RE: Ilogin Authentication problem

Hi Nuno,

Thanks for your answer. But, it's not clear to me if you could reproduce it. If you could, on which server platform ? Or you are guessing this could happen according to what you've tested ?

But it still doesn't make sense that user "A" logs in as user "B", but user "A" never typed that password in any combination of errors, because he doesn't know it. So, I guess, login and password prompts could be mangled, but the login should never succeed. According to our customer, this happens with every pair of user/password you choose and on any PC already configured. So it's not a case of coincidence in the passwords or usernames with passwords.

Nevertheless, I've already asked my customer to send me it's login prompts, and WFE configuration, in order to check this out.

Thanks again, any further comments please let me know, as I'm still struggling with this, and it's a big security issue for our customer.

Luckily, we never use WFE's ilogin, instead we use telnet and macros in the emulator, as we've already had some security issues long time ago. But this customer insisted they wanted the nice "windows like" login, and we made some testes, and nothing went wrong, so we though those issues were solved. Until now.

Thanks,

Florencia

> -----Mensaje original-----
> De: [email protected] [mailto:[email protected]]En
> nombre de Nuno Godinho
> Enviado el: Viernes, 11 de Noviembre de 2005 14:54
> Para: [email protected]
> Asunto: RE: [fourjs-users] Ilogin Authentication problem
> 
> 
> Hi!
> 
> 	Most probably, after the first try, the login screen stops 
> on the "password:" request. On the second try the login colects 
> the user name as the passord and therefore fails to succed. On 
> the subsequent tries I guess wtk fails to recognize the 
> LOGIN_QUESTION and/or PASSWORD_QUESTION as defined on 
> wtkserv.ini,  most probably because they have already been 
> presented and detected. I now it's a long shot, but I tried to 
> reproduce your situation in here and that's what I got.
> HIH
> Best
> Nuno
> 
> -----Mensagem original-----
> De: Florencia Vitale [mailto:[email protected]]
> Enviada: sexta-feira, 11 de Novembro de 2005 17:29
> Para: FourJs BDS Users
> Assunto: [fourjs-users] Ilogin Authentication problem
> 
> 
> Hi,
> 
> On a customer we are having a very strange problem :
> 
> - the user A tries to log on to the system with wtk ilogin
> - he tries with the default user "B", that is defined on the 
> shortcut of a certain PC. As he doesn't "watch" the username, he 
> puts his own password, and it is refused.
> - then he tries again, with same user and password, and is refused again
> - then he realizes that the username is wrong, he changes to user 
> "A" and puts his own password (user's "A" password) and he logs in
> - but the odd thing is that he logs in as user "B", not as user "A"
> 
> This happens with this products :
> 
> - Linux Server RH Enterprise 3.0
> - fglrun -> 3.54.02.20
> - Wfe (wtk) -> 3.53.1a
> 
> I've tried to reproduce this problem here, against a Sun server 
> (solaris 5.8), and against a Red Hat 8.0 server, and I couldn't 
> reproduce it. I've tried with almost the same BDS version 
> (3.54.01.19) and the exact same WFE version.
> 
> But maybe it's a problem of RHEAS ? Or is it a known bug ? Or is 
> something we can configure ?
> 
> I've also checked our customer's /etc/hosts.equiv and 
> "$HOME/.rhosts" files, and they don't have any of those configured.
> 
> Thanks in advance,
> 
> Florencia
> 
> 
> -- 
> No virus found in this incoming message.
> Checked by AVG Free Edition.
> Version: 7.1.362 / Virus Database: 267.13.0/167 - Release Date: 11/11/2005
> 
>