From: mcba@newt.phys.unsw.edu.au (Michael C. B. Ashley)
Newsgroups: comp.unix.ultrix
Subject: Re: VXT's, xdm, and UPGRADE/ADVANCED security....
Summary: here is a patch to xdm
Date: 13 Oct 92 23:16:44 GMT
Organization: University of New South Wales

In article <1992Oct12.212232.18086@olaf.wellesley.edu>, lhawkins@olaf.wellesley.edu (Lee Hawkins) writes:
> Hi all:
> I decided to upgrade my DECstation to UPGRADE security level today, and
> was pleasantly surprised at how easy it was.  -Then- I tried to login
> in from one of our VXT2000's and was unable to (login incorrect).  A 
> call to DEC confirmed my suspicions: If you are running xdm to support
> Xsessions on a VXT2000, you can't use UPGRADE/ENHANCED security, because
> xdm uses crypt, and U/E sec. uses crypt16.  When I asked for a solution,
> I was told: "Well, it's a catch-22: xdm is unsupported, so you'll have to
> fix it yourself, or wait around for us to.  In the meantime, we suggest
> you either not run U/E sec. or not use your VXT's for Xsessions."
> Yeah! Right! What a good solution!
> 
> Am I the only person out there who has had this problem, and if not, has
> anybody else fixed it?  If not, where can I get the xdm sources so I can
> at least try to fix it?
> 


I posted the same question about 6 months ago and got many helpful
replies.  At the end of this message are the context diffs for a
kerberized xdm based on the X11R5 sources.  The diffs originally came
from angel@flipper.rsmas.miami.edu (Angel Li).  Use Larry Wall's
"patch" program to apply the patches.

Angel Li's patched xdm works just fine.  The only improvement that
would be useful would be to display the informative messages that the
ULTRIX "login" does, e.g., "Your password is about to expire", "Your
password has expired" and so on.  Has anyone done this?

The other problem is that if the user hits carriage return for both
the username and password, then xdm thinks this is a login as root,
and next time root logs in you get the message "you have xxx
unsuccessful logins".  For some reason the users around here do this
all the time, and I accumulate hundreds of phantom root logins.  If
you solve this problem, please let me know.

Incidentally, if anyone is holding off installing X11R5 on the the
assumption that is difficult to compile, don't worry, it is easy!  It
only takes a couple of hours to ftp the sources from somewhere, read
the (excellent) installation guide, and start the make.  Come back a
few hours later and it all works!  (This is using ULTRIX 4.2A, and
the standard MIPS cc - one caveat: you need a few hundred Mbytes of
spare disk space).

Michael Ashley mcba@newt.phys.unsw.edu.au
Dept. of Astrophysics / University of New South Wales / Sydney Australia

diff -c ../xdm.kerb/Makefile ../xdm/Makefile
*** ../xdm.kerb/Makefile	Thu May 21 09:15:05 1992
--- ../xdm/Makefile	Sun Mar 15 23:01:06 1992
***************
*** 68,75 ****
    STD_CPP_DEFINES =
        STD_DEFINES =
   EXTRA_LOAD_FLAGS =
!   EXTRA_LIBRARIES = -lckrb -lkrb -ldes -lauth
! #  EXTRA_LIBRARIES =
               TAGS = ctags
  
      PROTO_DEFINES = -DFUNCPROTO
--- 68,74 ----
    STD_CPP_DEFINES =
        STD_DEFINES =
   EXTRA_LOAD_FLAGS =
!   EXTRA_LIBRARIES =
               TAGS = ctags
  
      PROTO_DEFINES = -DFUNCPROTO
diff -c ../xdm.kerb/verify.c ../xdm/verify.c
*** ../xdm.kerb/verify.c	Thu May 21 09:13:57 1992
--- ../xdm/verify.c	Fri Jul 19 12:23:36 1991
***************
*** 36,48 ****
  char *getenv();
  #endif
  
- #ifdef ultrix
- #include	<sys/svcinfo.h>
- #include	<auth.h>
- static void	initKerberos();
- static int	initKerb = 1;
- #endif
- 
  struct passwd joeblow = {
  	"Nobody", "***************"
  };
--- 36,41 ----
***************
*** 82,90 ****
  	char		**userEnv (), **systemEnv (), **parseArgs ();
  	char		*shell, *home;
  	char		**argv;
- #ifdef ultrix
- 	struct		svcinfo *si;
- #endif
  
  	Debug ("Verify %s ...\n", greet->name);
  	p = getpwnam (greet->name);
--- 75,80 ----
***************
*** 100,135 ****
  
  	if (strcmp (crypt (greet->password, sp->sp_pwdp), sp->sp_pwdp))
  #else
- #ifdef ultrix
- 	si = getsvc();
- 	if ((si->svcauth.seclevel == SEC_UPGRADE) ||
- 	    (si->svcauth.seclevel == SEC_ENHANCED)) {
- 		int		why;
- 
- 		if (initKerb) {
- 			initKerberos();
- 			initKerb = 0;
- 		}
- 		why = authenticate_user(p, greet->password, "");
- 		if (why < 0)
- 			goto itFailed;
- 		else
- 			goto itWorked;
- 	}
- #endif	/* ultrix */
  	if (strcmp (crypt (greet->password, p->pw_passwd), p->pw_passwd))
  #endif
  	{
- #ifdef ultrix
-     itFailed:
- #endif	/* ultrix */
  		Debug ("verify failed\n");
  		bzero(greet->password, strlen(greet->password));
  		return 0;
  	}
- #ifdef ultrix
-     itWorked:
- #endif	/* ultrix */
  	Debug ("verify succeeded\n");
  /*	bzero(greet->password, strlen(greet->password)); */
  	verify->uid = p->pw_uid;
--- 90,102 ----
***************
*** 265,321 ****
  	}
  	verify->ngroups = ngroups;
  	endgrent ();
- }
- #endif
- 
- #ifdef ultrix
- # include	<stdio.h>
- 
- /*
-  * include files for kerberos and auth file support.
-  *
-  * link with: -lckrb -lkrb -ldes -lauth
-  */
- #include	<sys/types.h>
- #include	<krb.h>
- #include	<des.h>
- #include	<errno.h>
- 
- static void
- initKerberos()
- 
- {
-     char		*crypt ();
-     char *auth_db = AUTHORIZATION_DB;
-     AUTHORIZATION 	*auth, *getauthuid();
-     char 		*crypt16();
-     char 		namebuf[ANAME_SZ];
-     char 		*ptr;
-     char		*name;
-     char		*password, *getpass();
-     char		*index();
-     int			krb_result;
- 
- 
-     config_auth();			/* nudge bind internals */
- 
-     if (gethostname(namebuf, sizeof(namebuf)) == -1 )
-     {
- 	printf ("%s\n","gethostname failure");
-     }
- 
-     if ((ptr = index(namebuf, '.')) != (char *)0)
- 	*ptr = '\0';			/* remove any '.' stuff */
- 
-     /* Initialize Kerberos */
- 
-     if ((krb_result = krb_svc_init("hesiod", namebuf, (char *)NULL, 0,
- 		   (char *)NULL, "/var/dss/kerberos/tkt/tkt.login"))
- 				   != RET_OK) 
-     {
- 	printf("Kerberos initialization failure\n");
- 	exit (0);
-     }
- 
  }
  #endif
--- 232,236 ----
Newsgroups: comp.unix.ultrix