netinfo/security: lockout disables login_accounting

Thread View: comp.sys.next.bugs

3 messages

[T] Back to Threads [V] Tree View [G] Group Articles

3 total messages Started by Larry Fahnoe Mon, 04 Jan 1993 02:37

#11

Author: Larry Fahnoe
Date: Mon, 04 Jan 1993 02:37

40 lines
1910 bytes

Environment: standalone cube running 3.0

I would like to be able to log failed login attempts, and according to the
network and system admin guide (chapter 14, setting security options in
netinfo) I can do this.  After following the instructions and verifying
them with niutil:

	cubit> niutil -read . /
	master: localhost/local 
	security_options: login_accounting lockout 
	trusted_networks: 0 

To test this, I added a line to syslog.conf:

	*.debug		/usr/adm/debug

However after much tinkering about, I find that when you add the lockout
flag, you loose login_accounting's ability to log failed attempts.  A
simple test shows this:

	- set security_options to login_accounting
	- try a few bad logins
	- set security_options to login_accounting + lockout
	- try a few more bad logins

Only the first set of login errors will be logged.  It seems that
sucessfull logins get logged in either case, but I was not testing for
that case.  I have done these tests on a system with a fresh netinfo
database so I do not believe that there are additional bogosities in my
netinfo database that were causing problems.

Additionally, it seems that simply sending a HUP to syslogd does not cause
syslogd to really read /etc/syslog.conf.  I found that to add a new log
file required syslogd to be killed and restarted.

--Larry
-- 
Larry Fahnoe                        Cellular One
612/832-7616                        7900 S. Xerxes Ave, Suite 301
lfahnoe@kegworks.mn.org             Minneapolis, MN  55431

Re: netinfo/security: lockout disables login_accounting

#24

Author: Rob Francis
Date: Mon, 04 Jan 1993 18:24

14 lines
1158 bytes

Along those lines, there's another problem with this feature.  I added
the secure_passwords property to the security property in / in my
network domain.  The secure_passwords value is supposed to make it
that people must choose good passwords.  It does, but only for
/etc/passwd, not in Preferences.app.  Most of my users use Preferences
to change their password.  So the security option didn't help out
much.  I'd call it a bug. The property should be universal to password
changing, not just command line.

-rob
---
Rob Francis   Unix Systems Specialist, Indiana University
francisr@indiana.edu (812)855-0327

Re: netinfo/security: lockout disables login_accounting

#25

Author: Rob Francis
Date: Mon, 04 Jan 1993 18:29

14 lines
1251 bytes

In article <C0CDsr.CCD@usenet.ucs.indiana.edu> francisr@stupid.ucs.indiana.edu (Rob Francis) writes:
>
>Along those lines, there's another problem with this feature.  I added
>the secure_passwords property to the security property in / in my
>network domain.  The secure_passwords value is supposed to make it
>that people must choose good passwords.  It does, but only for
>/etc/passwd, not in Preferences.app.  Most of my users use Preferences

Whoops.  I meant /bin/passwd.  Trying to not cause confusion...

-rob
---
Rob Francis   Unix Systems Specialist, Indiana University
francisr@indiana.edu (812)855-0327

Thread Navigation

This is a paginated view of messages in the thread with full content displayed inline.

Messages are displayed in chronological order, with the original post highlighted in green.

Use pagination controls to navigate through all messages in large threads.

Back to All Threads