Ticket History #303: System crash with login.krb5

From b17783@achilles.ctd.anl.gov Wed Dec 18 16:01:41 1996
Received: from MIT.EDU (PACIFIC-CARRIER-ANNEX.MIT.EDU [18.69.0.28]) by rt-11.MIT.EDU (8.7.5/8.7.3) with SMTP id QAA29263 for <bugs@RT-11.MIT.EDU>; Wed, 18 Dec 1996 16:01:41 -0500
Received: from achilles.ctd.anl.gov by MIT.EDU with SMTP
id AA22181; Wed, 18 Dec 96 16:01:41 EST
Received: from pembroke.ctd.anl.gov (pembroke.ctd.anl.gov [146.137.64.73]) by achilles.ctd.anl.gov (8.6.11/8.6.11) with ESMTP id PAA19832 for <krb5-bugs@mit.edu>; Wed, 18 Dec 1996 15:01:39 -0600
Received: (b17783@localhost) by pembroke.ctd.anl.gov (8.6.11/8.6.11) id PAA24050; Wed, 18 Dec 1996 15:01:32 -0600
Message-Id: <199612182101.PAA24050@pembroke.ctd.anl.gov>
Date: Wed, 18 Dec 1996 15:01:32 -0600
From: DEEngert@anl.gov
Reply-To: DEEngert@anl.gov
To: krb5-bugs@MIT.EDU
Subject: System crash with login.krb5
X-Send-Pr-Version: 3.99


Douglas E. Engert <DEEngert@anl.gov>
Argonne National Laboratory
9700 South Cass Avenue
Argonne, Illinois 60439
(630) 252-5444 <New Area Code 8/3/96>
PGP Key fingerprint = 20 2B 0C 78 43 8A 9C A6 29 F7 A3 6D 5E 30 A6 7F
AIX 4.1.4

System: AIX pembroke 1 4 000300234600


When krlogind or telnetd exec login.krb5 the machine hangs.
I have seen this in the past, and I have talked to Sam
about this. I thought it was fixed. But since I have been
using the IBM /usr/bin/login inplace of the login.krb5 on
AIX systems, with K5b6 and K5b7 I had not tried it.
it till today with the Krb5-1.0 released 12/09/96.

I believe it is a problem with mixing streams and none streams
routines within the pty routines.



For krlogind, replacing login.krb5 with a link to /usr/bin/login
allows the rlogin to work.


From: Sam Hartman <hartmans@MIT.EDU>
To: DEEngert@anl.gov
Cc: krb5-bugs@MIT.EDU
Subject: Re: pty/303: System crash with login.krb5
Date: 18 Dec 1996 20:08:10 -0500



I have never really been under that impression; I have
received a fix that someone claimed would work but it *shouldn't*
have changed things. Cygnus found an ioctl that was causing some
problems; I believe they commented it out on AIX, but will confirm
that made that into 1.0. However, the problems Cygnus was seeing were
different from the problem I was seeing. I appear to be seeing a
panic in the streams driver implementation of revoke().



It is not at all clear to me what you mean by a "streams"
routine. In particular, AIX4.1 does not define grantpt, unlockpt, or
any of the traditional Solaris routines. I do not push any streams
modules on the pty under AIX. The configure.in finds that AIX does
support streams, but it should not find any streams features that it
uses on AIX4.1. AIX4.2 is a totally different picture, which I am
fairly certain doesn't work as I don't have access to an AIX4.2 box,
nor has anyone sent reasonable patches. (There is one generic problem
in telnet that gets pointed out by AIX4.2, but I think that you will
have to do a bit more to get it working.)

I will look at this again, and see if the Cygnus fix got
integrated.




From: Doug Engert <DEEngert@anl.gov>
To: Sam Hartman <hartmans@MIT.EDU>
Cc: krb5-bugs@MIT.EDU
Subject: Re: pty/303: System crash with login.krb5
Date: Thu, 19 Dec 1996 09:39:34 -0600

Sam Hartman writes:

Sam,

I went back in my notes, and see that the AIX login.krb5 problem has
never been fixed (sorry about the reference above), only circumvented
by using the vendor's login. (A note from me to you on Jun 12 is the
last I have on the subject.)

With krb5-1.0 on the AIX 4.1.4 system , I have built it using
these options:
--with-cppopts='-DANL_DCE -DAFS524 -ULOGIN_CAP_F '

The -ULOGIN_CAP_F tells telnetd to use -f rather then -F.
Then by replacing login.krb5 with a link to /usr/bin/login,
both klogind and telnetd work. (I had problems with using the
-DLOGIN_PROGRAM=\"/usr/bin/login\" in configure, and wanted to do the
following for DCE also.)

So the new circumvention for AIX with krb5-1.0 could be:
configure with -ULOGIN_CAP_F and replace login.krb5 with a link to
/usr/bin/login.

For your information, I no longer need any mods in the src/appl
routines for DCE or AFS.

I have moved my klogind mods to a new routine, k5prelogin. I rename
login.krb5 to login.k5 and add a link for login.krb5->k5prelogin. This
now works with klogind and telnetd to use the forwarded ticket to get
a DCE context and/or an AFS token. (On the AIX system k5prelogin will
exec /usr/bin/login.)

The -DANL_DCE only applies to the kadmin/v5passwdd routines, to
not open the K5 database, but rather issue a dcecp command. So uses
cau use the CNS.EXE and/or v5passwd to change their DCE passwords.

The -DAFS524 only apply to the krb524 routines to use the the AFS
KeyFile for the V4 keys, and to map afsx/afscellname@k5realm to
afs@afscellname. This works with the ak5log.

--

Douglas E. Engert <DEEngert@anl.gov>
Argonne National Laboratory
9700 South Cass Avenue
Argonne, Illinois 60439
(630) 252-5444 <New Area Code 8/3/96>
PGP Key fingerprint = 20 2B 0C 78 43 8A 9C A6 29 F7 A3 6D 5E 30 A6 7F