Aren
/
NetBSD
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
68,213 Commits 606 Branches 0 Tags 3.1 GiB
Commit Graph

58 Commits

Author SHA1 Message Date
aidan dbb0b2f74d Backout login_get_kconf function, because it breaks crypto-intl builds. 
Keep the variables for setting default behaviour with krb4 and krb5
compiled in, even though they act like constants, to facilitate adding
another preference mechanism later.
 2000-06-02 03:01:22 +00:00
aidan 39d1e5b7fd Allow krb5 and krb4 to be compiled in to the same login binary at once, 
krb5 can request a forwardable TGT,
can get both krb4 and krb5 tickets, if explicitely configured to do so
by the krb5.conf.
 2000-05-30 06:56:16 +00:00
enami 1d82270b8c - For root, if ignorenologin is set in login.conf, don't call 
checknologin (previously, checknologin is called if ignorenologin is set).
- For non-root user, make ignorenologin take effect.
 2000-03-07 14:11:22 +00:00
enami 6dccad067d Cosmetic changes. 2000-03-07 13:59:19 +00:00
aidan d6bf7fdb89 Move include/kerberosIV/com_err.h to include/com_err.h. 2000-02-14 03:21:02 +00:00
mjl b3204d536b Add login_getpwclass to libutil as convenience function for 
programs originally for FreeBSD.
Add parsing of "setenv" parameter which can be used to set
up an initial environment on login.
 2000-02-04 02:17:14 +00:00
mjl 8e380b472c Removed some fallback cases since that is now done in libutil. 2000-01-22 09:48:52 +00:00
mjl eb1d660e28 Clean up changes a bit. 2000-01-13 12:43:19 +00:00
mjl 07053cf7c1 Re-enable login_cap processing, now that a non-existing login.conf 
won't make it crash. Also make it less noisy in that case.
 2000-01-13 06:52:47 +00:00
mjl cfdb7e0720 Ack. Disable login caps, until problems are fixed. 2000-01-13 06:30:31 +00:00
mjl 4863ee6f07 Add login.conf capability setting. 2000-01-13 06:17:56 +00:00
billc 7ad9ba975f copyright year change (thanks cgd) so we emit , 2000 now. 2000-01-07 00:00:37 +00:00
aidan 5375ac8703 Made login continue without kerberos when there is no krb5.conf present 
(and KERBEROS5 is defined).
 1999-12-05 23:39:11 +00:00
christos f5241efcfa make this compile.... 1999-08-25 19:58:15 +00:00
aidan 3a4abbe0d1 Kerberos5 changes to login -- now supports forwarded TGTs. 1999-07-12 21:36:10 +00:00
christos 9966d744f2 Don't declare login here. It is declared in <util.h> 1999-06-15 14:19:53 +00:00
kim 0c127d7cef Show year of last login. 1999-01-11 20:20:54 +00:00
lukem 0e36738ca6 add copyright 1999 1999-01-06 13:51:09 +00:00
ross f670fa10c5 Add { and } to shut up egcs. Reformat the more questionable code. 1998-08-25 20:59:36 +00:00
mycroft 55ac0c2da3 const poisoning. 1998-07-26 21:58:46 +00:00
mrg 95b49ba52b do _NOT_ use system(3) in setuid programs. KNF. 1998-07-11 08:12:51 +00:00
mrg 2beab49a06 - use an array MAXHOSTNAMELEN+1 size to hold hostnames 
- ensure hostname from gethostname() is nul-terminated in all cases
- minor KNF
- use MAXHOSTNAMELEN over various other values/defines
- be safe will buffers that hold hostnames
 1998-07-06 06:45:41 +00:00
kleink fd366142a3 Need <time.h> for ctime() and time() prototypes. 1998-04-02 10:27:16 +00:00
hubertf 567c3f3e41 Also save groups before chdir($HOME). This fixes a problem pointed 
out by Bernd Ernesti with /home/lusers/joe (being uid joe, gid lusers),
with /home/lusers mode 750 and owner root:lusers.
 1998-01-16 00:31:53 +00:00
thorpej 974b59d07c Happy new year! 1998-01-07 00:41:43 +00:00
hubertf 5dda445628 Give up special privileges before chdir($HOME) and access(.hushlogin), 
fixing PR 4636 by myself with some help from Jason Thorpe.
 1997-12-05 08:29:39 +00:00
mrg 6bb686b3be print TNF copyright, like the kernel does. 1997-11-07 20:32:05 +00:00
mycroft 83ef48db0a Undo part of the previous; don't allow logins if we've passed pw_change. 
