Bug 17183

Summary:	/etc/pam.d/rlogin bypasses /etc/nologin
Product:	[Retired] Red Hat Linux	Reporter:	jhs28
Component:	rsh	Assignee:	Nalin Dahyabhai <nalin>
Status:	CLOSED RAWHIDE	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	4.2	Keywords:	Security
Target Milestone:	---
Target Release:	---
Hardware:	i386
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2000-09-01 17:35:30 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description jhs28 2000-09-01 17:35:28 UTC

rsh-server packages 
rsh-server-0.16-12.i386.rpm	(RedHat 6.2)
rsh-server-0.17-2.2.i386.rpm	(pinstripe)
(and possibly previous versions)

have what I consider are incorrect settings in /etc/pam.d/rlogin: 
auth       sufficient   /lib/security/pam_rhosts_auth.so
...
auth       required     /lib/security/pam_nologin.so

This means that rlogins can bypass /etc/nologin.

I believe the nologin and rhosts_auth entries should be reversed:
auth       required     /lib/security/pam_nologin.so
auth       sufficient   /lib/security/pam_rhosts_auth.so

(n.b. I'm not trying to be alarmist by assigning a security severity level,
but some admins might depend on /etc/nologin for security)

Comment 1 Jeff Johnson 2000-10-12 16:44:45 UTC

Fixed (as suggested) in rsh-0.17-2.4.

Comment 2 Phil Knirsch 2001-06-16 15:13:57 UTC

*** Bug 20518 has been marked as a duplicate of this bug. ***

Comment 3 Phil Knirsch 2001-06-16 15:15:44 UTC

*** Bug 20525 has been marked as a duplicate of this bug. ***