non-root user can't login on CDE console

[Vladimir Fabecic]

Hello
Once I had strange problems with newly added cluster member with /tmp. It was not writable by users, only root. Probably will not help, but try.

[Rick Retterer]

Hello,
I'm working with Victor on this from the support center. The part that is missing here is that theses systems have C2 security enabled on them.

Applications that have the SUID bit set on them will run and display on the graphics terminal. If the application does not have the SUID bit set, then the appliation fails with "can't open display" or "Invalid display for transport" which in this case is the "local" transport. If you use ip.address.of.system:0.0, then the application is allowed to display.

The applications with the SUID bit set on them are: xterm, dtterm, dxterm and xmesh.

All 4 of these applications can display to the console using ":0.0" or "local:0.0".

We are going to look into the SIA stuff today to see if there have been any changes into this database.

Cheers,
Rick Retterer
HP Services
Atlanta, GA.

[AwadheshPandey]

if root or all other user can login on the system. then delete ~/.Xauthority file of particular user.

[Rick Retterer]

We have already removed the user's .Xauthority file as well as the .TTauthority.

It is something more hidden from us than that.

We are continuing to work on this issue.

Cheers,
Rick

[AwadheshPandey]

sorry for last reply it is .TTauthority to move, try mv .TTauthority .TTauthority.old
this will solve ur problem

Awadhesh

[Rick Retterer · Accepted solution]

Found the cause of the problem.

It appears that the permissions on the /tmp/.X11-unix/X0 file were changed from 777 to 755.

This only permitted the root user to have write access to the device file.

After changing the permissions back to 777 on the /tmp/.X11-unix/X0 file, now the non-root users are able to login and bring up a CDE session successfully.

Cheers,
Rick Retterer
HP Services
Atlanta, GA.
Tru64 Unix Graphics Support

[Vladimir Fabecic]

That is what I said. It was very strange that newly added member did not have 777 permition on /tmp. I did "chmod 777 /tmp" and fixed the problem.

[Johan Brusche]

Vladimir ,

Setting 777 on /tmp is insecure !! The "t"-bit must be set on /tmp , so rather use :

chmod 1777 /cluster/members/member2/tmp

Rgds,
___ Johan.

[Vladimir Fabecic]

Johan, of course you are right. I did what you said later, but first I had to be sure that /tmp permition is causing problem. This kind of problem happened to me just once and still do not know why it happened.

[Victor Semaska_3]

Rick beat me to it. It was a permissions problem.

Vic