| document id | Synopsis | Date | ||
| 57587 | Solaris 9 Patches 112908-12 and 115168-03 WITHDRAWN, May Cause Passwords to be Logged as Clear Text on Kerberos Clients | 17 Jun 2004 |
| Description | Top |
This issue can occur on a Solaris system configured as a kerberos client with patch 112908-12 or 115168-03 installed and any service using pam_krb5 as an "auth" module. With the debug feature of pam_krb5 enabled, password authentication for the user will be logged in clear text at LOG_DEBUG level.
Patches 112908-12 and 115168-03 have been WITHDRAWN and are no longer available on SunSolve.
This issue can occur in the following releases:
SPARC Platform
x86 Platform
Note: Solaris 7 and 8 are not affected by this issue.
This issue will only occur if ALL of the following are true:
A) The system is configured as a kerberos client, which can be determined by either output from the following command:
$ /usr/bin/klist
klist: No credentials cache file found while setting cache flags
(ticket cache /tmp/krb5cc_xxxx) $ /usr/bin/klist
Ticket cache: /tmp/krb5cc_xxxx
Default principal: jon.doe@FOO.BAR
... Note: In the output "Ticket cache: /tmp/krb5cc_xxxx", xxxx is the uid of the user running klist(1).
B) A service is using pam_krb5 as an "auth" module and the debug feature of pam_krb5 is enabled, which can be determined by any matching lines returned from the following command:
$ egrep -e '[\\t ]*[^#].*pam_krb5.*debug' /etc/pam.conf
C) Logging of LOG_DEBUG level messages is enabled, which can be determined by any matching lines returned from the following command:
$ egrep -e '\*.debug|daemon.debug' /etc/syslog.conf
Messages are logged at LOG_DEBUG level in the following format:
Feb 21 14:56:11 raptor dtlogin[14263]: [ID 151277 user.debug] PAM-KRB5(auth):
user ams8, pass xxxxx | Solution Summary | Top |
To work around the described issue, do one of the following:
A) Back out patch 112908-12 (SPARC platform) or 115168-03 (x86 platform)
OR
B) Disable the debug feature of pam_krb5. Search for any matching lines using the following command, and remove the "debug" entry from that line in the "/etc/pam.conf" (see pam.conf(4)) file:
$ egrep -e '[\\t ]*[^#].*pam_krb5.*debug' /etc/pam.conf
OR
C) Disable logging of LOG_DEBUG level messages, which can be achieved by the following steps:
1. Remove or comment out entries in the "etc/syslog.conf" (see syslog.conf(4)) file that match output from the following command:
$ egrep -e '\*.debug|daemon.debug' /etc/syslog.conf
2. Send a SIGHUP to syslogd:
$ pkill -HUP syslog
This issue is addressed in the following releases:
SPARC Platform
x86 Platform
This Sun Alert notification is being provided to you on an "AS IS" basis. This Sun Alert notification may contain information provided by third parties. The issues described in this Sun Alert notification may or may not impact your system(s). Sun makes no representations, warranties, or guarantees as to the information contained herein. ANY AND ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT, ARE HEREBY DISCLAIMED. BY ACCESSING THIS DOCUMENT YOU ACKNOWLEDGE THAT SUN SHALL IN NO EVENT BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL DAMAGES THAT ARISE OUT OF YOUR USE OR FAILURE TO USE THE INFORMATION CONTAINED HEREIN. This Sun Alert notification contains Sun proprietary and confidential information. It is being provided to you pursuant to the provisions of your agreement to purchase services from Sun, or, if you do not have such an agreement, the Sun.com Terms of Use. This Sun Alert notification may only be used for the purposes contemplated by these agreements.
Copyright 2000-2004 Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, CA 95054 U.S.A. All rights reserved.
| Applies To | (none) |
| Attachments | (none) |