Newsgroups: comp.os.linux.announce
From: bjdouma@xs4all.nl (Bauke Jan Douma)
Subject: WARNING about shadow-mk package
Message-ID: <ann-8811.778874344@cs.cornell.edu>
Date: Tue, 6 Sep 1994 17:59:26 GMT
Approved: linux-announce@tc.cornell.edu (Matt Welsh)

If you are about to update you shadow programs with the shadow-mk
package by Mohan Kokal, think again.

Here's the snippet from the Makefile in that package where login is
installed:

	install -m4755 login $(LOGINDIR)/_login
	install -m4711 login.secure $(LOGINDIR)/login

It appears that login is installed as _login, and another binary,
login.secure is installed as login. 
This package has no sources for login.secure!
Login.secure was never in the original shadow-3.n.n packages by John
F. Haugh, and in this package is nowhere referred to.


Sagittarius(tty2):/usr/src/shadow-mk> ls -la login*
-rwx--x--x   1 root     staff       27792 Sep  1 15:05 login
-rw-r--r--   1 root     staff        3351 Jun 28 04:44 login.1
-rw-r--r--   1 root     staff       14568 Sep 17  1993 login.5
-rw-r--r--   1 root     staff        3264 Sep 17  1993 login.c
-rw-r--r--   1 root     staff        5324 Jul 13 09:12 login.defs
-rw-------   1 root     staff        1555 Sep  1 15:04 login.o
-rws--x--x   1 root     staff        1124 Jul 13 10:36 login.secure <- ?


I would advise anyone that has installed this package to remove it.

Of those that have already emailed me on this, one person told me in
his correspondence with the author of this package (Mohan Kokal) that
author, in his helpfulness, asked for a temporary account on his
machine and, having been denied that, asked for the password file.
The emailer also told me he has observed this author to be bragging
about violating computer security.



bjdouma@xs4all.nl  (Bauke Jan Douma)


--
Send submissions for comp.os.linux.announce to: linux-announce@tc.cornell.edu
Be sure to include Keywords: and a short description of your software.
