OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
From: Roger Dunk (rogerat.com.au)
Date: Mon Feb 19 2001 - 04:56:47 CST

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

    G'day all,

    I run a Cobalt RAQ 3 with the default Apache v1.3.6 installed. Up until
    recently, Apache would authorise users off the /etc/password and /etc/shadow
    files via PAM without a problem. However, I recently had to re-install PAM,
    so I went for the latest version (v0.74). Now Apache fails to authorise
    users. I then reinstalled the original version of PAM (v0.68), and the
    problem didn't go away. The strange thing is I have one instance of httpd
    running on port 81 as an admin server (this is part of the RAQ), which DOES
    authenticate properly, and the normal web server on port 80 which
    WON'T authenticate. I can't for the life of me work out why.

    Does anyone have any ideas? How can I track down exactly where the problem
    lies?

    FWIW, other programs such as proftpd etc work without a problem.

    I've included a partial trace below, which may shed some light on the
    problem.

    [pid 18118] open("/etc/pwdb.conf", O_RDONLY) = 6
    [pid 18118] recvmsg(6, 0xbffffc6c, 0x4014fd40) = -1 ENOSYS (Function not
    impleme
    nted)
    [pid 18118] fstat(6, {st_mode=0, st_size=0, ...}) = 0
    [pid 18118] mmap(0, 4096, PROT_READ|PROT_WRITE,
    MAP_PRIVATE|MAP_ANONYMOUS, -1, 0
    ) = 0x40015000
    [pid 18118] read(6, "#\n# This is the configuration f"..., 4096) = 134
    [pid 18118] read(6, "", 4096) = 0
    [pid 18118] close(6) = 0
    [pid 18118] munmap(0x40015000, 4096) = 0
    [pid 18118] getrlimit(RLIMIT_CORE, {rlim_cur=0, rlim_max=RLIM_INFINITY}) = 0
    [pid 18118] setrlimit(RLIMIT_CORE, {rlim_cur=0, rlim_max=RLIM_INFINITY}) = 0
    [pid 18118] getuid() = 15
    [pid 18118] open("/etc/passwd", O_RDONLY) = 6
    [pid 18118] fstat(6, {st_mode=0, st_size=0, ...}) = 0
    [pid 18118] mmap(0, 4096, PROT_READ|PROT_WRITE,
    MAP_PRIVATE|MAP_ANONYMOUS, -1, 0
    ) = 0x40015000
    [pid 18118] read(6, "root:x:0:0:Root:/root:/bin/sh\nb"..., 4096) = 4096
    [pid 18118] close(6) = 0
    [pid 18118] munmap(0x40015000, 4096) = 0
    [pid 18118] time(NULL) = 982579145
    [pid 18118] time(NULL) = 982579145
    [pid 18118] time(NULL) = 982579145
    [pid 18118] time(NULL) = 982579145
    [pid 18118] time(NULL) = 982579145
    [pid 18118] time(NULL) = 982579145
    [pid 18118] time(NULL) = 982579145
    [pid 18118] time(NULL) = 982579145
    [pid 18118] time(NULL) = 982579145
    [pid 18118] open("/etc/shadow", O_RDONLY) = 6
    [pid 18118] fstat(6, {st_mode=0, st_size=0, ...}) = 0
    [pid 18118] mmap(0, 4096, PROT_READ|PROT_WRITE,
    MAP_PRIVATE|MAP_ANONYMOUS, -1, 0
    ) = 0x40015000
    [pid 18118] read(6, "root:$1$Efk53l18$aYqlRO.UxoEZ7WB"..., 4096) = 4096
    [pid 18118] close(6) = 0
    [pid 18118] munmap(0x40015000, 4096) = 0
