🚀 go-pugleaf

John Owens wrote:

> After installing this patch, sadc seems unable to create the necessary
> files in /usr/adm/sa when run out of the "sys" crontab (the default).
>
> The modes I had were as follows:
> 
> drwxr-xr-x   2 adm      bin          352 Dec 01 17:47 /usr/adm/sa
> ---s--s--x   1 root     sys        15782 Nov 25 22:24 /usr/lib/sa/sadc
> 
> For now, I've changed /usr/adm/sa to
> 
> drwxrwxr-x   2 adm      sys          352 Dec 01 17:48 /usr/adm/sa
> 
> which seems relatively safe.  Has anyone else had this problem?

Your analysis is correct (and points out what the problem with sadc
was).  Your solution is also correct and should be safe.  (If someone
has permission to write as sys, they already own the system anyway).

You may want to edit /etc/perms/rts to indicate the new permissions of
/usr/adm/sa.  This will keep fixperm from "fixing" your fix out of
existence...

>Bela<

Probably the best way to avoid any problems with login, passwd and prwarn
is to install a replacement from public source code- then if you _DO_ find
a problem you can just patch the source, recompile, and have a much better
idea if the problem is fixed or, in the tradition of SUN, just moved to
some other part of the sequence so the 'cookbook' exploitation doesn't work.

Hugh's shadow login suite has some mention of options for the vagaries of
SCO, and should work on recent releases- perhaps SCO themselves should start
using it?


--
kadokev@ripco.com						 Kevin Kadow

FREE Usenet/Mail, inexpensive Internet - Ripco... Wearing white hats since 1983
Dialup:(312) 665-0065|Gopher:gopher.ripco.com|Telnet:foley.ripco.com ('info')

Bela Lubkin (belal@sco.COM) wrote:
:Your analysis is correct (and points out what the problem with sadc
:was).  Your solution is also correct and should be safe.  (If someone
:has permission to write as sys, they already own the system anyway).

:You may want to edit /etc/perms/rts to indicate the new permissions of
:/usr/adm/sa.  This will keep fixperm from "fixing" your fix out of
:existence...

I made this change, but now I get 'sadc: Not enough space'.  Does anyone
know what the deal is with this?  I have just as much space as I did
yesterday before installing the patch, but now it fails.  However, the
old version seems to fail the same way.  Anyone?!

--
Kurt Adam                                  "Play with lions;
mage@vt.edu                                 get covered in yellow fur."
http://www.vt.edu:10021/cns/mage/home.html                 - Duckman

On Dec 6, 17:08, Kurt Adam wrote:
> I made this change, but now I get 'sadc: Not enough space'. [....]

I haven't seen this.  Are you sure you have enough inodes?
(Try "df -v -i".)

> http://www.vt.edu:10021/cns/mage/home.html                 - Duckman

CNS, huh?  I worked at CNS for a few months back in '87.  Helped
get VT.EDU registered on the Internet and set up the nameserver(s)
and domain scheme....  Say hi to Theta and Kim H. for me!

	-John

-- 
John Owens        john@micros.com        olorin@access.digex.net
http://access.digex.net/~olorin, or see .plan for PGP public key
------- Technical advisor - Wednesday's Coterie of Thugs -------

Hmm.  Several people have indicated that they didn't see the article
of mine on sadc that started this sub-thread.  (I posted it via the
scogen mailing list, but can't find it in the news spool over here on
another system, so perhaps the list gateway hiccupped.)

Anyway, here it is again, as a public service.... :-)

Newsgroups: comp.security.unix,biz.sco.general
From: John Owens <john@micros.com>
Subject: Re: SCO Advisory 94:001 at.login.prwarn.sadc.pt_chmod
Organization: MICROS Systems, Inc.
Date: Thu, 1 Dec 1994 17:55:28 -0500
Message-Id: <9412011755.aa08762@eagle.micros.com>
In-Reply-To: Christopher Durham <chrisdu@sco.com>
       "SCO Advisory 94:001 at.login.prwarn.sadc.pt_chmod" (Nov 30, 17:17)

On Nov 30, 17:17, Christopher Durham wrote:
> ===========================================================================
>  			     SCO Advisory 94:001
>                              November 30th, 1994
> 	Patches for at(C), login(M), prwarn(C), sadc(ADM), pt_chmod
> ---------------------------------------------------------------------------

>      sadc(ADM)		sse004

After installing this patch, sadc seems unable to create the necessary
files in /usr/adm/sa when run out of the "sys" crontab (the default).

The modes I had were as follows:

drwxr-xr-x   2 adm      bin          352 Dec 01 17:47 /usr/adm/sa
---s--s--x   1 root     sys        15782 Nov 25 22:24 /usr/lib/sa/sadc

For now, I've changed /usr/adm/sa to

drwxrwxr-x   2 adm      sys          352 Dec 01 17:48 /usr/adm/sa

which seems relatively safe.  Has anyone else had this problem?
(This is under both OSE 3.0 and UNIX 3.2v4.2, not that that makes any
difference.)

	Thanks,
	-John

--
John Owens        john@micros.com        olorin@access.digex.net
http://access.digex.net/~olorin, or see .plan for PGP public key
------- Technical advisor - Wednesday's Coterie of Thugs -------

In comp.security.unix, Kevin Kadow (kadokev@ripco.com) wrote:
> Probably the best way to avoid any problems with login, passwd and prwarn
> is to install a replacement from public source code- then if you _DO_ find
> a problem you can just patch the source, recompile, and have a much better
> idea if the problem is fixed or, in the tradition of SUN, just moved to

Consequently, you can use a free OS coming with the source code...

--
Harald Milz (hm@ix.de)   WWW: http://www.ix.de/ix/editors/hm.html
iX Multiuser Multitasking Magazine      phone +49 (511) 53 52-377
Helstorfer Str. 7, D-30625 Hannover     fax   +49 (511) 53 52-378
Opinions stated herein are my own, not necessarily my employer's.