Patch-ID# 100201-06
Keywords: login rpc.yppasswdd rpc.pwdauthd
Synopsis: 4.1, 4.1_PSR_A, 4.1.1: c2 jumbo patch
Date: 05/Nov/92
 
SunOS release: 4.1 4.1_PSR_A 4.1.1
 
Unbundled Product:
 
Unbundled Release:
 
Topic: c2 jumbo patch
 
BugID'd fixed for this patch: 1059261 1043667 1040465 1044204 1040334 1047131 1049585 1058378 1063796 1085851 1097292

Changes incorporated in this -06 version: 1097292

Architectures for which this patch is available: sun3(x), sun4(c,490,390)

Patches which may conflict with this patch: 100138-02 This patch obsoletes patch 100138-02

Obsoleted by: BSM 1.0 or 4.1.2

Problem Description:

This patch contains the bug fixes for several bugs that were reported
in relation to C2 security. 

	login contains the bug fix related to password aging.
	The bug is due to the fact that the utility in libc that is used
        to read and parse passwd.adjunct does not parse the age field
        correctly. It always returns an empty field. login uses
        this utility to get the age field and does nothing with it.
        Therefore password aging is disabled. passwd does not have
        this problem because it reads and parses passwd.adjunct itself
        and uses the actual age field.


	rpc.pwdauthd contains the bug fix related to not being able to
	disable remote use of the daemon. It also allows the daemon to
	generate audit records using its own pseudo-user.

	rpc.yppasswdd contains the fix for the daemon mysteriously dying.
	It also allows the daemon to generate audit records using it's 
	own pseudo-user.

	rpc.yppasswdd contains the fix for using the same lockfile as
	vipw (i.e /etc/ptmp).

	rpc.yppasswdd contains the fix for passwd.adjunct file can get
	overwritten by yppasswd command when NIS and C2 is running. 

   	bug 1063796:
  	When running C2 with NIS, NIS client users will notice the result of 
	the yppasswd command would be effective immediately (it takes 5 mintues 	delay).

	bug 1058378:
	rpc.pwdauthd includes in its C2 audit log the cleartext
	password for every call, whether successful or not.

	For -05 version: bugid 1085851 -- a dynamically-linked program that 
	is executed by a setuid program has access to the callers environmental
	variables if the setuid program sets the real UID equal to the 
	effective UID and the real GID equal to the effective GID before the 
	dynamically-linked program is executed.

	For -06 version: bugid 1097292 -- rpc.pwdauthd's core image contains 
        plaintext passwords and passwd.adjunct file
	

FOR PROGRAMMERS ONLY:
 
Patch 100201-02 fixed many of the C2 auditing problems in SunOS 4.1, 4.1.1
For Compatibility sake, the fixes to login ,rpc.yppasswd and rpc.pwauthd were
statically linked to getauditflags.o and getpwaent.o two c library function calls
in libc. This eliminated the need to change libc for the patch to function.
The problem with this is customers who use libc's function of getauditflags or
getpwaent will get the origional version which exist in libc.
Supplying the getauditflags.o and getpwaent.o separate from libc for linking to
your application solves this problem.
You should link the new getauditflags.o and getpwaent.o to you application with
-lrpcsvc flag. 

Modified binaries:
	/bin/login
	/usr/etc/rpc.pwdauthd
	/usr/etc/rpc.yppasswdd

INSTALL:

NOTE: If you are not building applications which call getauditflags or getpwaent
      C library function calls, the getauditflags.o and getpwaent.o modules
      are not needed since they are statically linked into login, rpc.pwdauthd,
      and rpc.yppasswdd already. These modules can be ignored.
=============================================================================
= IF NIS is being run the new binaries need to be installed on all machines =
= in the domain. Additionally yppasswdd needs to be started in /etc/rc.local=
= edit /etc/rc.local and add in the following lines after the ypbind        =
= startup statements:                                                       =
=                                                                           =
#This starts yppasswd daemon and tells it to look for the passwd.adjunct file
rpc.yppasswdd /etc/passwd /etc/security/passwd.adjunct -m
= Also the NIS master maps should contain the AUpasswdd and AUyppasswdd     =
= as stated below                                                           =
=============================================================================

Generically for all systems:

***************************************************************************
* The following pseudo-users must be added to /etc/passwd and             *
* /etc/security/passwd.adjunct before changing any binaries               *
* This is so the auditing of the rpc.pwdauthd and rpc.yppasswd can occur  *
*                                                                         *
* /etc/passwd additions:                                                  *
* # Note: for systems not running NIS, the AUyppasswdd can be left out    *
*                                                                         *
*                                                                         *
AUpwdauthd:##AUpwdauthd:10:10:::/bin/false                                *
AUyppasswdd:##AUyppasswdd:11:10:::/bin/false                              *
*                                                                         *
*                                                                         *
*/etc/security/passwd.adjunct additions:                                  *
*                                                                         *
AUpwdauthd:*:::::                                                         *
AUyppasswdd:*:::::                                                        *
*                                                                         *
***************************************************************************

NOTE: If you are not running with C2 but want the fix for rpc.yppasswdd
      (bug id 1043667), you can skip the above passwd file additions and
      all you need is the rpc.yppasswdd binary. Please follow the following
      instruction for restoring rpc.yppasswdd.


 As root:
First save the FCS distribution versions as a precaution:

 # cp /bin/login /bin/login.orig
 # cp /usr/etc/rpc.pwdauthd /usr/etc/rpc.pwdauthd.orig
 # cp /usr/etc/rpc.yppasswdd /usr/etc/rpc.yppasswdd.orig



It is critical that the following steps be completed in single-user
mode, so that the rpc.pwdauthd and rpc.yppasswd daemons are both
disabled while the new versions are installed.

# shutdown now

 The new version of the binaries can now be installed. The 4.1 and 4.1.1
versions are identical except for the library version they are expecting
to dynamically link to. 

 Substitute either sun3 or sun4 for {arch} and either 4.1 or 4.1.1 for {OS rev}

# cp {arch}/{OS rev}/login /bin/login
# chown root /bin/login
# chmod 4755 /bin/login
# chgrp staff /bin/login

# cp {arch}/{OS rev}/rpc.pwdauthd /usr/etc/rpc.pwdauthd
# chown root /usr/etc/rpc.pwdauthd
# chgrp staff /usr/etc/rpc.pwdauthd
# chmod 755 /usr/etc/rpc.pwdauthd

# cp {arch}/{OS rev}/rpc.yppasswdd /usr/etc/rpc.yppasswdd 
# chown root /usr/etc/rpc.yppasswdd 
# chgrp staff /usr/etc/rpc.yppasswdd 
# chmod 755 /usr/etc/rpc.yppasswdd 


Double check permissions of the new files.
If the permissions are set wrong, or the wrong architecture type is installed,
login will not be able to occur except in single user mode 
(boot -s)
Note the example below does not show the size of the binary as the sun3 and sun4
versions are different size.

Doing a "file /bin/login" should tell you that it is a:

mc68020 demand paged dynamically linked executable not stripped
on a sun3, and a  :

sparc demand paged set-uid executable not stripped
on a sun4

 # ls -lg /bin/login
-rwsr-xr-x  1 root     staff      
 # ls -lg /usr/etc/rpc/rpc.pwdauthd
-rwxr-xr-x  1 root     staff       
 # ls -lg /usr/etc/rpc.yppasswdd
-rwxr-xr-x  1 root     staff      

Now you can either give a ^D (control D) from single user
mode or reboot the machine. This finishes the installation.

