Subject: [LON-CAPA-dev] sudo

From: Scott Harrison <[email-masked]>
Date: Tue, 05 Feb 2002 19:41:45 -0500

Dear All:

sudo is now a mandatory part of a LON-CAPA installation

You can add it to your system by:
cd loncom/build/
make rpmstatuspost
http://MACHINENAME/lon-status/rpmstatus.html

You will find a link on that page
to download and install sudo.
http://install.lon-capa.org/3.1/latestRPMS/sudo-1.6.5p2_rh6.2-1.i386.rpm

rpm -Uvh sudo-1.6.5p2_rh6.2-1.i386.rpm 

RedHat 7.* systems normally come with sudo.

You can choose between
http://install.lon-capa.org/3.1/latestRPMS/sudo-1.6.5p2_rh7.1-1.i386.rpm
or
ftp://mirror.pa.msu.edu/linux/redhat/linux/updates/7.2/en/os/i386/sudo-1.6.4-0.7x.2.i386.rpm

If you are running RedHat 7.*, you will likely want to
update glibc, glibc-common, glibc-devel as well
See
ftp://mirror.pa.msu.edu/linux/redhat/linux/updates/7.1/en/os/i386/

I rolled the 6.2 rpm myself so as to avoid a security hole
from the older RedHat "powertools" version.

Regards,
Scott

-- 
Scott Harrison -- Graduate Student
Microbiology and Molecular Genetics
Mich. State. Univ., East Lansing, MI
[email-masked], 517-353-0998

---

From: Martin Siegert <[email-masked]>
Date: Tue, 5 Feb 2002 17:23:45 -0800

> from the older RedHat "powertools" version.

The security hole is in all versions < 1.6.4. Thus the powertools rpm
is actually safe.

Martin

========================================================================
Martin Siegert
Academic Computing Services                        phone: (604) 291-4691
Simon Fraser University                            fax:   (604) 291-4242
Burnaby, British Columbia                          email: [email-masked]
Canada  V5A 1S6
========================================================================

---

From: Scott Harrison <[email-masked]>
Date: Tue, 05 Feb 2002 22:22:02 -0500

> The security hole is in all versions < 1.6.4. Thus the powertools rpm

I had not been aware of a common powertools update repository.

I had been looking at
ftp://mirror.pa.msu.edu/linux/redhat/redhat-6.2-en/powertools/i386/i386/

Instead of
ftp://mirror.pa.msu.edu/linux/redhat/linux/updates/6.2/en/powertools/i386/

For more information on the sudo ChangeLog, please visit
http://www.courtesan.com/sudo/changes.html
By using the custom-rolled RPM, we are avoiding the following
bugs.

Sudo 1.6.5 released.

467) Visudo could access memory that was already freed.

468) If the skey.access file denied use of plaintext passwords sudo
would exit instead of allowing the user to enter an S/Key.

Sudo 1.6.5p1 released.

469) Older versions of BSDi have getifaddrs() but no freeifaddrs().

470) BSDi has a fake setreuid() as do certain versions of FreeBSD and
NetBSD.

471) Ignore the return value of pam_setcred().  In Linux-PAM 0.75,
pam_setcred() will return PAM_PERM_DENIED even if the setcred function
of the module succeeds when pam_authenticate() has not been called.

472) Avoid giving PAM a NULL password response, use the empty string
instead.
This avoids a log warning when the user hits ^C at the password prompt
when Linux-PAM is in use.  This also prevents older versions of
Linux-PAM from dereferencing the NULL pointer.

473) The user's password was not zeroed after use when AIX
authentication,
BSD authentication, FWTK or PAM was in use.

Sudo 1.6.5p2 released.

474) Fixed compilation problem on HP-UX 9.x.