gnats/314: gnats.host_acess access-level overrides gnatsd.access settings

gnats/314: gnats.host_acess access-level overrides gnatsd.access settings

[elzubeir]

>Number:         314
>Category:       gnats
>Synopsis:       gnats.host_acess access-level overrides gnatsd.access settings
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    unassigned
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Dec 20 17:45:58 -0500 2001
>Originator:     Mohammed Elzueir
>Release:        4.0-alpha
>Organization:
Arabeyes Project (http://www.arabeyes.org/)
>Environment:
Debian Linux (woody), i386.
>Description:
When the gnatsd.host_access access-level is set to 'view' (for example), and gnatsd.acess has users with various access-levels - only the access-level set on gnatsd.host_access prevail.

That does not appear to happen when the passwords are stored in clear-text (ie. $0$passme). If the passwords are encrypted, it fails to see the user access-level and defaults to gnatsd.host_acess settings.
>How-To-Repeat:
1. In /etc/gnats/gnatsd.host_access put:
127.0.0.1:view:

2. In /var/lib/gnats/gnats-db/gnats-adm/gnatsd.access put:
plainguy:$0$test:edit:default
cryptguy:4/1d3Y7NqgISI:admin:default

The cryptguy password is 'test'. 'plainguy' will have proper access-level, whereas 'cryptguy' will default to 'view'.


>Fix:
Unknown
>Unformatted:
 

_______________________________________________
Gnats-prs mailing list
Gnats-prs@gnu.org
http://mail.gnu.org/mailman/listinfo/gnats-prs

Re: gnats/314: gnats.host_acess access-level overrides gnatsd.access settings

[Yngve Svendsen]

At 17:45 20.12.01 -0500, elzubeir@fakkir.net wrote:
>>When the gnatsd.host_access access-level is set to 'view' (for example),
and gnatsd.acess has users with various access-levels - only the
access-level set on gnatsd.host_access prevail.
>
>That does not appear to happen when the passwords are stored in clear-text
(ie. $0$passme). If the passwords are encrypted, it fails to see the user
access-level and defaults to gnatsd.host_acess settings.
>>How-To-Repeat:
>1. In /etc/gnats/gnatsd.host_access put:
>127.0.0.1:view:
>
>2. In /var/lib/gnats/gnats-db/gnats-adm/gnatsd.access put:
>plainguy:$0$test:edit:default
>cryptguy:4/1d3Y7NqgISI:admin:default
>
>The cryptguy password is 'test'. 'plainguy' will have proper access-level,
whereas 'cryptguy' will default to 'view'.

What you are seeing is the intended behaviour. For some reason,
authentication of the 'cryptguy' user fails, and the user then instead gets
the default access level defined for the host that the user is on.

The problem could be caused by a wrong password hash. You should start off
by checking it, for instance by using it for some user in the system passwd
file and then trying a login as that user.

Yngve Svendsen
GNATS doc guy


_______________________________________________
Gnats-prs mailing list
Gnats-prs@gnu.org
http://mail.gnu.org/mailman/listinfo/gnats-prs