[PATCH] contrib/cygwin/ssh-host-config: Handle lastlog with more care

Hi,

below is a patch to Cygwin's ssh-host-config file. So far this script
allowed to have a lastlog file as well as a lastlog dir, whatever the
user preferred. This is no problem as long as ssh is the only
application using lastlog, but that's nothing we can be sure about, so
we decided to restrict lastlog to being a file in a Cygwin installation.
This also allows reliable porting and use of Linux tools like lastlog(1)
which is only aware of lastlog being a file.

Consequentially, the ssh-host-config script must handle lastlog with
some greater care than before and refuse to allow a lastlog dir.
Additionally the lastlog file doesn't get a 666 access mask anymore, but
it's chowned to the user account starting the service and gets a 644
access mask now for security reasons.

Could this be applied?


Thanks,
Corinna

--- ssh-host-config.ORIG 2006-02-28 13:24:32.248566300 +0100
+++ ssh-host-config 2006-02-28 13:32:22.168803900 +0100
@@ -153,22 +153,31 @@ fi

# Create /var/log and /var/log/lastlog if not already existing

-if [ -f ${LOCALSTATEDIR}/log ]
+if [ -e ${LOCALSTATEDIR}/log -a ! -d ${LOCALSTATEDIR}/log ]
then
- echo "Creating ${LOCALSTATEDIR}/log failed!"
-else
- if [ ! -d ${LOCALSTATEDIR}/log ]
- then
- mkdir -p ${LOCALSTATEDIR}/log
- fi
- if [ -d ${LOCALSTATEDIR}/log/lastlog ]
- then
- chmod 777 ${LOCALSTATEDIR}/log/lastlog
- elif [ ! -f ${LOCALSTATEDIR}/log/lastlog ]
- then
- cat /dev/null > ${LOCALSTATEDIR}/log/lastlog
- chmod 666 ${LOCALSTATEDIR}/log/lastlog
- fi
+ echo
+ echo "${LOCALSTATEDIR}/log is existant but not a directory."
+ echo "Cannot create ssh host configuration."
+ echo
+ exit 1
+fi
+if [ ! -e ${LOCALSTATEDIR}/log ]
+then
+ mkdir -p ${LOCALSTATEDIR}/log
+fi
+
+if [ -e ${LOCALSTATEDIR}/log/lastlog -a ! -f ${LOCALSTATEDIR}/log/lastlog ]
+then
+ echo
+ echo "${LOCALSTATEDIR}/log/lastlog exists, but is not a file."
+ echo "Cannot create ssh host configuration."
+ echo
+ exit 1
+fi
+if [ ! -e ${LOCALSTATEDIR}/log/lastlog ]
+then
+ cat /dev/null > ${LOCALSTATEDIR}/log/lastlog
+ chmod 644 ${LOCALSTATEDIR}/log/lastlog
fi

# Create /var/empty file used as chroot jail for privilege separation
@@ -578,6 +587,7 @@ then
fi
chown "${_user}" ${SYSCONFDIR}/ssh*
chown "${_user}".544 ${LOCALSTATEDIR}/empty
+ chown "${_user}".544 ${LOCALSTATEDIR}/log/lastlog
if [ -f ${LOCALSTATEDIR}/log/sshd.log ]
then
chown "${_user}".544 ${LOCALSTATEDIR}/log/sshd.log

--
Corinna Vinschen
Cygwin Project Co-Leader
Red Hat

_______________________________________________
openssh-unix-dev mailing list
openssh-unix-dev@mindrot.org
http://www.mindrot.org/mailman/listi...enssh-unix-dev