* Use login.krb5 -f from klogind

* Allow login.krb5 -f to authorize root login.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@9135 dc483132-0cff-0310-8789-dd5450dbe970

diff --git a/src/appl/bsd/ChangeLog b/src/appl/bsd/ChangeLog
index 7c6ef6278a59911e65d5a4166af7a993c49bf8cd..44453312c2a06d6e5787a4ec80c39de01a7350a4 100644 (file)
--- a/src/appl/bsd/ChangeLog
+++ b/src/appl/bsd/ChangeLog
@@ -1,3 +1,14 @@
+Mon Sep 30 17:15:14 1996  Sam Hartman  <hartmans@mit.edu>
+
+       * login.c: Allow login -f to let you log in as root.
+
+Mon Sep 30 16:22:48 1996  Sam Hartman  <hartmans@tertius.mit.edu>
+
+       * login.c (stypeof): If TERM environment variable set, use it.
+
+       * krlogind.c (doit): Do not use login -E; no one supports it
+        besides login.krb5which also supports -f.
+
 Sun Sep 29 20:49:47 1996  Sam Hartman  <hartmans@mit.edu>
 
        * login.c: Fix so it works with --without-krb4 option

diff --git a/src/appl/bsd/krlogind.c b/src/appl/bsd/krlogind.c
index 2327ba85a73955bea977adc50ee21efbb868417b..d878e1ebaff309135a1fdc70b816d06768b2d3ee 100644 (file)
--- a/src/appl/bsd/krlogind.c
+++ b/src/appl/bsd/krlogind.c
@@ -45,7 +45,7 @@ char copyright[] =
  * 3) Prompt for password if any checks fail, or if so configured.
  * Allow login if all goes well either by calling the accompanying 
  * login.krb5 or /bin/login, according to the definition of 
- * DO_NOT_USE_K_LOGIN.
+ * DO_NOT_USE_K_LOGIN.l
  * 
  * The configuration is done either by command-line arguments passed by 
  * inetd, or by the name of the daemon. If command-line arguments are
@@ -94,7 +94,7 @@ char copyright[] =
  */
 #define LOG_REMOTE_REALM
 #define CRYPT
-
+#define USE_LOGIN_F
 
 #ifdef HAVE_UNISTD_H
 #include <unistd.h>
@@ -507,8 +507,8 @@ struct winsize win = { 0, 0, 0, 0 };
 int pid; /* child process id */
 
 void doit(f, fromp)
-     int f;
-     struct sockaddr_in *fromp;
+  int f;
+  struct sockaddr_in *fromp;
 {
     int p, t, on = 1;
     register struct hostent *hp;
@@ -622,7 +622,7 @@ int syncpipe[2];
 
 #if defined(POSIX_TERMIOS) && !defined(ultrix)
        tcgetattr(t,&new_termio);
-#if !(defined(DO_NOT_USE_K_LOGIN)&&defined(USE_LOGIN_F))
+#if !defined(USE_LOGIN_F)
        new_termio.c_lflag &=  ~(ICANON|ECHO|ISIG|IEXTEN);
        new_termio.c_iflag &= ~(IXON|IXANY|BRKINT|INLCR|ICRNL);
 #else
@@ -714,7 +714,6 @@ int syncpipe[2];
        }
 #endif
 
-#ifdef DO_NOT_USE_K_LOGIN
 #ifdef USE_LOGIN_F
 /* use the vendors login, which has -p and -f. Tested on 
  * AIX 4.1.4 and HPUX 10 
@@ -735,12 +734,6 @@ int syncpipe[2];
 #else /* USE_LOGIN_F */
        execl(login_program, "login", "-r", rhost_name, 0);
 #endif /* USE_LOGIN_F */
-#else
-       if (passwd_req)
-         execl(login_program, "login","-h", rhost_name, lusername, 0);
-       else
-         execl(login_program, "login", "-h", rhost_name, "-e", lusername, 0);
-#endif
        
        fatalperror(2, login_program);
        /*NOTREACHED*/
@@ -791,12 +784,10 @@ int syncpipe[2];
 #endif
 
     
-#if defined(DO_NOT_USE_K_LOGIN)&&!defined(USE_LOGIN_F)
+#if!defined(USE_LOGIN_F)
     /* Pass down rusername and lusername to login. */
     (void) write(p, rusername, strlen(rusername) +1);
     (void) write(p, lusername, strlen(lusername) +1);
-#endif
-#if !defined(DO_NOT_USE_K_LOGIN) || !defined(USE_LOGIN_F) 
     /* stuff term info down to login */
     if ((write(p, term, strlen(term)+1) != (int) strlen(term)+1)) {
        /*
@@ -805,7 +796,8 @@ int syncpipe[2];
        sprintf(buferror,"Cannot write slave pty %s ",line);
        fatalperror(f,buferror);
     }
-#endif /* DO_NOT_USE_K_LOGIN && USE_LOGIN_F */
+
+#endif
     protocol(f, p);
     signal(SIGCHLD, SIG_IGN);
     cleanup();

