Subject: [41] ksh user access

From: [email-masked]
Date: Thu, 23 Jun 1994 12:19:14 -0600

Many thanks to your quick response for my question. As all of you
indicated that /etc/shell should define all shells remote user 
can use. Simply only BSD UNIX system seem to use that file here. I
found that on SunOS 4.x and Ultrix systems but no such file exists
on AIX, IRIX(SGI) and Solaris 2.x(SUN) --- three major architectures 
we use here. Built-in ftpd does don't use this file.

So the further question will be which file native ftpd uses and is there
a potential security hole here? Most SysV'ish UNIX sytems improved security
and reduced the exposure of some important system files.

Thanks again,

--Ward
     __________________________________________________
    /                     /                           /
   /  Ward Deng          /   Maui Project Office     /
  / (505)277-8339(w)    /   1601 Central Ave. NE    /
 / (505)277-8235(fax)  /   Albuquerque, NM 87131   /
/                     /                           /
\____________________/\__________________________/
/                                                \
\       E-mail: [email-masked]                 \
 \________________________________________________/

---

From: Ward Deng <[email-masked]>
Date: Thu, 23 Jun 1994 14:03:58 -0600

This is the most valuable suggestion I got from Bill Pemberton of UVa. Thank you,
Bill!

I re-built 2.4 wu-ftpd and it fixed the problem I had before. I hope it will be
an official patch for 2.4 version.

How about Solaris and IRIX? It should be done in the same way.

--Ward

On Jun 23,  2:51pm, Bill Pemberton wrote:
> Subject: Re: [41] ksh user access
> [email-masked] writes:
> >
> AIX has the valid shells in /etc/security/login.cfg .  I've got some code
> that emulates getusershell() for AIX.  This can be used in place of
> getusershell.c in the support directory.  You'll also have to link ftpd with
> the security library (-ls).
>
>
>
> /* emulate getusershell for AIX */
>
> #include <userconf.h>
> #include <usersec.h>
>
> static int GETUSERSHELL_opened=0;
> static char **GETUSERSHELL_shells;
> static int GETUSERSHELL_current;
>
>
> char *getusershell()
> {
> 	static char *val;
> 	static char *list;
> 	static char *retVal;
> 	int n;
>
> 	if (!GETUSERSHELL_opened)
> 	{
> 		if(getconfattr(SC_SYS_LOGIN,SC_SHELLS,(void *)&val,SEC_LIST))
> 		{
> 			return(NULL);
> 		}
> 		GETUSERSHELL_opened = 1;
> 		GETUSERSHELL_current = 0;
> 		list = val;
> 	}
>
> 	if ( (list != NULL) && (*list != NULL) )
> 	{
> 	while (list && *list)
> 		list++;
>
> 	*list = '\0';
>
> 	retVal = val;
> 	list++;
> 	val = list;
> 	}
> 	else
> 		retVal = NULL;
>
> 	return(retVal);
>
> }
>
> void setusershell()
> {
> 	GETUSERSHELL_opened = 0;
> }
>
> void endusershell()
> {
> 	GETUSERSHELL_opened = 0;
> }
>
>
>
>
>
>
>
>
> --
> Bill Pemberton                           [email-masked]
> ITC/Unix Systems                         [email-masked]
> University of Virginia                   uunet!virginia!wfp5p
>
>-- End of excerpt from Bill Pemberton