acua_login

acua_login authorizes a user login, and initializes fields in their ACUA user record. It must be called whenever a user logs in or I can guarantee you will not like the results. You should put the following line in the system-wide startup script (e.g. /etc/profile (for bash)): If you are using mgetty's AutoPPP feature, you will want to put the following into your ip-up script: acua_login determines what type of login is in progress, be it TTY/Telnet/SSH/PPP/PPPoE, by looking at environment variables.  This is somewhat insecure, so there are a couple of security checks done in acua_login to attempt to catch users who are playing games or trying to be malicious.

The examined environment variables are:

TTY/Telnet/SSH Logins:

    LOGNAME - The login name of the user logging in.  This is verified with security checks.

PPP/PPPoE Logins:

    PPPD_PID - The PID of the PPPD process.

    IFNAME - The pppX interface name.

Using a modern PPPD will automatically set the PPPD_PID and IFNAME environment variables.

Using bash as the shell will set the LOGNAME environment variable.

Security Information:

When PPP and PPPoE logins are done, the environment variables PPPD_PID and IFNAME are taken on face value and are not checked.  However, what is checked is that the user who ran acua_login was the root user.  So, to do a PPP or PPPoE login, acua_login needs to be run as root, and pppd will do this out of the box.

When Local/Telnet/SSH logins are done, the login name in the LOGNAME environment variable is checked by making sure that the /dev file for the terminal the user is using is owned by the user in LOGNAME.  The tty the user is using is determined by the result of the ttyname() function.  Another check that is done is that the UID of the person running acua_login matches the UID value of the LOGNAME environment variable.  In the case that the LOGNAME environment variable does not exist or contains invalid data, the login will be rejected.

All environment variables that acua_login reads are also checked for conditions such as someone attempting to exploit buffer overflows within acua_login.


Robert Davidson