Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.
Bug 17183 - /etc/pam.d/rlogin bypasses /etc/nologin
/etc/pam.d/rlogin bypasses /etc/nologin
Product: Red Hat Linux
Classification: Retired
Component: rsh (Show other bugs)
i386 Linux
medium Severity medium
: ---
: ---
Assigned To: Nalin Dahyabhai
: Security
: 20518 20525 (view as bug list)
Depends On:
  Show dependency treegraph
Reported: 2000-09-01 13:35 EDT by jhs28
Modified: 2008-05-01 11:37 EDT (History)
0 users

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2000-09-01 13:35:30 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description jhs28 2000-09-01 13:35:28 EDT
rsh-server packages 
rsh-server-0.16-12.i386.rpm	(RedHat 6.2)
rsh-server-0.17-2.2.i386.rpm	(pinstripe)
(and possibly previous versions)

have what I consider are incorrect settings in /etc/pam.d/rlogin: 
auth       sufficient   /lib/security/pam_rhosts_auth.so
auth       required     /lib/security/pam_nologin.so

This means that rlogins can bypass /etc/nologin.

I believe the nologin and rhosts_auth entries should be reversed:
auth       required     /lib/security/pam_nologin.so
auth       sufficient   /lib/security/pam_rhosts_auth.so

(n.b. I'm not trying to be alarmist by assigning a security severity level,
but some admins might depend on /etc/nologin for security)
Comment 1 Jeff Johnson 2000-10-12 12:44:45 EDT
Fixed (as suggested) in rsh-0.17-2.4.
Comment 2 Phil Knirsch 2001-06-16 11:13:57 EDT
*** Bug 20518 has been marked as a duplicate of this bug. ***
Comment 3 Phil Knirsch 2001-06-16 11:15:44 EDT
*** Bug 20525 has been marked as a duplicate of this bug. ***

Note You need to log in before you can comment on or make changes to this bug.