ Kerberos V5 accepted forwarded credentials ] Password for userb: Last login: Tue Sep 5 14:02:49 from operator: unknown RPC error (-1765328188) when initializing cache k5token: unknown RPC error (-1765328190) failure on principal Connection closed by foreign host. In 1.2.1, when telnetd passes the ticket cache on to login.krb5, the ticket cache is still owned by root. When login.krb5 tries to delete the cache and recreate it (as userb), it fails, and things fall apart rapidly after that. Restoring the 'chown' at the bottom of .../appl/telnet/libtelnet/forward.c that was removed from 1.0 to 1.2.1 allows the login to work. However, I assume there was a reason why the chown was removed. Is there a better fix for this problem? >How-To-Repeat: >Fix: >Audit-Trail: Responsible-Changed-From-To: gnats-admin->tlyu Responsible-Changed-By: tlyu Responsible-Changed-When: Wed Feb 7 15:39:00 2001 Responsible-Changed-Why: refiled From: Tom Yu To: thomas@cs.wisc.edu Cc: krb5-bugs@MIT.EDU Subject: Re: telnet/883: telnetd doesn't chown ticket file Date: Wed, 7 Feb 2001 15:44:47 -0500 (EST) >>>>> "DT" == David Thompson writes: DT> operator: unknown RPC error (-1765328188) when initializing cache DT> k5token: unknown RPC error (-1765328190) failure on principal These error messages should not be printed by the login.krb5 that comes with MIT krb5. What login.krb5 program is actually getting run by telnetd? I suspect there may be a mismatch between your telnetd and login.krb5. DT> In 1.2.1, when telnetd passes the ticket cache on to login.krb5, the ticket DT> cache is still owned by root. When login.krb5 tries to delete the cache DT> and recreate it (as userb), it fails, and things fall apart rapidly DT> after that. Can you diagnose why it fails? As I said above, it's probably a mismatch between telnetd and login.krb5 programs. DT> Restoring the 'chown' at the bottom of DT> .../appl/telnet/libtelnet/forward.c that was removed from 1.0 to 1.2.1 DT> allows the login to work. However, I assume there was a reason why DT> the chown was removed. Is there a better fix for this problem? The chown was removed because it is a security hole in some cases where a naive vendor login may want to access the ccache as root. There is compensating code that should write out the ccache as the user. ---Tom >Unformatted: -- --