From leon@hermes.si Tue May 7 16:19:54 1996 Status: RO X-VM-v5-Data: ([nil nil nil nil nil nil nil nil nil] ["10512" "Tue" "7" "May" "1996" "15:16:59" "+0200" "Leon Mlakar" "leon@hermes.si" nil "220" "SSH on HP-UX 10.0 Secure System" "^From:" nil nil "5" nil nil nil nil] nil) Received: from muuri.ssh.fi (muuri.ssh.fi [192.168.2.254]) by pilari.ssh.fi (8.7.5/8.7.3) with ESMTP id QAA21028 for ; Tue, 7 May 1996 16:19:40 +0300 (EET DST) Received: from hutcs.cs.hut.fi (root@hutcs.cs.hut.fi [130.233.192.6]) by muuri.ssh.fi (8.7.5/8.7.3) with ESMTP id QAA18588 for ; Tue, 7 May 1996 16:19:33 +0300 (EET DST) Received: from iki.fi (root@iki.fi [194.100.45.81]) by hutcs.cs.hut.fi (8.7.5/8.7.3) with ESMTP id QAA03206 for ; Tue, 7 May 1996 16:19:25 +0300 (EET DST) Received: from sparc.eunet.si (sparc.eunet.si [193.77.2.66]) by iki.fi (8.7.5/8.7.3) with SMTP id QAA12955 for ; Tue, 7 May 1996 16:19:02 +0300 (EET DST) Received: from guardian.hermes.si (guardian.hermes.si [193.77.5.150]) by sparc.eunet.si (8.6.8/8.7.3) with ESMTP id PAA06577; Tue, 7 May 1996 15:22:09 +0200 Received: from graybox.hermes.si by relay.hermes.si with ESMTP (1.39.111.2/16.2) id AA147555028; Tue, 7 May 1996 15:17:08 +0200 Received: from graybox.hermes.si (localhost [127.0.0.1]) by graybox.hermes.si (8.6.11/8.6.9) with ESMTP id PAA00746; Tue, 7 May 1996 15:17:04 +0200 Message-Id: <199605071317.PAA00746@graybox.hermes.si> X-Mailer: exmh version 1.6 4/21/95 Return-Receipt-To: X-Organization: HERMES SoftLab, Litijska 51, 61000 Ljubljana, Slovenia X-Phone: +386 61 1865 239 From: Leon Mlakar To: ylo@ssh.fi Cc: Iztok.Umek@snet.fri.uni-lj.si Subject: SSH on HP-UX 10.0 Secure System Date: Tue, 07 May 1996 15:16:59 +0200 Reply-To: Leon Mlakar Content-Type: application/pgp; format=mime; x-action=signclear; x-originator=C8F243E1 Content-Transfer-Encoding: 7bit Mime-Version: 1.0 -----BEGIN PGP SIGNED MESSAGE----- content-type: text/plain; charset=us-ascii Tatu, I have modified SSH 1.2.13 to run on HP-UX 10.0 when configured as secure system. HP-UX then uses a secure account database, which is basically a SecureWare library (see www.secureware.com) with little adoptions for HP-UX. I don't have other secureware systems arround hence the patch is HP-UX specific. Admittely, it is a half-hearted job with a "rude" modification of auth-passwd.c. Nevertheless, it figures out whether the system is configured as secure system or not - hence you can run it on "normal" HP-UX 10.0 systems as well. The behavior is then the same as with non-patched version. On secure systems it does: o extract the encrypted password from the secure