acua_login

acua_login authorizes a user login, and initializes fields in their ACUA user record. It must be called whenever a user logs in or I can guarantee you will not like the results. You should put the following line in the system-wide startup script (e.g. /etc/profile (for bash)): If you are using mgetty's AutoPPP feature, you will want to put the following into your ip-up script: acua_login determines what type of login is in progress, be it TTY/Telnet/SSH/PPP/PPPoE, by looking at environment variables.  This is somewhat insecure, so there are a couple of security checks done in acua_login to attempt to catch users who are playing games or trying to be malicious.

The examined environment variables are:

TTY/Telnet/SSH Logins:

    LOGNAME - The login name of the user logging in.  This is verified with security checks.

PPP/PPPoE Logins:

    PPPD_PID - The PID of the PPPD process.

    IFNAME - The pppX interface name.

CIPE VPN Connections:

    CIPE_USER - The username of the user to record the CIPE accountancy information under.

    CIPE_PID - The PID of the CIPE daemon.

    CIPE_IFNAME - The interface name of the CIPE VPN tunnel (eg. cipcb0).

Using a modern PPPD will automatically set the PPPD_PID and IFNAME environment variables.

Using CIPE does not automatically set any useful environment variables, except maybe for the "arg" one.  CIPE does send some useful information on the command-line to the /etc/cipe/ip-up and /etc/cipe/ip-down scripts though, which is
the information we use.

Using bash as the shell will set the LOGNAME environment variable.

Security Information:

When PPP and PPPoE logins are done, the environment variables PPPD_PID and IFNAME are taken on face value and are not checked.  However, what is checked is that the user who ran acua_login was the root user.  So, to do a PPP or PPPoE login, acua_login needs to be run as root, and pppd will do this out of the box.

When a CIPE VPN connection is being established, it looks at the environment variables CIPE_USER, CIPE_PID, and CIPE_IFNAME.  They all need to contain correct information otherwise acua_login will reject the login.  Because these environment variables are taken on face value, and the only checks done are for potential buffer overflows, the acua_login program needs to be run by the root user (this is standard for CIPE as of this writing).

When Local/Telnet/SSH logins are done, the login name in the LOGNAME environment variable is checked by making sure that the /dev file for the terminal the user is using is owned by the user in LOGNAME.  The tty the user is using is determined by the result of the ttyname() function.  Another check that is done is that the UID of the person running acua_login matches the UID value of the LOGNAME environment variable.  In the case that the LOGNAME environment variable does not exist or contains invalid data, the login will be rejected.

All environment variables that acua_login reads are also checked for conditions such as someone attempting to exploit buffer overflows within acua_login.


Robert Davidson