Subject: Re: Opie Looks Broken in VR15

From: wuftpd <[email-masked]>
Date: Tue, 2 Mar 1999 19:59:47 -0500 (EST)

Greg,

I did it from the VR15-source straight off your site...

I just grabbed VR14 and compiled with OPIE support and that works
fine....Cant get VR15 to work....

I just did a diff of VR14-ftpd.c and VR15-ftpd.c ..Over 300 lines
different. Shesh!....

Here is the problem....I figured it out...
Below is the code in question...
Basically, the code does a strcmp with xpassword.
Now, if you follow the code you will notice if 
the opieverify works it doesnt do the xpassword = crypt...
Now, later on the strcmp bombs out due to this.(I think!)
I put in 
xpasswd = crypt(passwd, pw->pw_passwd);
after the rval = 0;
line to force it anyway (since we have succeeded at this point, it doesnt
matter.)
and everything works fine.
I AM NO C Programmer , I only know enuff to do damage...

IS this correct or are we barking up the wrong tree?

Thanks
David

--------------------------------------------------------------------
In ftpd.c: 

#else /* OPIE */
        if(!opieverify(&opiestate, passwd))
            {
            rval = 0;
//Line by me...
	   xpasswd = crypt(passwd, pw->pw_passwd);A
            }
        else
            xpasswd = crypt(passwd, pw->pw_passwd);
#endif /* OPIE */
#ifdef ULTRIX_AUTH
        if ((numfails = ultrix_check_pass(passwd, xpasswd)) >= 0) {
#else
        /* The strcmp does not catch null passwords! */
      if (pw !=NULL && *pw->pw_passwd != '\0' &&
#ifdef HAS_PW_EXPIRE
          (pw->pw_expire && time(NULL) < pw->pw_expire) &&
#endif
          strcmp(xpasswd, pw->pw_passwd) == 0) {
#endif
            rval = 0;
           }
        if(rval){

On Tue, 2 Mar 1999, Gregory A Lundberg wrote:

> The man who did the changes also did a precompiled binary.  Is it that
> binary or did you compile from the source kit?
> 
> -- 
> 
> Gregory A Lundberg              Senior Partner, VRnet Company
> 1441 Elmdale Drive              [email-masked]
> Kettering, OH 45409-1615 USA    1-800-809-2195
>

---

From: Gregory A Lundberg <[email-masked]>
Date: Tue, 2 Mar 1999 20:58:16 -0500 (EST)

I'll read through your suggestion.  Actually, it's your comment about the
later strcmp failing which bothers me.  While he's on the open mailing
list, I'll make sure my Linux/OPIE man knows about your email.

--