The semantics of this are not well documented.  *sigh*
 1997-10-12 15:21:24 +00:00
mycroft 97734d5e35 Refuse login only when we've past pw_expire, not pw_change. Check pw_expire 
first.
 1997-10-12 15:11:24 +00:00
mycroft 879c3292d6 Several things: 
* Change the semantics of the `-s' option somewhat.  If specified, allow
either Kerberos or S/Key login, but not a plain password.
* Eliminate the special `s/key' password; just type it at the prompt.
* Remove the root instance special case.  This is a serious security hole
waiting to happen, and no other system works this way.
* Don't force a password change if Kerberos was used.  Also, don't call
/bin/passwd at all if the password change isn't required.
 1997-10-12 15:05:24 +00:00
mycroft 1434f98d69 If we compile without SKEY, abort if a -s option is used, rather than silently 
failing to enforce it.
 1997-10-12 12:42:38 +00:00
mycroft 5171059387 Fix uninitialized variable. 1997-10-12 12:31:40 +00:00
kleink 66105c37fc Lseek(2) usage cleanup: the use of L_SET/L_INCR/L_XTND is deprecated, 
use SEEK_SET/SEEK_CUR/SEEK_END instead.
 1997-08-25 19:31:43 +00:00
mycroft 3110c7add1 Various changes to keep up with krb5, mostly addition of the kcontext 
structure.  From PR 3826, by Chris Jones.
 1997-08-19 17:26:13 +00:00
lukem 049da32c75 * add functionality to `force password change at next login'. to use, 
set the pw_change field of the user to -1 (defined in <pwd.h> as
  _PASSWORD_CHGNOW). based on [bin/936] by Simon Gerraty <sjg@quick.com.au>
* clean up for WARNS?=1
 1997-08-16 13:50:43 +00:00
mikel 2064aaafaa add comparisons to NULL implicit in my last changes 
compare result of getopt() to -1, not EOF
 1997-07-11 03:47:53 +00:00
lukem 6840bd89be Don't leak some information (``you have no s/key''). 
Only information leaks now are:
* if '-s -s' is used (only allow s/key users, and force s/key use),
  then "login incorrect" will be given if a non-s/key user (or
  non-existant user) attempts to login; no password will be prompted
  for.
  XXX: maybe this should be fixed, but further analysis is required.
* an s/key user will be reminded in the "Password" prompt that they
  have an s/key. Therefore it would be possible to determine if a user
  is active on the machine if they have an s/key.
  XXX: maybe an option is required to control this behaviour
 1997-06-29 02:38:25 +00:00
lukem 9c9e83ed7f use _PASSWORD_WARNDAYS from <pwd.h> 1997-06-27 16:42:22 +00:00
lukem 5170144fac Apply [bin/3270] from Simon J. Gerraty <sjg@quick.com.au>, with fixes by me: 
* if the user has an s/key, provide a reminder in the password prompt
* if '-s' is given once, force a user that has an s/key to use it
* if '-s' is given more than once, only permit s/key logins
 1997-06-25 00:15:04 +00:00
veego de140ea979 Move stdio.h before skey.h to get the FILE struct. 1997-06-23 11:19:10 +00:00
mikel 63482e654c include <skey.h> for skey function prototypes, add parens for gcc -Wall 1997-06-23 01:20:40 +00:00
mrg 56d95f62f0 remove dangerous sprintf calls. 1997-02-11 08:15:08 +00:00
sommerfe 36da84b7df Longer login name support: use MAXLOGNAME, not UT_NAMESIZE 1996-12-20 20:17:30 +00:00
gwr 6efa6770fc After the chown(ttyn, ...), call ttyaction(ttyn, "login", pwd->pw_name) 1996-11-14 19:28:29 +00:00
explorer e1fa4673e0 Don't display skey error on s/key logins... This gives attackers some 
information
 1996-09-18 21:23:37 +00:00
jtc 01120f4477 Updated to use <util.h>. 
From Greg Hudson <ghudson@MIT.EDU>.
 1996-05-15 23:46:50 +00:00
jtc b412b86505 Merged with 4.4lite. 
Changed to conform to NetBSD's new RCS Id convention.
 1994-12-23 06:52:56 +00:00
deraadt 80ba474bd2 pr#377: dialup line hack is silly 1994-08-03 10:04:25 +00:00
brezak b491643425 Add support for Kerberos5 authentication. 1994-07-25 21:11:08 +00:00
deraadt 4693d9a138 add s/key support 1994-05-24 06:50:57 +00:00