diff --git a/src/appl/bsd/login.M b/src/appl/bsd/login.M
index b6ea951d36cc39dd47b6fcd17ab3497875041e07..0603d16bd2a752d3cbcb97db8a48b1a45cddce86 100644 (file)
--- a/src/appl/bsd/login.M
+++ b/src/appl/bsd/login.M
@@ -39,7 +39,7 @@ pass hostname to rlogind.
 pass hostname to telnetd, etc.
 .TP
 \fB\-f\fP \fIname\fP
-Perform pre-authenticated login, e.g., datakit, xterm, etc.; does not
+Perform pre-authenticated login, e.g., datakit, xterm, etc.; 
 allow preauthenticated login as root.
 .TP
 \fB\-F\fP \fIname\fP

diff --git a/src/appl/bsd/login.c b/src/appl/bsd/login.c
index 93573a48c9bb922d6a0845dc1d0f4147547a149d..7514310cfc9db1144db72f5f02c761531a61799c 100644 (file)
--- a/src/appl/bsd/login.c
+++ b/src/appl/bsd/login.c
@@ -63,7 +63,7 @@ int login_accept_passwd = 0;
  * login -r hostname   (for rlogind)
  * login -h hostname   (for telnetd, etc.)
  * login -f name       (for pre-authenticated login: datakit, xterm, etc.,
- *                      does not allow preauthenticated login as root)
+ *                      does allow preauthenticated login as root)
  * login -F name       (for pre-authenticated login: datakit, xterm, etc.,
  *                      allows preauthenticated login as root)
  * login -e name       (for pre-authenticated encrypted, must do term
@@ -1078,7 +1078,7 @@ afs_cleanup ()
 }
 \f
 /* Main routines */
-#define EXCL_AUTH_TEST if (rflag || kflag || Kflag || eflag || fflag || Fflag ) { \
+#define EXCL_AUTH_TEST if (rflag || kflag || Kflag || eflag || fflag ) { \
                                fprintf(stderr, \
                                    "login: only one of -r, -k, -K, -e, -F, and -f allowed.\n"); \
                                exit(1);\
@@ -1148,7 +1148,7 @@ int main(argc, argv)
        struct group *gr;
        int ch;
        char *p;
-       int fflag, hflag, pflag, rflag, Fflag, cnt;
+       int fflag, hflag, pflag, rflag, cnt;
        int kflag, Kflag, eflag;
        int quietlog, passwd_req, ioctlval;
        sigtype timedout();
@@ -1199,7 +1199,7 @@ int rewrite_ccache = 1; /*try to write out ccache*/
        (void)gethostname(tbuf, sizeof(tbuf));
        domain = strchr(tbuf, '.');
 
-       Fflag = fflag = hflag = pflag = rflag = kflag = Kflag = eflag = 0;
+        fflag = hflag = pflag = rflag = kflag = Kflag = eflag = 0;
        passwd_req = 1;
        while ((ch = getopt(argc, argv, "Ffeh:pr:k:K:")) != EOF)
                switch (ch) {
@@ -1209,7 +1209,7 @@ int rewrite_ccache = 1; /*try to write out ccache*/
                        break;
                case 'F':
                        EXCL_AUTH_TEST;
-                       Fflag = 1;
+                       fflag = 1;
                        break;
                case 'h':
                        EXCL_HOST_TEST;
@@ -1364,7 +1364,7 @@ int rewrite_ccache = 1; /*try to write out ccache*/
 #endif /* KRB5_GET_TICKETS */
 
                if (username == NULL) {
-                       fflag = Fflag = 0;
+                       fflag = 0;
                        getloginname();
                }
 
@@ -1374,23 +1374,13 @@ int rewrite_ccache = 1; /*try to write out ccache*/
                if (pwd == NULL || pwd->pw_uid)
                        checknologin();
 
-               /*
-                * Disallow automatic login to root.
-                * If not invoked by root, disallow if the uid's differ.
-                */
-               if (fflag && pwd) {
-                       int uid = (int) getuid();
-
-                       passwd_req =
-                           (pwd->pw_uid == 0 || (uid && uid != pwd->pw_uid));
-               }
 
                /*
                 * Allows automatic login by root.
                 * If not invoked by root, disallow if the uid's differ.
                 */
 
-               if (Fflag && pwd) {
+               if (fflag && pwd) {
                        int uid = (int) getuid();
                        passwd_req = (uid && uid != pwd->pw_uid);
                }
@@ -1906,7 +1896,7 @@ int rewrite_ccache = 1; /*try to write out ccache*/
 
        if (!quietlog) {
 #ifdef KRB4_KLOGIN
-               if (!krbflag && !fflag && !Fflag && !eflag )
+               if (!krbflag && !fflag && !eflag )
                    printf("\nWarning: No Kerberos tickets obtained.\n\n");
 #endif /* KRB4_KLOGIN */
                motd ();
@@ -2223,14 +2213,19 @@ void dolastlog(quiet, tty)
 
 char *
 stypeof(ttyid)
-       char *ttyid;
+  char *ttyid;
 {
+char *cp = getenv("term");
+
 #ifndef HAVE_TTYENT_H
-       return(UNKNOWN);
+if (cp)
+  return cp;
+else return(UNKNOWN);
 #else
        struct ttyent *t;
-
-       return(ttyid && (t = getttynam(ttyid)) ? t->ty_type : UNKNOWN);
+       if (cp)
+         return cp;
+ else return(ttyid && (t = getttynam(ttyid)) ? t->ty_type : UNKNOWN);
 #endif
 }