topic Re: question about pam on hpux11 in Operating System - HP-UX

question about pam on hpux11

mango_1 — Mon, 21 Apr 2003 17:44:31 GMT

hello! i'm having problems using the pam application i made which simply authenticates the user. I was wondering how come if I log in as root I dont have a problem using the application. I'm currently using hpux11 which uses tcb. Any help is much appreciated. thanks!

Re: question about pam on hpux11

John Dvorchak — Mon, 21 Apr 2003 17:49:46 GMT

Like a wise man told me once "if it feels like a permsisions problem, it probably is". I don't know a thing about your Pam application but permissions is always a good place to start.

Re: question about pam on hpux11

mango_1 — Mon, 21 Apr 2003 17:58:30 GMT

thanks for the advice. I've also looked into that possibility. but couldn't figure out where it had permission problems. I used truss to trace the application and i think the difference is in accessing the /tcb/files/auth/... its issuing an error 13 while as root its issuing error 2. is there a way to solve this?

thanks!

Re: question about pam on hpux11

Keith Buck — Mon, 21 Apr 2003 18:06:59 GMT

Sounds like your application works if run as root, but not if it runs as another user? If I understood your question correctly, then this is expected behavior in trusted mode.

There are two reasons for this, from different perspectives.

1. One of the main features of trusted mode is the ability to hide the encrypted password from non-root users. Hence, non-root users can't try to authenticate, or they could attempt password guessing schemes.

2. It doesn't really do much good to authenticate a user if you can't switch to that user. Only root can do that anyway.

Hope that helps. If not, maybe you could clarify what you're trying to do in the application?

Re: question about pam on hpux11

mango_1 — Mon, 21 Apr 2003 18:18:30 GMT

thanks for the help. really appreciate it! let me explain further. The application runs when I run it as myself or as root. the problem is when I use my application. my application actually tries to authenticate the user provided.

(e.g. mylogin is the name of my application and when I run it as: mylogin . It will fail when I log in as myself but will return success when I'm the root)

Please let me know if you need any additional information. thanks!

Re: question about pam on hpux11

mango_1 — Mon, 21 Apr 2003 19:17:41 GMT

i encounter the error "No account present for user" even if the user is valid.

thanks again! :)

Re: question about pam on hpux11

mango_1 — Mon, 21 Apr 2003 20:46:35 GMT

hi all! i think the problem is that i need the root priveledges for my application to be able to access the tcb files. (my application is somewhat like the login service existing. it just accepts user name and password) i tried to chmod (u+s) the executable but it still failed. do you guys have any idea how I could do this?

thanks so much!

Re: question about pam on hpux11

John Dvorchak — Mon, 21 Apr 2003 20:53:49 GMT

I am still kinda fuzzy on what the application explicitly does. But any time we have an app that has to run as root, but run by certain users, we use sudo. Sudo is free and available, I believe from HP's software site or the porting center.

How sudo works is the root user will specify, in config files, what users can issue which commands. So in effect the user(s) would have a list of commands, that you set up for them, to execute, and the command runs as root. It is very slick and if you follow the examples etc, it is very safe.

Try this link to download sudo :

http://hpux.cs.utah.edu/hppd/hpux/Sysadmin/sudo-1.6.6/

and do a little searching on the ITRC forums about it.

Good luck

Re: question about pam on hpux11

mango_1 — Mon, 21 Apr 2003 21:10:45 GMT

thanks for the replies! but i was wondering if there was a way that wouldn't use another software like sudo. couldn't I just issue the setuid command? if I want to use the root command, Can't I just use the setuid(0) in my application? sorry for the trouble.

Re: question about pam on hpux11

doug hosking — Tue, 22 Apr 2003 18:19:26 GMT

Melissa, you said you did 'chmod u+s' on the binary but didn't specify who owns the binary.

The binary must be owned by root before you do the chmod on it. If not, you will see the type of problem you describe.

Try
chown root:sys mylogin
chmod 4755 mylogin

That will give you the privileges you need to access the protected password files under /tcb.