From: root@crash.cts.com (Superuser)
Subject: Problems with SCO Authentication System
Organization: CTS Network Services (crash, ctsnet), El Cajon, CA
Date: 4 Oct 92 00:01:10 GMT
Keywords: authentication relax security frustration database

I'm having a hell of a time with the security database system in SCO
Unix 3.2 v4.  Perhaps someone will recognize what's going on and point
me in the right direction.

I recently (a couple of weeks ago) converted crash from Xenix 2.3.4 to
the Unix mentioned above.  Besides a hiccup or two along the way, the
conversion went pretty well.  As soon as the system was back on line
for a couple of hours I started getting 'Cannot obtain database
information on this terminal' messages and logins would fail.  I
tracked that down to extraneous -t files in /etc/auth/system, ttys-t.
Delete the ttys-t file and things would start working again.  I looked
up that message in the administrators manual and it says the message
may occur on 'bbs type' systems.  Oh great.  Crash has 21 serial
ports, 17 of which are connected to modems, and it's a pretty busy
system.  I think what the manual is saying is that these clowns have
apparently either not implemented a file locking system for the
/etc/auth/system/ttys file, which each port has to consult at the
beginning and end of each login, or a bad locking system that doesn't
work well in the face of a lot of traffic.  Bah.

Well, there's a section in the Release Notes that talks about removing
this security database system entirely.  This seems like the solution
to the problem, except it doesn't work on crash.  The removal works
just fine on another system here, but the exact same steps don't work
on crash, and I'm completely baffled.

The Release Notes steps are:

1.	/etc/relax low
2.	Add a file /etc/defaults/security which says TCBFILES=OFF
3.	remove the sdd line in /etc/inittab
4.	remove the same line in /etc/conf/cf.d/initbase
5.	rm -rf /tcb /etc/auth

Of course, they don't tell you that relax low also removes the
/etc/shadow file, which you need to bring back with pwconv before you
do step 5.

Just to be safe, I mv'd /tcb to /tcb.orig and /etc/auth to
/etc/auth.orig so I could recover easily if things didn't work.  Good
thing.

For some reason, no matter what I do, I can't convince /bin/login not
to check with /etc/auth/system/ttys on each and every login.  When it
sees that that file is not there (cause I renamed the directory) it
gives the same error message as I get if a ttys-t file exists.  I
would have thought that if /bin/login didn't see an /etc/auth
directory it would bypass all that, but it doesn't.

HELP!  Does anyone recognize what's going on here?

There's only one difference that I can think of between crash and the
other system on which this change works.  On the other system, the
original installation was done with security set to low.  On crash, it
was originally done with security set to traditional, and then changed
to low (and back and forth a couple of times).  I've compared key
files between the systems and everything seems the same -- but
obviously, something isn't.

In the meantime, to keep the system working, I have a little script
that runs every 5 minutes to look for ttys-t files.  If it finds one,
it checks in 10 seconds and again in another 10 seconds to see if it
a) still there, and b) the same as the original.  If it is, the file
gets deleted and I get sent a message to that effect.  A deletion
occurs 4-5 times per day with about 700 logins.

ANY suggestions would be greatly appreciated.

--Bill

Newsgroups: comp.unix.sysv386