>Number:         2798
>Category:       bin
>Synopsis:       rlogind prevents root logins
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    bin-bug-people (Utility Bug People)
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Oct  2 14:50:01 1996
>Last-Modified:
>Originator:     Chief Anarchic Officer
>Organization:
Star Wolf Innovations
>Release:        gnats-3.95
>Environment:
Release 1.2 userland, binaries, kernel
	
System: NetBSD sparc starwolf STARWOLF #1...
Architecture: sun4c

>Description:
	rlogind does not allow root logins at all.  While this may be a
	security issue, there should at least be an option to permit
	such operations if the administrator so desires.  I have enclosed
	a fix for this which explicitly requires rlogind to be recompiled
	with -DALLOW_ROOT in the Makefile.
>How-To-Repeat:
	add the following line to ~root/.rhosts
		localhost root
	and try to rlogin to localhost as root.  It will fail.
>Fix:
####### Makefile
*** Makefile	Wed Oct  2 14:38:02 1996
--- Makefile.orig	Wed Oct  2 14:36:29 1996
***************
*** 5,12 ****
  MAN=	rlogind.8
  DPADD=	${LIBUTIL}
  LDADD=	-lutil
- # uncomment this to allow super-user remote logins
- # THIS IS STRONGLY DISCOURAGED
- #CFLAGS+=	-DALLOW_ROOT
  
  .include <bsd.prog.mk>
--- 5,9 ----

####### rlogind.c
*** rlogind.c	Wed Oct  2 14:05:23 1996
--- rlogind.c.orig	Wed Oct  2 14:06:06 1996
***************
*** 79,89 ****
  #define TIOCPKT_WINDOW 0x80
  #endif
  
- #ifdef ALLOW_ROOT
- #define		ARGSTR			"alnr"
- #else
  #define		ARGSTR			"aln"
- #endif
  
  char	*env[2];
  #define	NMAX 30
--- 79,85 ----
***************
*** 92,98 ****
  #define	ENVSIZE	(sizeof("TERM=")-1)	/* skip null for concatenation */
  int	keepalive = 1;
  int	check_all = 0;
- int	allow_root = 0;
  
  struct	passwd *pwd;
  
--- 88,93 ----
***************
*** 132,142 ****
  		case 'n':
  			keepalive = 0;
  			break;
- #ifdef ALLOW_ROOT
- 		case 'r':
- 			allow_root = 1;
- 			break;
- #endif	/* ALLOW_ROOT */
  		case '?':
  		default:
  			usage();
--- 127,132 ----
***************
*** 493,503 ****
  	pwd = getpwnam(lusername);
  	if (pwd == NULL)
  		return (-1);
! 	if ((pwd->pw_uid == 0) && (allow_root == 0))
  		return (-1);
  	/* XXX why don't we syslog() failure? */
! 	return (iruserok(dest->sin_addr.s_addr, pwd->pw_uid == 0,
! 		rusername, lusername));
  }
  
  void
--- 483,492 ----
  	pwd = getpwnam(lusername);
  	if (pwd == NULL)
  		return (-1);
! 	if (pwd->pw_uid == 0)
  		return (-1);
  	/* XXX why don't we syslog() failure? */
! 	return (iruserok(dest->sin_addr.s_addr, 0, rusername, lusername));
  }
  
  void

>Audit-Trail:
>Unformatted: