bugConcurrent Versions System - Bugs: bug #14721, pam_open_session fails on Solaris...

 
 

bug #14721: pam_open_session fails on Solaris (sparc) for CVS >= 1.12.10

Submitter:  Svein Olav Bjerkeset <sobjerke>
Submitted:  Wed 05 Oct 2005 01:41:27 PM UTC
   
 
Category:  None Severity:  3 - Normal
Item Group:  None Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Closed Release: 
Fixed Release:  None Fixed Feature Release:  None
* Mandatory Fields

Add a New Comment Rich Markup
   

Jump to the original submission

Thu 03 May 2007 03:51:34 PM UTC, comment #9: 

I just wanted to put a comment in here for posterity. I compiled 1.12.13 for Solaris 8 because I need to use PAM and I had this exact problem. The below patch seems to fix it! The exact error was:

PAM open session error: Can not make/remove entry for session


Brendon Colby <brendonc>
Sun 16 Oct 2005 06:21:43 PM UTC, comment #8: 

this is now fixed and tested (On linux) please test on other
platforms with PAM support and report problems. It is possible
that there are some out there which have not implimented
getnameinfo in which case I need to find another way of converting
an ip address to text.

Brian Murphy <bmurphy>
Group Member
Fri 07 Oct 2005 06:39:49 PM UTC, comment #7: 

Yes it is. PAM will not function if not running as root anyway
so going the extra step to having it run from inetd is no big
problem. I think you could even use netcat as a front end if you
really wanted to test.

Brian Murphy <bmurphy>
Group Member
Fri 07 Oct 2005 08:14:47 AM UTC, comment #6: 

I have tested the patch and it works when running pserver from inetd. However: if for some reason (debuging?) STDIN is not a socket, cvs will fail. Is this intentional?

Svein Olav Bjerkeset <sobjerke>
Thu 06 Oct 2005 08:47:14 PM UTC, comment #5: 

Just added an attached patch which doesn't set PAM_RUSER and
sets PAM_RHOST to the remote host ip address. Comments are
requested...

Brian Murphy <bmurphy>
Group Member
Thu 06 Oct 2005 05:40:26 AM UTC, comment #4: 

I have now recompiled CVS 1.12.13 without setting PAM_RUSER and it worked. So it seems like it is PAM_RHOST that is needed for Solaris' pam_open_session to work.

Svein Olav Bjerkeset <sobjerke>
Wed 05 Oct 2005 08:04:29 PM UTC, comment #3: 

I am aware that RHOST as set by my patch will set the hostname to the host where the server is running, but technically speaking the pserver is the PAM client, so would this be wrong? If we were to set the RHOST to the hostname of the cvs client machine, how would we get that information given that pserver is run from inetd?

Regarding the other question on the need to set PAM_RUSER as well, I have not tested to see if it works with only one of PAM_RHOST and PAM_RUSER or if it is really necessary to set both. I found some example PAM code from FreeBSD that did set both variables and I assumed both needed to be set. I will be happy to test this if you feel like it, but wouldn't setting PAM_RUSER be a good thing anyway?

As far as SSH is consirned, Solaris comes with SSH out of the box (probably based on OpenSSH), but from the Solaris 8 days, we compiled and used OpenSSH on Solaris, so yes it works.

Svein Olav Bjerkeset <sobjerke>
Wed 05 Oct 2005 06:17:59 PM UTC, comment #2: 

If you write a patch reference like "patch #4488", Savannah will create a link.  :)

Derek Robert Price <dprice>
Group administrator
Wed 05 Oct 2005 06:10:05 PM UTC, comment #1: 

The patch sets the remote hostname RHOST to the hostname of the
machine running the server. This should be set to the remote
host name or to some dummy value which cannot be a valid hostname.

Looking at the ssh code (which I presume runs on solaris) it does not set PAM_RUSER are you sure it is necessary?

Brian Murphy <bmurphy>
Group Member
Wed 05 Oct 2005 01:41:27 PM UTC, original submission:  

CVS on Solaris/sparc fails in the pam_open_session call with a PAM_SESSION_ERR error for versions of CVS >= 1.12.10.

I have submitted a patch for this bug, see patch id #4488

Svein Olav Bjerkeset <sobjerke>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #2964:  cvs.patch added by bmurphy (2KiB - text/x-patch - remove setting PAM_RUSER and set PAM_HOST correctly to the remote host ip)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by brendonc (Posted a comment)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 2 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2005-10-16 bmurphy Open/ClosedOpen Closed
    2005-10-06 bmurphy Attached File- Added cvs.patch, #3028

    Back to the top

    Powered by Savane 3.13-d3ae.
    Corresponding source code