A/UX 2.0: Restricted Login Problem


I want to set up a restricted account through the chroot command. The man pages for login say that you should be able to do this by using a "*/etc/passwd" in the place of a shell to be executed at startup. I tried to duplicate the problem and documented it below. If this is a bug that is not fixable in the near future, can you suggest a way to set up a restricted account, so that it has no way of getting to /? How is this done on the patch server?

Man page excerpt from login:

If the last field is *, then a chroot(2) is done to the directory named in the directory field of the entry. At that point, login is re-executed at the new level, which must have its own root structure, including /etc/login and /etc/passwd.

User toad's login sequence, it looks like it is trying to execute "*".

Apple Computer A/UX (ebc_A/UX)

login: toad
*: No such file or directory
No shell

Entry for user toad in /etc/passwd

toad::1009:1002:,,,:/users/toad:*

Directory structure for users/toad. The files are all linked rather than exact
copies. The shared library file was set up in case there was a problem, given
the problems I had with anonymous ftp.

ebc_aux.root # cd /users/toad
ebc_aux.root # ls
README
bin
etc
shlib
ebc_aux.root # cd bin
ebc_aux.root # ls -la
total 110
drwxr-xr-x 2 root gp1002 512 Aug 27 17:34 .
drwxr-x--- 5 toad gp1002 512 Aug 27 17:35 ..
-rwsr-xr-x 2 root root 53468 Apr 10 06:49 login
ebc_aux.root # cd ../etc
./etc: bad directory
ebc_aux.root # cd ..
ebc_aux.root # cd etc
ebc_aux.root # ls -la
total 8
drwxr-xr-x 2 root gp1002 512 Aug 27 17:32 .
drwxr-x--- 5 toad gp1002 512 Aug 27 17:35 ..
-rwxr--r-- 2 root sys 1068 Aug 27 18:37 passwd
ebc_aux.root # cd ..
ebc_aux.root # cd shlib
ebc_aux.root # ls -la
total 164
drwxr-xr-x 2 root gp1002 512 Aug 27 17:35 .
drwxr-x--- 5 toad gp1002 512 Aug 27 17:35 ..
-rwxr-xr-x 2 root root 81684 Apr 10 05:48 libc_s


This is a bug in the A/UX 2.0 login(1) command.  You would not be able to reproduce this by logging in to the console under A/UX 2.0.  This feature is a part of the System V login(1) command, which is not executed when logging in to the A/UX console.  Instead the /mac/bin/Login program is called, and it does not understand the "*" syntax in the /etc/passwd file.  Even when logging into the serial ports or the console when /mac/bin/Login is not present, the chroot does not work.  This is one reason why the patch server is still running A/UX 1.1.1.

You should use rsh(1) as a replacement for the functionality that has been lost in the A/UX 2.0 login command until a fix is provided.  rsh would normally be the way to accomplish restricted login anyway.
Published Date: Feb 18, 2012