    [pid 18118] time(NULL) = 982579145
    [pid 18118] time(NULL) = 982579145
    [pid 18118] time(NULL) = 982579145
    [pid 18118] time(NULL) = 982579145
    [pid 18118] time(NULL) = 982579145
    [pid 18118] time(NULL) = 982579145
    [pid 18118] time(NULL) = 982579145
    [pid 18118] read(0, "mypassword\0", 200) = 8
    [pid 18118] time(NULL) = 982579145
    [pid 18118] brk(0x8051000) = 0x8051000
    [pid 18118] time([982579145]) = 982579145
    [pid 18118] open("/etc/localtime", O_RDONLY) = 6
    [pid 18118] read(6, "TZif\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 44) = 44
    [pid 18118] read(6, "\236\246H\240\237\273\25\220\240"..., 920) = 920
    [pid 18118] fstat(6, {st_mode=0, st_size=0, ...}) = 0
    [pid 18118] mmap(0, 4096, PROT_READ|PROT_WRITE,
    MAP_PRIVATE|MAP_ANONYMOUS, -1, 0
    ) = 0x40015000
    [pid 18118] read(6, "\377\377\235\220\1\0\377\377\217"..., 4096) = 36
    [pid 18118] close(6) = 0
    [pid 18118] munmap(0x40015000, 4096) = 0
    [pid 18118] getpid() = 18118
    [pid 18118] SYS_174(0xd, 0xbffffba0, 0xbffffb14, 0x8, 0xd) = 0
    [pid 18118] socket(PF_UNIX, SOCK_DGRAM, 0) = 6
    [pid 18118] fcntl(6, F_SETFD, FD_CLOEXEC) = 0
    [pid 18118] connect(6, {sun_family=AF_UNIX, sun_path="/dev/log"}, 16) = 0
    [pid 18118] send(6, "<36>Feb 19 02:39:05 pwdb_chkpwd["..., 58, 0) = 58
    [pid 18118] SYS_174(0xd, 0xbffffba4, 0, 0x8, 0xd) = 0
    [pid 18118] close(6) = 0
    [pid 18118] getrlimit(RLIMIT_CORE, {rlim_cur=0, rlim_max=RLIM_INFINITY}) = 0
    [pid 18118] setrlimit(RLIMIT_CORE, {rlim_cur=0, rlim_max=RLIM_INFINITY}) = 0
    [pid 18118] _exit(1) = ?
    <... wait4 resumed> [WIFEXITED(s) && WEXITSTATUS(s) == 1], 0, NULL) = 18118
    --- SIGCHLD (Child exited) ---
    getrlimit(RLIMIT_CORE, {rlim_cur=0, rlim_max=RLIM_INFINITY}) = 0
    setrlimit(RLIMIT_CORE, {rlim_cur=0, rlim_max=RLIM_INFINITY}) = 0
    open("/etc/nologin", O_RDONLY) = -1 ENOENT (No such file or
    directory)
    select(0, NULL, NULL, NULL, {0, 844565}) = 0 (Timeout)
    socket(PF_UNIX, SOCK_STREAM, 0) = 5
    connect(5, {sun_family=AF_UNIX, sun_path="/var/run/.nscd_socket"}, 110) = -1
    ECO
    NNREFUSED (Connection refused)
    close(5) = 0
    open("/etc/hosts", O_RDONLY) = 5
    fcntl(5, F_GETFD) = 0
    fcntl(5, F_SETFD, FD_CLOEXEC) = 0
    fstat(5, {st_mode=0, st_size=0, ...}) = 0
    mmap(0, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) =
    0x400160
    00
    read(5, "127.0.0.1\tlocalhost\n64.19.11.1"..., 4096) = 64
    read(5, "", 4096) = 0
    close(5) = 0
    munmap(0x40016000, 4096) = 0
    socket(PF_INET, SOCK_DGRAM, IPPROTO_IP) = 5
    connect(5, {sin_family=AF_INET, sin_port=htons(53),
    sin_addr=inet_addr("64.29.16
    .107")}, 16) = 0
    send(5, "\311\343\1\0\0\1\0\0\0\0\0\0\003"..., 44, 0) = 44
    time(NULL) = 982579146
    SYS_168(0xbfffeba4, 0x1, 0x1388, 0x1388, 0xbfffeba4) = 1
