Debian Bug report logs - #451521
small logging improvement to login

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Thiemo Nagel <tnagel@e18.physik.tu-muenchen.de>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: small logging improvement to login

Date: Fri, 16 Nov 2007 15:42:32 +0100

Package: login
Version: 1:4.0.18.1-7
Severity: wishlist
Tags: patch


I'm sending a small patch to improve logging of login.  When getpwnam() fails inside the PAM section, login
would just silently quit, which caused me a considerable amount of pain while debugging my setup.  I thought,
I'd help avoid others falling into that trap in the future.

Kind regards,

Thiemo


--- login.c-orig        2007-11-16 15:23:59.000000000 +0100
+++ login.c     2007-11-16 15:32:17.000000000 +0100
@@ -745,10 +745,18 @@
                        PAM_FAIL_CHECK;
                }

-               if (!pwd || setup_groups (pwd))
+               if (!pwd) {
+                       SYSLOG ((LOG_ERR, "getpwnam(%s) failed", pam_user));
                        exit (1);
-               else
-                       pwent = *pwd;
+               }
+
+               if (setup_groups (pwd)) {
+                       SYSLOG ((LOG_ERR, "setup_groups() failed for user %s",
+                                pam_user));
+                       exit (1);
+               }
+
+               pwent = *pwd;

                retcode = pam_setcred (pamh, PAM_ESTABLISH_CRED);
                PAM_FAIL_CHECK;



-- System Information:
Debian Release: 4.0
  APT prefers stable
  APT policy: (500, 'stable')
Architecture: i386 (i686)
Shell:  /bin/sh linked to /bin/bash
Kernel: Linux 2.6.18-5-486
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)

Versions of packages login depends on:
ii  libc6                  2.3.6.ds1-13etch2 GNU C Library: Shared libraries
ii  libpam-modules         0.79-4            Pluggable Authentication Modules f
ii  libpam-runtime         0.79-4            Runtime support for the PAM librar
ii  libpam0g               0.79-4            Pluggable Authentication Modules l

login recommends no packages.

-- no debconf information

Message #10 received at 451521@bugs.debian.org (full text, mbox, reply):

From: Nicolas François <nicolas.francois@centraliens.net>

To: Thiemo Nagel <tnagel@e18.physik.tu-muenchen.de>, 451521@bugs.debian.org

Subject: Re: Bug#451521: small logging improvement to login

Date: Sat, 17 Nov 2007 17:03:01 +0100

[Message part 1 (text/plain, inline)]

tags 451521 fixed-upstream
thanks

Hello,

On Fri, Nov 16, 2007 at 03:42:32PM +0100, tnagel@e18.physik.tu-muenchen.de wrote:
> 
> I'm sending a small patch to improve logging of login.  When getpwnam() fails inside the PAM section, login
> would just silently quit, which caused me a considerable amount of pain while debugging my setup.  I thought,
> I'd help avoid others falling into that trap in the future.

Thanks for the patch.

I did not apply this patch, but another which should also solve your
issue.

 * setup_groups already log information about the issue, so an additional
   log is not required.
 * if the password entry could not be retrieved, it is not recommended to
   log the username: users sometimes enter their password instead of
   login.
   This is the default behavior, which can be turned off with
   LOG_UNKFAIL_ENAB in /etc/login.defs.

Please find attached the patch applied upstream for the next version.
-- 
Nekral

[shadow_login_log.patch (text/x-diff, attachment)]

Message #17 received at 451521@bugs.debian.org (full text, mbox, reply):

From: Nicolas François <nicolas.francois@centraliens.net>

To: Thiemo Nagel <tnagel@e18.physik.tu-muenchen.de>, 451521@bugs.debian.org

Subject: Re: Bug#451521: small logging improvement to login

Date: Sat, 17 Nov 2007 19:19:46 +0100

[Message part 1 (text/plain, inline)]

And now, the real patch...

-- 
Nekral

[shadow_login_log.patch (text/x-diff, attachment)]

Message #22 received at 451521@bugs.debian.org (full text, mbox, reply):

From: Thiemo Nagel <tnagel@e18.physik.tu-muenchen.de>

To: Nicolas François <nicolas.francois@centraliens.net>

Cc: 451521@bugs.debian.org

Subject: Re: Bug#451521: small logging improvement to login

Date: Sun, 18 Nov 2007 18:35:23 +0100

> I did not apply this patch, but another which should also solve your
> issue.