database o prevent login by any authentication method if the administrator has locked the account o records a successful interractive login by any authentication method and records an unseccusfull login when password authentication fails o updates unsuccessful login counter at failed password authentication o resets unsuccessful login counter upon any succesful authentication o upon interactive login displays the last login messages for successful and unssucceful attempts - the difference against standard login is that the times are displayed in local timezone and not GMT o denies the password authentication if: - password is not set (on these systems the account, when created, receives a password validation number, which at the first login lets the user to modify the password. - too many unsuccessful logins (passwd authentications) have been encountered. The limit is set by admin - the password is not correct (obviously ;-) o the login terminal device for ssh logins for the last login record is marked as ssh@pts/0. It does not: o support password setting for the new accounts (through password validation number) o check the permitted login hours for users o ckeck the password expiration or too long interval between two successive logins o check the user access lists per terminal o check the login hours per terminal o ... support other fancy security features as I don't even know all of them I have used two new defines: -DHPUX_10=1 to bring in HP specific header files and -DSECUREWARE=1 for the rest of the code. It is also necessary to add -lsec into the LIBS variable. I have updated configure script to reflect the change but did not modify configure.in. It is unlikely that I'll spend more time on enhancing the integration with SecureWare features. If you think the patch is good enough to be distributed arround please feel free to do so. Apart from appending it at the end I will make it available from ftp.hermes.si in /pub/ssh. BTW, the configuration I use is: configure --prefix=/opt/ssh --with-etcdir=/etc/opt/ssh I compile the stuff with HP ANSI C compiler. I have tested the secure system on HP-UX 10.10 and normal system on HP-UX 10.01. Regards, Leon #!/bin/sh # This is a shell archive (produced by GNU sharutils 4.1). # To extract the files from this archive, save it to some FILE, remove # everything before the `!