Subject: Locking Keyboard Problem

From: "John J. Guettler" <[email-masked]>
Date: Wed, 3 Mar 1993 12:33:44 -0500 (EST)

I've just discovered that if I use the lock keyboard option, pine will not
accept my correct password to unlock the keyboard, and I have to break my
connection to force myself off the system.

I'm also having a similar problem with the imapd in the pine distribution.
It will not take a correct password, either.  I've telnet-ed to the imap
port and tried entering the command by hand, but it responds with bad
username or password.

My system is a DECstation 5000/25 running ULTRIX V4.2A.  I'm also running
at ENHANCED security level.  Could this be causing the problem?

	John J. Guettler
	Saginaw Valley State University
	University Center, MI  48710

---

From: Mark Crispin <[email-masked]>
Date: Wed, 3 Mar 1993 10:25:46 -0800 (PST)

> at ENHANCED security level.  Could this be causing the problem?

That is almost certainly the problem.  Depending upon how ``secure'' your
system is, it may be impossible for an unprivileged task to verify a password.

The most common situation is that of ``shadow password files''.  This takes
the password information out of the password file and puts it in another file
that is supposed to have much stronger protection than the password file.

There are about as many different incompatible implementations of shadow
passwords as there are of UNIX.  Worse, even in the same flavor of UNIX there
are different implementations.  Some implementations are almost invisible; you
only need to relink Pine and imapd and everything will work.  Others require
code changes.  And in some of these, you simply can not win unless you have
root privileges.

All this to get around having a system call to validate passwords the way
other operating systems do...  :-(

The first thing to do in fixing the problem is to figure out what ENHANCED
security really means.  On ULTRIX 4.2A, try the following edits:

1) In c-client/makefile.ult, change the definition of LDFLAGS to be
	LDFLAGS = -lauth

2) In c-client/os_ult.h, add the line
	#include <auth.h>
   somewhere reasonable

3) In c-client/os_ult.c, in the routine server_login(), add the declaration
	struct authorization *au;
   and change the password test (the line after the comment ``validate
   password'') to be:
	if (!(au = getauthuid (pw->pw_uid)) ||
	    strcmp (au->a_password,crypt16 (pass,au->a_password)))
	  return NIL;		/* no shadow password or doesn't match */

Then rebuild.  You should get a working imapd out of this.  You may be able to
do something similar in Pine, depending upon how shadow passwords are
implemented -- as I said in some systems unprivileged processes are not
permitted to validate passwords.  imapd is alright since server_login() is
only called when imapd is not logged in (and thus is running with ID 0, giving
it root access).

-- Mark --

---

From: "Steven D. Majewski" <[email-masked]>
Date: Wed, 3 Mar 1993 14:02:14 +22306404 (EST)

> at ENHANCED security level.  Could this be causing the problem?

I've never seen those problems on either a Sun or an IBM-RS6000, so my
guess is yes - ENHANCED security is causing the problem. 

But I have no idea what that option does and I don't have a DECstation 
to try to duplicate it. 

===============================================================================
 Steven D. Majewski			University of Virginia 
 [email-masked]			Box 449 Health Sciences Center
 Voice: (804)-982-0831			1300 Jefferson Park Avenue
 FAX:   (804)-982-1616			Charlottesville, VA 22908

---

From: Erik Lawaetz <[email-masked]>
Date: Thu, 4 Mar 1993 09:11:49 +0100 (MET)

> guess is yes - ENHANCED security is causing the problem. 

You'll experience the same problem with SunOS, but SUN's approach
makes it a lot easier to patch than Ultrix.

--Erik