>Number:         1078
>Category:       bin
>Synopsis:       rlogind ignores root's .rhosts and /etc/nologin
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    bin-bug-people (Utility Bug People)
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat May 27 10:20:11 1995
>Originator:     Rolf Grossmann
>Organization:
	I guess not.
>Release:        NetBSD-current 1.0A
>Environment:
	NetBSD/sparc, but it doesn't matter.
System: NetBSD kiss 1.0A NetBSD 1.0A (TIGKI) #22: Mon May 8 19:51:43 MET DST 1995 grossman@kiss:/export/netbsd/src/sys/arch/sparc/compile/TIGKI sparc


>Description:
	rlogin doesn't check root's .rhosts file to authenticate a login.
	It also doesn't check the presence of /etc/nologin to refuse user
        logins. This is in contrast to the documentation.

>How-To-Repeat:
	Create a .rhosts file for root and try to log in. Note that you're
	still prompted for a password.
	Touch /etc/nologin and try to log in as a user. Note that you
	succeed.

>Fix:
	Apply this patch to /usr/src/libexec/rlogind/rlogind.c:

===================================================================
RCS file: /export/netbsd/mastersrc/netbsd/libexec/rlogind/rlogind.c,v
retrieving revision 1.1.1.1
diff -c -r1.1.1.1 rlogind.c
*** rlogind.c	1995/02/09 18:53:08	1.1.1.1
--- rlogind.c	1995/05/26 14:52:26
***************
*** 483,492 ****
  	pwd = getpwnam(lusername);
  	if (pwd == NULL)
  		return (-1);
! 	if (pwd->pw_uid == 0)
! 		return (-1);
  	/* XXX why don't we syslog() failure? */
! 	return (iruserok(dest->sin_addr.s_addr, 0, rusername, lusername));
  }
  
  void
--- 483,496 ----
  	pwd = getpwnam(lusername);
  	if (pwd == NULL)
  		return (-1);
! 
!         if (pwd->pw_uid && !access(_PATH_NOLOGIN, F_OK)) {
!                 fatal(STDERR_FILENO, "Logins currently disabled.\n", 0);
!         }
! 
  	/* XXX why don't we syslog() failure? */
! 	return (iruserok(dest->sin_addr.s_addr, pwd->pw_uid == 0, 
! 			rusername, lusername));
  }
  
  void

>Audit-Trail:
>Unformatted: