🚀 go-pugleaf

Archive-name: auto/comp.unix.admin/log-tcp-tcp-wrapper-update

This is an announcement of an interim patch for some rough edges that
were left in last June's release. The patch does not introduce any new
features or changes to installation and/or configuration procedures.

The patch has been submitted to comp.sources.misc, and can be picked up
from ftp-win.tue.nl:/pub/security/log_tcp_4.2-to-4.3.Z.

A fully-patched source kit can be found on ftp.win.tue.nl in the file
/pub/security/log_tcp.shar.Z.  The archives on cert.org (in directory
/pub/tools/wrappers) and on ftp.uu.net (in /pub/security) will be
updated ASAP. 

The remainder of this message is an extract of the BLURB file (summary
of fixes and workarounds).

    - Some sites reported that connections would be rejected because
    localhost != localhost.domain. The host name checking code now
    special-cases localhost (problem reported by several sites).

    - The programs now report an error if an existing access control
    file cannot be opened (e.g. due to lack of privileges).  Until now,
    the programs would just pretend that the access control file does
    not exist (reported by Darren Reed, avalon@coombs.anu.edu.au).

    - The timeout period for remote userid lookups was upped to 30
    seconds, in order to cope with slow hosts or networks.  If this is
    too long for you, adjust the TIMEOUT definition in file rfc931.c
    (problem reported by several sites).

    - On hosts with more than one IP network interface, remote userid
    lookups could use the IP address of the "wrong" local interface.
    The problem and its solution were discussed on the rfc931-users
    mailing list.  Scott Schwartz (schwartz@cs.psu.edu) folded the fix
    into the rfc931.c module.

    - The result of % expansion (in shell commands) is now checked for
    stuff that may confuse the shell; it is replaced by underscores
    (problem reported by Icarus Sparry, I.Sparry@gdr.bath.ac.uk).

    - A portability problem was fixed that caused compile-time problems
    on a CRAY (problem reported by Michael Barnett, mikeb@rmit.edu.au).

Finally, a caveat for those who use the optional remote username lookup
feature (RFC 931 protocol).  On some systems, these lookups may trigger
a kernel bug.  When a client host connects to your system, and the RFC
931 connection to that client is rejected by a router, some kernels
drop all connections with that client.  The bug is not in the log_tcp
programs. The patched README file describes how to find out if your
kernel has the bug, and what action can be taken.

	Wietse Venema (wietse@wzv.win.tue.nl),
	Department of Mathematics and Computing Science,
	Eindhoven University of Technology,
	The Netherlands.