Thanks a lot!  Your changes make more sense than mine.
--
Kind regards,

Thiemo

Message #29 received at 451521-close@bugs.debian.org (full text, mbox, reply):

From: Christian Perrier <bubulle@debian.org>

To: 451521-close@bugs.debian.org

Subject: Bug#451521: fixed in shadow 1:4.1.0-1

Date: Sat, 12 Jan 2008 22:47:02 +0000

Source: shadow
Source-Version: 1:4.1.0-1

We believe that the bug you reported is fixed in the latest version of
shadow, which is due to be installed in the Debian FTP archive:

login_4.1.0-1_i386.deb
  to pool/main/s/shadow/login_4.1.0-1_i386.deb
passwd_4.1.0-1_i386.deb
  to pool/main/s/shadow/passwd_4.1.0-1_i386.deb
shadow_4.1.0-1.diff.gz
  to pool/main/s/shadow/shadow_4.1.0-1.diff.gz
shadow_4.1.0-1.dsc
  to pool/main/s/shadow/shadow_4.1.0-1.dsc
shadow_4.1.0.orig.tar.gz
  to pool/main/s/shadow/shadow_4.1.0.orig.tar.gz



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 451521@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Christian Perrier <bubulle@debian.org> (supplier of updated shadow package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Sat, 12 Jan 2008 20:40:02 +0100
Source: shadow
Binary: login passwd
Architecture: source i386
Version: 1:4.1.0-1
Distribution: unstable
Urgency: low
Maintainer: Shadow package maintainers <pkg-shadow-devel@lists.alioth.debian.org>
Changed-By: Christian Perrier <bubulle@debian.org>
Description: 
 login      - system login tools
 passwd     - change and administer password and group data
Closes: 447747 451518 451521 452291 452296 454485 454584
Changes: 
 shadow (1:4.1.0-1) unstable; urgency=low
 .
   [ Nicolas FRANCOIS (Nekral) ]
   * The "Bleu d'Auvergne" release
   * New upstream release. This closes the following bugs:
     - usermod: Make usermod options independent of the argument order.
       Closes: #451518
     - login: Improve logging of login when the user's passwd entry could not
       be retrieved.  Closes: #451521
     - Updated Russian translations. Thanks to Yuri Kozlov <kozlov.y@gmail.com>.
       Closes: #452291, #452296
     - Section of newgrp fixed in the gshadow manpage. Closes: #454485
     - Remove patches applied upstream:
       + 468_duplicate_passwd_struct_before_usage
       + 495_salt_stack_smash
       + 397_non_numerical_identifier
       + 405_su_no_pam_end_before_exec
       + 493_pwck_no_SHADOWPWD
       + 497_newgrp_primary_group
       + 409_man_generate_from_PO
       + 410_newgrp_man_mention_sg
       + 411_chpasswd_document_no_pam
       + 494_passwd_lock
       + 417_passwd_warndays
     - Updated patches:
       + debian/patches/504_undef_USE_PAM.dpatch
         MD5_CRYPT_ENAB is back in login.defs to define the default crypt
         algorithm. It is tagged as deprecated and ENCRYPT_METHOD is
         recommended instead. New algorithms are also available.
         Closes: #447747
   * Debian packaging fixes:
     - debian/rules: compile with -W -Wall
     - debian/rules: large files are now supported by configure. Remove
       -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 from
       CFLAGS.
     - 479_chowntty_debug was debian specific. Renamed to 579_chowntty_debug
     - Remove (not applied patch) 419_time_structures.dpatch. All its chunks
       are already applied upstream (with some differences), except one chunk
       which comes from 008_login_log_failure_in_FTMP. Fix
       008_login_log_failure_in_FTMP. This should fix some bugs causing invalid
       faillog entries on 64 bit architectures with 32 bit compatibility.
     - debian/securetty.linux: Add ttyS1. Better comments for the ttyS and xen
       consoles. Add a note for the devfs consoles. They are no more needed for
       most users. Closes: #454584
 .
   [ Christian Perrier ]
   * debian/control
     - Updated to Standards: 3.7.3.0 (checked, no change needed)
Files: 
 977492375a314b0f29151e1bb04087bd 1041 admin required shadow_4.1.0-1.dsc
 c25eb47acbed087ee795bdc16d3bd6b1 2651512 admin required shadow_4.1.0.orig.tar.gz
 04e0877eccdc189c3eb99b0bc011a6bd 81158 admin required shadow_4.1.0-1.diff.gz
 723abc09f0d3088b9e5fc27655da10c7 804454 admin required passwd_4.1.0-1_i386.deb
 1f2cf1fffe2474ea9db849d00de00e11 819076 admin required login_4.1.0-1_i386.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFHiT2Z1OXtrMAUPS0RAvlnAJsEAOoDxO2G1GGu8HJJEnQxvIX5DQCgnIWG
M6f32UNUk+CU0KLvcehcKps=
=6v43
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.