Bug 17183 - /etc/pam.d/rlogin bypasses /etc/nologin
Summary: /etc/pam.d/rlogin bypasses /etc/nologin
Alias: None
Product: Red Hat Linux
Classification: Retired
Component: rsh (Show other bugs)
(Show other bugs)
Version: 4.2
Hardware: i386 Linux
Target Milestone: ---
Assignee: Nalin Dahyabhai
QA Contact:
Keywords: Security
: 20518 20525 (view as bug list)
Depends On:
TreeView+ depends on / blocked
Reported: 2000-09-01 17:35 UTC by jhs28
Modified: 2008-05-01 15:37 UTC (History)
0 users

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2000-09-01 17:35:30 UTC
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

Description jhs28 2000-09-01 17:35:28 UTC
rsh-server packages 
rsh-server-0.16-12.i386.rpm	(RedHat 6.2)
rsh-server-0.17-2.2.i386.rpm	(pinstripe)
(and possibly previous versions)

have what I consider are incorrect settings in /etc/pam.d/rlogin: 
auth       sufficient   /lib/security/pam_rhosts_auth.so
auth       required     /lib/security/pam_nologin.so

This means that rlogins can bypass /etc/nologin.

I believe the nologin and rhosts_auth entries should be reversed:
auth       required     /lib/security/pam_nologin.so
auth       sufficient   /lib/security/pam_rhosts_auth.so

(n.b. I'm not trying to be alarmist by assigning a security severity level,
but some admins might depend on /etc/nologin for security)

Comment 1 Jeff Johnson 2000-10-12 16:44:45 UTC
Fixed (as suggested) in rsh-0.17-2.4.

Comment 2 Phil Knirsch 2001-06-16 15:13:57 UTC
*** Bug 20518 has been marked as a duplicate of this bug. ***

Comment 3 Phil Knirsch 2001-06-16 15:15:44 UTC
*** Bug 20525 has been marked as a duplicate of this bug. ***

Note You need to log in before you can comment on or make changes to this bug.