/bin/sh' line above, then type `sh FILE'. # # Made on 1996-05-07 15:05 MET DST by . # Source directory was `/home/leon/src'. # # Existing files will *not* be overwritten unless `-c' is specified. # # This shar contains: # length mode name # ------ ---------- ------------------------------------------ # 3998 -rw-r--r-- ssh-1.2.13-hpux10-secureware.patch.gz # touch -am 1231235999 $$.touch >/dev/null 2>&1 if test ! -f 1231235999 && test -f $$.touch; then shar_touch=touch else shar_touch=: echo echo 'WARNING: not restoring timestamps. Consider getting and' echo "installing GNU \`touch', distributed in GNU File Utilities..." echo fi rm -f 1231235999 $$.touch # # ============= ssh-1.2.13-hpux10-secureware.patch.gz ============== if test -f 'ssh-1.2.13-hpux10-secureware.patch.gz' && test X"$1" != X"-c"; then echo 'x - skipping ssh-1.2.13-hpux10-secureware.patch.gz (file already exists)' else echo 'x - extracting ssh-1.2.13-hpux10-secureware.patch.gz (binary)' sed 's/^X//' << 'SHAR_EOF' | uudecode && begin 600 ssh-1.2.13-hpux10-secureware.patch.gz M'XL("#9)CS$``W-S:"TQ+C(N,3,M:'!U>#$P+7-E8W5R97=A.Y[KLK[-^@E+TVG?&(P&QL:ZE6?3?FRE MZAW]KJ;1N,_D2X^.O+.CT!U,6Y7QV\#R_<@6PX^Z\,1E#G>]D#OM%Z\O?S*-88<]>5*,34Z> M7EZ<_'AT<=*AV1+.-^D\7<_F,4\'T\/*@VF<?Q(G42;'>.AX+GPA MTES`Q5X<_7!B$K+38QA=7V.3/(ZC)&-NE+")!,F.YZ$5>'8J1DZ/F6TES@`6 MP.MI%&:)=Y5GW&%7,#4*+=]A+^WO/=_W;"MDWSB!?8-_?/NK/;CBOC^PK<,! M6UMOE/..T=O9%G)F3)#T)O%XRK*(H?IXF`'4C#/XRG*0-[QYX34CK49`%6,7 M/,N3$%8DH&!@F,C4UGI1R-+4/';C"H M\]*V/A_739H>[8Q[(Z5K%,MHU^B-MPJO(KD<55GR4F8!4S$:&[@0RH>'=C*G M`444S$E`*(Y8YQ/[""XAF;$T2^P@;A?K"M:1Q23A=B9&G`X[.&##?5C[@;S' M3[EPD4*`"+G[*=37_9CZNA@U_K"RNJ"L[D>5I$`T;+ON&9F4)4 M-QU^E5^W6T*AS(G`&,,()$V@&($JF?"C:R\UWD>=T`#VR#))I:Q`E0<>*$A`#B8RR%'S,TXP'/4`,]&;H'.`[ZSRSUV5V M%M2M%/!`+4^GW+XAV:-,4S;SLBG`UMQ*JH(ITN6#GX>_Z'*.9_W#>"8EJSWK M%(M+%I?(^0PE**6+]H&D1#DX9RGD*VY;BFD(65$.OCNUT@K!N@I*+1C[%%&4 M?=46,2MTZ@J=61A)/%X50:'&0AX?97S1&DIK`^L6<:`,EQ6`&B]UQ.#W(8;< MN+:DAQ'!YV$[[G2J1%0-LB*45ONH7:9*'`<:$9R% MN->F3$6:E]_+"B^1*!T5.AJBP[J7[(";S0`U%;6934C8Y=1^!ZKN7Y M^Q7+6=0D,`C2L3F;\67N+`20HE-;/K,R61A";G%UG$7LE(XQ8$.0NB*6.B'>B>3S!JX8GP'SY(XTJCH&O'2ZTK M'YCZ%,JN!@"=%5EDN;YUK8P9=03ZR%,,:.\X:(6'+`^I7$E3-R?%8X1*%P*R M+NJ0TE"ZC'MT7TT[)'6Y9(G@E^DTL&[-C.JS6IQCH.DJ@G)J3=_%@P;'+R4% MLS!.$0`EK(@-28*^AYE8JC5?\V1JQ2G&/#`8*")\)_PZ`Y]BZ&40&'U?4E_;'JC9"A&L`.^XQAH` M2X?2&^>E.^*V2$R"/`F4`2L8RD!"[4*D;A[:"!_!Y"F>GU#!"(N!DB8?3_BU ME3@^!7FT=`6HMIL).)1(#FM#/F!1"%1!IN9)8@&R=YS)6,!F4RSO-2C-<049 M(2"*&[<:]*NX%2R0,.039Z#^EAH$&*:.QI1H&C8/RQ1-;WK-\J'&[8O&]9*-0-7[I+^=1ZHF:$!+ M*!^GK1ZK0/^8"RV6@UK.`GE\BB2^'+_$C7@.*\I-,[`NNT%C*61%D^2)PI*! M#N&3J348VH,-`D)D4II%I;;MR0WT9["*+\,XA'X:+`,G`_45!P)2VZ5ZY*EL M._5^XY';KHL:$@U;7/,"WB;)%>? M)\"`=&`'*\'HVHD/X`%6_.WAW>+'8SP0/]A]+ZY8"Y8@JZJ::*T[_-UZJX?3 MQAV("O"E.X9(`)^TSP;C9@FX)B0OFEK*56E*(JKR2?3W$)>@$""W(%>V]NCC MVU8U=-;YD&!#R$^-<..