tieto team mailing list archive
-
tieto team
-
Mailing list archive
-
Message #00308
[Bug 423252] Re: NSS using LDAP+SSL breaks setuid applications like su, sudo, apache2 suexec, and atd
3 sets of LDAP client libraries? That sounds like a terrible solution.
Fwiw, I wrote a version of OpenLDAP's TLS support that could use any/all
of OpenSSL, GnuTLS, and MozillaNSS simultaneously, and never released
it, because it seemed that would be too confusing if separate apps had
different expectations of TLS config options. But it would certainly be
possible to add libltdl support in, and make libldap dynamically load a
single TLS implementation. I still don't see any technical merit in
supporting anything besides OpenSSL.
--
You received this bug notification because you are a member of Tieto,
which is subscribed to the bug report.
https://bugs.launchpad.net/bugs/423252
Title:
NSS using LDAP+SSL breaks setuid applications like su, sudo, apache2
suexec, and atd
Status in Release Notes for Ubuntu:
Fix Released
Status in “eglibc” package in Ubuntu:
Invalid
Status in “libgcrypt11” package in Ubuntu:
Confirmed
Status in “libnss-ldap” package in Ubuntu:
Invalid
Status in “openldap” package in Ubuntu:
New
Status in “sudo” package in Ubuntu:
Invalid
Status in “eglibc” source package in Lucid:
Invalid
Status in “libgcrypt11” source package in Lucid:
Confirmed
Status in “libnss-ldap” source package in Lucid:
Invalid
Status in “openldap” source package in Lucid:
New
Status in “sudo” source package in Lucid:
Invalid
Status in “eglibc” source package in Maverick:
Invalid
Status in “libgcrypt11” source package in Maverick:
Confirmed
Status in “libnss-ldap” source package in Maverick:
Confirmed
Status in “openldap” source package in Maverick:
New
Status in “sudo” source package in Maverick:
Invalid
Status in “eglibc” source package in Karmic:
Invalid
Status in “libgcrypt11” source package in Karmic:
Won't Fix
Status in “libnss-ldap” source package in Karmic:
Invalid
Status in “openldap” source package in Karmic:
New
Status in “sudo” source package in Karmic:
Invalid
Status in “gnutls26” package in Debian:
Unknown
Status in “libgcrypt11” package in Debian:
Confirmed
Status in “openldap” package in Debian:
New
Status in “sudo” package in Debian:
Confirmed
Status in “sudo” package in Kairos Linux:
Confirmed
Bug description:
On Karmic (alpha 4 plus updates), changing the nsswitch.conf 'passwd'
field to anything with 'ldap' as the first item breaks the ability to
become root using 'su' and 'sudo' as anyone but root.
Default nsswitch.conf:
passwd: compat
group: compat
shadow: compat
matt@box:~$ sudo uname -a
[sudo] password for matt:
Linux box 2.6.31-9-server #29-Ubuntu SMP Sun Aug 30 18:37:42 UTC 2009 x86_64 GNU/Linux
matt@box:~$ su -
Password:
root@box:~#
Modified nsswitch.conf with 'ldap' before 'compat':
passwd: ldap compat
group: ldap compat
shadow: ldap compat
matt@box:~$ sudo uname -a
sudo: setreuid(ROOT_UID, user_uid): Operation not permitted
matt@box:~$ su -
Password:
setgid: Operation not permitted
Modified nsswitch.conf with 'ldap' after 'compat':
passwd: compat ldap
group: compat ldap
shadow: compat ldap
matt@box:~$ sudo uname -a
[sudo] password for matt:
Linux box 2.6.31-9-server #29-Ubuntu SMP Sun Aug 30 18:37:42 UTC 2009 x86_64 GNU/Linux
matt@box:~$ su -
Password:
root@box:~#
The same arrangements in nsswitch.conf work as expected in Jaunty and
earlier releases.
Lucid Release Note:
== NSS via LDAP+SSL breaks setuid applications like sudo ==
Upgrading systems configured to use ldap over ssl as the first service
in the nss stack (in nsswitch.conf) leads to a broken nss resolution
for setuid applications after the upgrade to Lucid (for example sudo
would stop working). There isn't any simple workaround for now. One
option is to switch to libnss-ldapd in place of libnss-ldap before the
upgrade. Another one consists in using nscd before the upgrade.
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu-release-notes/+bug/423252/+subscriptions
Follow ups