From: bugzilla at busybox.net <bugzilla@busybox.net>
To: buildroot@busybox.net
Subject: [Buildroot] [Bug 12181] New: dropbear: norootlogin (-w) no longer works when PAM is enabled
Date: Wed, 04 Sep 2019 14:06:27 +0000 [thread overview]
Message-ID: <bug-12181-163@https.bugs.busybox.net/> (raw)
https://bugs.busybox.net/show_bug.cgi?id=12181
Bug ID: 12181
Summary: dropbear: norootlogin (-w) no longer works when PAM is
enabled
Product: buildroot
Version: 2019.02.5
Hardware: All
OS: Linux
Status: NEW
Severity: critical
Priority: P5
Component: Other
Assignee: unassigned at buildroot.uclibc.org
Reporter: jan.dumon at septentrio.com
CC: buildroot at uclibc.org
Target Milestone: ---
This affects dropbear 2018.76 in 2019.02.5 and earlier.
The vanilla dropbear 2018.76 doesn't have this problem, it is introduced
(ironically) by the patch for CVE-2018-15599 in
https://git.busybox.net/buildroot/commit?id=4a3b0ba38fde05e8f8c3512d516d86803efa44c0
It only happens when PAM is enabled & used.
When invoked with the -w command line argument, root logins should be
disallowed, but when someone attempts to login as root, the following happens:
- login attempt for root
- password is asked
- norootlogin is set but pam is invoked anyway
- pam validates the password and an 'already authenticated flag' gets set
- login still fails (as is expected) and password is asked again
- regardless of input, root can log in because he was authenticated before.
(completely unexpected !!!)
It's still required to have a proper password but the root login should not be
allowed per the -w command line argument.
--
You are receiving this mail because:
You are on the CC list for the bug.
next reply other threads:[~2019-09-04 14:06 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-09-04 14:06 bugzilla at busybox.net [this message]
2019-09-04 14:10 ` [Buildroot] [Bug 12181] dropbear: norootlogin (-w) no longer works when PAM is enabled bugzilla at busybox.net
2019-09-04 19:57 ` bugzilla at busybox.net
2019-09-04 20:02 ` bugzilla at busybox.net
2019-09-05 7:58 ` bugzilla at busybox.net
2019-09-05 10:16 ` bugzilla at busybox.net
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=bug-12181-163@https.bugs.busybox.net/ \
--to=bugzilla@busybox.net \
--cc=buildroot@busybox.net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.