Subject: pam on solaris

From: Charles Bruneteau <[email-masked]>
Date: Wed, 28 Apr 1999 15:58:32 +0200

hi,

i compiled recently the VR17 on solaris 2.6 using the pam authentication
flag (USE_PAM) that was in the linux config. It seems to work very well
but i haven't  seen anything about this on the list; have someone tested
it ?

Charles Bruneteau

---

From: Gregory A Lundberg <[email-masked]>
Date: Wed, 28 Apr 1999 10:18:26 -0400 (EDT)

On Wed, 28 Apr 1999, Charles Bruneteau wrote:

> i compiled recently the VR17 on solaris 2.6 using the pam
> authentication flag (USE_PAM) that was in the linux config. It seems
> to work very well but i haven't seen anything about this on the list;
> have someone tested it?

You.

-- 

Gregory A Lundberg              Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195

---

From: Nellie Lee <[email-masked]>
Date: Thu, 29 Apr 1999 00:59:23 +1000

Hi,
Sorry if my questions seems a bit silly but I've only just started along the
Unix path a few months ago, at what point do you specify the USE_PAM flag.

On another note, I remember reading a previous question about using shadow
support. How can I verify that I am using shadow support with wu-ftpd, I've
just recently compiled wu-ftpd 2.4.2 vr17 on solaris 2.6 as per the INSTALL
instructions and everything seems fine although I would be interested in
knowing more about what options/flags I can set. The INSTALL file doesn't
specify this (I could be wrong here)

Thanks in advance

Nellie

---

From: Brett Goldstock <[email-masked]>
Date: Wed, 28 Apr 1999 12:06:45 -0400

I'm getting syslogs messages from ftpd that I don't understand.

ftpd[20693]: sleeping: fcntl lock of pid file failed: Resource 
temporarily unavailable

These can occur several times a day. Should I be concerned?

Also, I was wondering about these messages:

ftpd[798]: getpeername (/bin/ftpd): Connection reset by peer

This doesn't sound too bad. Is it?

I'm running wu-2.4.2-academ[BETA-18-VR14] under Solaris 2.5.1.

-Brett

|Brett M. Goldstock                               [email-masked]|
|Senior Technical Analyst/Sys Admin          http://www.tvdata.com|
|TVData                                               800/833-9581|
|                "We tell the world what's on TV."                |

---

From: Gregory A Lundberg <[email-masked]>
Date: Wed, 28 Apr 1999 12:22:12 -0400 (EDT)

On Wed, 28 Apr 1999, Brett Goldstock wrote:

> ftpd[20693]: sleeping: fcntl lock of pid file failed: Resource  temporarily unavailable
> 

Maybe, but probably not.  If your system is heavily used, you should see
these.  If it's normally idle, something might be wrong.

If the messages are annoying, there's a compile-time option in VR17 to
suppress them.  (Might be in VR14 you're running, don't remember when I
put it in.)

> This doesn't sound too bad. Is it?

No.  Someone went away leaving the TCP connection half-open.

There are some attacks which do this.  If you're seeing it very often, get
a packet sniffer and take a look at what's being dropped on you.  Often
times it's just lousy network connections, but it pays to be paranoid.
Check with your vendor, CERT and Bugtraq sites; if your kernel is
vulnerable to half-open TCP attacks (ie., older Linux .. dunno about
Solaris) look for vendor patches to harden the system.

-- 

Gregory A Lundberg              Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195

---

From: Charles Bruneteau <[email-masked]>
Date: Thu, 29 Apr 1999 13:59:31 +0200

> > but i haven't  seen anything about this on the list; have someone tested

this is not in the INSTALL procedure. I saw a note about pam for linux boxes in

FIXES-2.4.2-VR17 : "Added PAM support for Linux". I created a new platform
configuration from "sol" and "lnx" (just as point 1b in INSTALL file) :
./src/config/config.so2

------------------------------
/*
 * config.h for Solaris 2.X with PAM
 *
 * $Id: config.sol,v 1.13 1999/02/26 16:09:15 sob RELEASE sob $
 */
#define HAVE_SYMLINK
#undef  F_SETOWN
#define HAVE_DIRENT
#define HAVE_D_NAMLEN
#undef  HAVE_FLOCK
#define HAVE_FTW
#define HAVE_GETCWD
#undef  HAVE_GETDTABLESIZE
#define HAVE_GETRLIMIT
#undef  HAVE_PSTAT
#define HAVE_STATVFS
#define HAVE_ST_BLKSIZE
#define HAVE_SYSINFO
#define HAVE_SYSCONF
#undef  HAVE_UT_UT_HOST
#define HAVE_VPRINTF
#define L_INCR  SEEK_CUR
#define REGEX
#undef SHADOW_PASSWORD
#define SOLARIS_2
#define SVR4
#define USG
#define USE_VAR
#if !defined(USE_ETC_FTPD) && !defined(USE_LOCAL_ETC) && !defined(USE_OPT_FTPD)

#define USE_ETC
#endif

#include <limits.h>
#include <malloc.h>
#include <stdlib.h>
#include <unistd.h>

#ifndef FACILITY
#define FACILITY LOG_DAEMON
#endif

typedef void    SIGNAL_TYPE;

#include "../config.h"

#define realpath realpath_on_steroids   /* hack to work around unistd.h */

#define QUOTA
#define VIRTUAL
------------------------------------------------

Note that "SHADOW_PASSWORD" is undefine; otherwise wuftp would not compile with

another authentication method such as PAM.
I edited the Makefiles to specify "CC=gcc -DUSE_PAM" and "LIBES    = -lsupport
-lsocket -lnsl -lgen -lpam" (quick and dirty).
Then a  './build CC=gcc so2'  should do the job (if i remind everything).

Charles Bruneteau