    recvfrom(5, "\311\343\201\200\0\1\0\1\0\2\0\2"..., 1024, 0,
    {sin_family=AF_INET,
     sin_port=htons(53), sin_addr=inet_addr("64.29.16.107")}, [16]) = 171
    close(5) = 0
    time(NULL) = 982579146
    write(17, "[Mon Feb 19 02:39:06 2001] [erro"..., 127) = 127
    munmap(0x4043e000, 43204) = 0
    munmap(0x40449000, 288060) = 0
    munmap(0x40345000, 7060) = 0
    munmap(0x403ac000, 32416) = 0
    munmap(0x40493000, 44224) = 0
    munmap(0x40490000, 7148) = 0
    munmap(0x4049e000, 6152) = 0
    stat("/home/sites/home/web", {st_mode=0, st_size=0, ...}) = 0
    stat("/usr/admserv/html/.cobalt/error/authorizationRequired.html",
    {st_mode=0, s
    t_size=0, ...}) = 0
    lstat("/usr", {st_mode=0, st_size=0, ...}) = 0
    lstat("/usr/admserv", {st_mode=0, st_size=0, ...}) = 0
    lstat("/usr/admserv/html", {st_mode=0, st_size=0, ...}) = 0
    lstat("/usr/admserv/html/.cobalt", {st_mode=0, st_size=0, ...}) = 0
    lstat("/usr/admserv/html/.cobalt/error", {st_mode=0, st_size=0, ...}) = 0
    lstat("/usr/admserv/html/.cobalt/error/authorizationRequired.html",
    {st_mode=0,
    st_size=0, ...}) = 0
    SYS_174(0xe, 0, 0xbffff8a8, 0x8, 0xe) = 0
    dup2(17, 2) = 2
    SYS_175(0, 0, 0xbffff980, 0x8, 0) = 0
    stat("/etc/cobalt/locale", {st_mode=0, st_size=0, ...}) = 0
    pipe([5, 7]) = 0
    fork() = 18119
    [pid 16899] close(7) = 0
    [pid 16899] fcntl(5, F_GETFL) = 0 (flags O_RDONLY)
    [pid 16899] fstat(5, {st_mode=0, st_size=0, ...}) = 0
    [pid 16899] mmap(0, 4096, PROT_READ|PROT_WRITE,
    MAP_PRIVATE|MAP_ANONYMOUS, -1, 0
    ) = 0x40016000
    [pid 16899] _llseek(0x5, 0, 0, 0xbffff698, 0x1) = -1 ESPIPE (Illegal seek)
    [pid 16899] read(5, <unfinished ...>
    [pid 18119] close(5) = 0
    [pid 18119] dup2(7, 1) = 1
    [pid 18119] close(7) = 0
    [pid 18119] execve("min/cat", ["cat", "/etc/cobalt/locale"], [/* 54 vars
    */]) =
    -1 ENOENT (No such file or directory)
    [pid 18119] execve("/usr/sbin/cat", ["cat", "/etc/cobalt/locale"], [/* 54
    vars *
    /]) = -1 ENOENT (No such file or directory)
    [pid 18119] execve("/bin/cat", ["cat", "/etc/cobalt/locale"], [/* 54 vars
    */]) =
     0
    [pid 18119] brk(0) = 0x804ad3c
    [pid 18119] mmap(0, 4096, PROT_READ|PROT_WRITE,
    MAP_PRIVATE|MAP_ANONYMOUS, -1, 0
    ) = 0x40014000
    [pid 18119] open("/etc/ld.so.preload", O_RDONLY) = -1 ENOENT (No such file
    or di
    rectory)
    [pid 18119] open("/etc/ld.so.cache", O_RDONLY) = 5
    [pid 18119] fstat(5, {st_mode=0, st_size=0, ...}) = 0
    [pid 18119] mmap(0, 9922, PROT_READ, MAP_PRIVATE, 5, 0) = 0x40015000
    [pid 18119] close(5) = 0
    [pid 18119] open("/lib/libc.so.6", O_RDONLY) = 5
    [pid 18119] fstat(5, {st_mode=0, st_size=0, ...}) = 0
    [pid 18119] read(5, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3"..., 4096) = 4096
    [pid 18119] mmap(0, 1001532, PROT_READ|PROT_EXEC, MAP_PRIVATE, 5, 0) =
    0x4001800
    0
