On Sun, 2007-07-22 at 16:48 -0400, Tom McLaughlin wrote: > On Sun, 2007-07-22 at 19:45 +1000, Paul Fraser wrote: > > Hi Tom (and ports list by CC), > > > > After an upgrade to sudo v1.6.9 on my 6-STABLE workstation, I've > > noticed some interesting behaviour with regards to interaction between > > sudo and w. > > > > Check the output below for an example. > > > > [EMAIL PROTECTED] ~]$ sudo -V > > Sudo version 1.6.9 > > [EMAIL PROTECTED] ~]$ w > > 7:42PM up 8 days, 7:46, 1 user, load averages: 0.11, 0.10, 0.15 > > USER TTY FROM LOGIN@ IDLE WHAT > > pfraser p0 core-server01 7:38PM - w > > [EMAIL PROTECTED] ~]$ sudo -s > > Last login: Sun Jul 22 19:36:22 on ttyp1 > > [EMAIL PROTECTED] ~]# w > > 7:42PM up 8 days, 7:46, 0 users, load averages: 0.10, 0.09, 0.15 > > USER TTY FROM LOGIN@ IDLE WHAT > > [EMAIL PROTECTED] ~]# > > > > Note there is now no active session listed? If I then drop out of the > > sudo session, the problem persists. > > > > [EMAIL PROTECTED] ~]# exit > > exit > > [EMAIL PROTECTED] ~]$ w > > 7:44PM up 8 days, 7:47, 0 users, load averages: 0.27, 0.15, 0.17 > > USER TTY FROM LOGIN@ IDLE WHAT > > [EMAIL PROTECTED] ~]$ > > > > I'm afraid I'm not familiar enough with the inner workings of all the > > related systems and can't be of much more assistance (at least > > initially), but I'm quite welcome to perform any testing you require. > > You may just need to hold my hand a little bit! > > > > I'm not sure if this is a sudo bug or a -STABLE bug. I can only > reproduce this on -STABLE with sudo 1.6.9. -CURRENT with 1.6.9 and > 1.6.8p12 works fine and -STABLE with sudo 1.6.8p12 works fine. I did a > little more experimenting and saw this behavior below. > > -STABLE: > [EMAIL PROTECTED] tom]$ last > tom ttyp2 bofh Sun Jul 22 16:16 still logged in > ... > [EMAIL PROTECTED] tom]$ sudo -s > # last | head -n 5 > root ttyp2 Sun Jul 22 16:16 - 16:16 (00:00) > tom ttyp2 bofh Sun Jul 22 16:16 - 16:16 (00:00) > ... > # ^D > [EMAIL PROTECTED] tom]$ last > root ttyp2 Sun Jul 22 16:16 - 16:16 (00:00) > tom ttyp2 bofh Sun Jul 22 16:16 - 16:16 (00:00) > > > -CURRENT: > [EMAIL PROTECTED] tom]$ last > tom ttyp1 bofh Sun Jul 22 16:18 still logged in > ... > [EMAIL PROTECTED] tom]$ sudo -s > # last | head -n 6 > tom ttyp1 bofh Sun Jul 22 16:18 still logged in > ... > # ^D > [EMAIL PROTECTED] tom]$ last > tom ttyp1 bofh Sun Jul 22 16:18 still logged in > > > I'm going to do a little more digging and figure out if this is caused > by a behavior difference in sudo or FreeBSD. > > tom
Yeah, I was totally wrong above. The issue is caused by pam_lastlog. I forgot I had commented out the session line in the pam file on my -CURRENT box to shutup the login message everytime I ran a command via sudo. It's not an issue on my CentOS box so it appears to be an issue with our pam_lastlog. I'm going to ask on freebsd-security@ tom -- | tmclaugh at sdf.lonestar.org tmclaugh at FreeBSD.org | | FreeBSD http://www.FreeBSD.org | _______________________________________________ freebsd-ports@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-ports To unsubscribe, send any mail to "[EMAIL PROTECTED]"
