[Pkg-shadow-devel] Bug#505071: Bug#505071: closed ... fixed in shadow 1:4.1.3-1

[Paul Szabo]

Dear Nicolas,

Comments on (snippet of code comments, and your words):

>>  	 * but users must "exec login" which will use the existing utmp
>>  	 * entry (will not overwrite remote hostname).  --marekm
>
> My point would be: In case login is setuid, shall we require that it is
> called with "exec login". That would be my preference.
>
> Then, how to enforce this? (note the point is not to enforce this is all
> cases, but to make sure regular user will not leave a opened session).

If login is not setuid then it cannot be used in that fashion anyway.
So this is not about current Debian or Ubuntu.

In my experience, if users want something, they will get it with some
"worse" means. If we do not let them run login directly, then they will
run telnet instead which is probably much more wasteful; they will not
use "exec login" or su, because are not familiar with those. There is
not much point in protecting users from own foolishness.

But mainly, "exec login" cannot possibly work in a PAM environment, but
will fail/die and "lose" the user session; users should not be tricked
into doing that. Presumably the user logged in with login (e.g. telnet,
may not apply for ssh or xterm); then login done a fork before running
the shell; any utmp entry refers to the PID of the parent login.
Incidentally, seems rather wasteful to have login waiting to
pam_close_session and telnetd waiting to clear utmp.

Cheers, Paul

Paul Szabo   psz at maths.usyd.edu.au   http://www.maths.usyd.edu.au/u/psz/
School of Mathematics and Statistics   University of Sydney    Australia