    [pid 18119] mprotect(0x40105000, 30780, PROT_NONE) = 0
    [pid 18119] mmap(0x40105000, 16384, PROT_READ|PROT_WRITE,
    MAP_PRIVATE|MAP_FIXED,
     5, 0xec000) = 0x40105000
    [pid 18119] mmap(0x40109000, 14396, PROT_READ|PROT_WRITE,
    MAP_PRIVATE|MAP_FIXED|
    MAP_ANONYMOUS, -1, 0) = 0x40109000
    [pid 18119] close(5) = 0
    [pid 18119] mprotect(0x40018000, 970752, PROT_READ|PROT_WRITE) = 0
    [pid 18119] mprotect(0x40018000, 970752, PROT_READ|PROT_EXEC) = 0
    [pid 18119] munmap(0x40015000, 9922) = 0
    [pid 18119] personality(PER_LINUX) = 0
    [pid 18119] getpid() = 18119
    [pid 18119] brk(0) = 0x804ad3c
    [pid 18119] brk(0x804ad74) = 0x804ad74
    [pid 18119] brk(0x804b000) = 0x804b000
    [pid 18119] fstat(1, {st_mode=0, st_size=0, ...}) = 0
    [pid 18119] open("/etc/cobalt/locale", O_RDONLY) = 5
    [pid 18119] fstat(5, {st_mode=0, st_size=0, ...}) = 0
    [pid 18119] brk(0x804d000) = 0x804d000
    [pid 18119] read(5, "en_US\n", 4096) = 6
    [pid 18119] write(1, "en_US\n", 6) = 6
    [pid 18119] read(5, "", 4096) = 0
    [pid 18119] close(5) = 0
    [pid 18119] close(1) = 0
    [pid 18119] _exit(0) = ?
    <... read resumed> "en_US\n", 4096) = 6
    --- SIGCHLD (Child exited) ---
    read(5, "", 4096) = 0
    close(5) = 0
    munmap(0x40016000, 4096) = 0
    SYS_174(0x1, 0xbffff4d4, 0xbffff448, 0x8, 0x1) = 0
    SYS_174(0x2, 0xbffff4c8, 0xbffff43c, 0x8, 0x2) = 0
    SYS_174(0x3, 0xbffff4bc, 0xbffff430, 0x8, 0x3) = 0
    wait4(18119, [WIFEXITED(s) && WEXITSTATUS(s) == 0], 0, NULL) = 18119
    SYS_174(0x1, 0xbffff574, 0, 0x8, 0x1) = 0
    SYS_174(0x2, 0xbffff56c, 0, 0x8, 0x2) = 0
    SYS_174(0x3, 0xbffff564, 0, 0x8, 0x3) = 0
    stat("/etc/sysconfig/i18n", 0xbffff8cc) = -1 ENOENT (No such file or
    directory)
    stat("/usr/admserv/html/.cobalt/error/authorizationRequired.html",
    {st_mode=0, s
    t_size=0, ...}) = 0
    stat("/usr/admserv/html/.cobalt/error/authorizationRequired.html",
    {st_mode=0, s
    t_size=0, ...}) = 0
    getgroups(32, [1074921483]) = 1
    stat("/usr/admserv/html/.cobalt/error/authorizationRequired.html",
    {st_mode=0, s
    t_size=0, ...}) = 0
    open("/usr/admserv/html/.cobalt/error/authorizationRequired.html", O_RDONLY)
    = 5
    fstat(5, {st_mode=0, st_size=0, ...}) = 0
    fcntl(5, F_SETFD, FD_CLOEXEC) = 0
    fstat(5, {st_mode=0, st_size=0, ...}) = 0
    mmap(0, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) =
    0x400160
    00
    read(5, "<HTML>\n\n<HEAD><TITLE>[str.auth"..., 4096) = 653
    read(5, "", 4096) = 0
    SYS_175(0, 0, 0xbffff934, 0x8, 0) = 0
    close(5) = 0
    munmap(0x40016000, 4096) = 0
    select(4, [3], NULL, NULL, {0, 0}) = 0 (Timeout)
    write(3, "HTTP/1.1 401 Authorization Requi"..., 1103) = 1103

    _______________________________________________
    Pam-list mailing list
    Pam-listredhat.com
    https://listman.redhat.com/mailman/listinfo/pam-list