>,:S5*DU2I(V1I@KA)W%>N&M5W3"[QY[@6.?NL">M M0(]:C0GR;QBWOHR8]:"@]65[AZXM#TIU'@"SU1`F8H*,7YJ2&F+6TL`BGW>[ M^R4Z4<""HMYY-E\"-[\[7N7WC%?$CQ:Q-!%7X85+(P/[@Z&A`%T$A\\=$J2R M*2;`KC+VK;GI6VF&\<$+W>CW%[:-IW.?*`K(_'R_HF71-PLA0_'MPGX2^$5N MZM:-%#Q.0<6UW2M*N%Y&EY6J2I?:N5\U6PNDYR<_G%R\3=Z&K84RHC@"7>K^ MS$IMLFZH="R?OCVID"B(Z'0J80*5(3?<\+73-WYAXK!XOY@B7#"(8/N6);!% MQ9/3MV'U7$-Q\!AVAR$(B)CH,:*K2H1PKP7^FA70$%[N4@!;KH'\2]!`_B5H M0,673D-6NG43SE6E6TQ8W.?()66C`?QS&GL_L$G"NQY,!R#\:H^&]J3>]Z$] M:NCZ,)9U?>C+JCT?P]UB6?,-]:AV0XT#Y=4]O"S'@<(]A=279MQRY!D(FT9@ MI61ZP-_QZ>3UV=%_Y#WT5SG=PK]X/;G\R3Q_=3YY'YA*VUCK0E8T+-?#P/3/A/P3G&WE"A4=3>.ZB MRXBFH>P&C+VAI:F0)PK/ME(\WF''SX'!\6"S*KCO+EY]?W)NGIZ?O#&/CH\O M[C0PNIQH,`88;S8N>-!@6J.[30L7/MT-^-I)AM? M\+6__V@5/M;Z:_UIG-^N=>3X5T+Y>"J?,C>)`O;?ZRC+TF]YB%>[>>#9TP'H M3T['XS$`S/J_L=:_GC]]VMI'.8>/5(QX^NSLZ/GDH/4O\87UCRS6/S;)DB:O M+B^>GK3D7->37Z`\88>'1#,H)1U,V3??O#UY]0SU))J8[K1P9L!$,;UDE5IC M0#*[QE!YV'TEL_N/$DV71%-$WWT1[]I5!.I)!6&=.:<)ILJ3DHB,Z'>J^A'*T'!#G\D/Y" MM>1A668\[HVV#!4,&)ME`>[2)I,7YH]O7K[&!B2948LO:/NU+CY0P>6;TS/S M[-7STW."(T[VG^0=`0';ER!@+T[&\$K931)29+=[$?))R6B2S^;&;F]S<[/, MPC0P+F+$"B!HMX`@T:&N#>'*HHG292TX3V,.D2'*'`4&TPU M92XD.5$RYK#C@7U:WZBWP"PYT-5.`SX4]1!I[`/A%JGS@O:O>/=C9>7V!2^L MY;5&E&>4^UZ)^Q+-V/988-WP/@[+'B0O6^,MGH;&R-E[Y^C^?&/]SGN"TL7-W:PUPA2HN]B=LO<(H?&(VV/)X-VD6':G3(3%JGL4*O7E`$-',Q>802-XHX]35[!C;'ZI.0'QB:L5]J!]%<=$?+DOD=F4![BM6I&SZ3,K6EF\^.3L_` M?HJ*I=+BTEXQLV9Y65MK9N,YW]$FCAU(8D^PP,6BOM3SR_E(VZ)/'1N\,F;=J+Z(9=G/VF!-A7Y),==AP25V:^#N!Q**4`IDG"###8`%+/8'DS6G, M;<_U(-RTTTAH&T(UPQ\&J7,AJ"KX+;=S*"@D##JKM.AL,^,$)K"`3]CVJ4YK MT0*.M:]LV)W3R=AU)'O)K5#TDLIUG06K5=2J6YHG3Q84!Q4_M>*M_II[7#[I M0"9?>2_B%/:D1R$VL),B'*J((LR.60)D2)0P$:&98A#;X\0)<`V;"GZT+Q!' MNE/M6#?D,_CD184&&MM%C6U7_?F?IK%N\Z^6/HT:V5^LQV9/W(#,O;NYH3QQ M1=XPR+Q&^1B>=]`N:/H@M3!&37R,H\:,+4)K#\M#'D^S2 M+/!G!:4Q0(8GY,@%U(.B9EPIVTMQ?RI^?J)^R,+8>42;!+2@B'JX2;6`(XXY M%,991"`(+,($$.(W($E$/_,!E*D7>+Z5:':_N0'R&8^URN83RH>.)^ATY0X# FJQN2#*W%-WPU[@FT.-_9+Z9_*#8'$.!U&']K9?T/#*K@L_,[``". ` end SHAR_EOF $shar_touch -am 0507145996 'ssh-1.2.13-hpux10-secureware.patch.gz' && chmod 0644 'ssh-1.2.13-hpux10-secureware.patch.gz' || echo 'restore of ssh-1.2.13-hpux10-secureware.patch.gz failed' shar_count="`wc -c < 'ssh-1.2.13-hpux10-secureware.patch.gz'`" test 3998 -eq "$shar_count" || echo "ssh-1.2.13-hpux10-secureware.patch.gz: original size 3998, current size $shar_count" fi exit 0 -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAgUBMY9NR5Ztei7I8kPhAQG+IQP/ba3PgwUsEYWW20Nahs+PqQm9HytlNJbY MBb/Iqrm8JdDHGLfxVxd3s8ab3PiUKhF2xUfXd6yAHed75NCTRm+Qm+a6mLfV2QX f+nPVmpBVbzl84b3qJDwZzaFWaoekIqgcxkXb+Ed/IsKZdeBil1uy+QaOMsgmH8v BlH1vhG6XIo= =ItP1 -----END PGP SIGNATURE-----