
> Synopsis: ypbind fails to authenticate over time
> Severity: critical
> Priority: high
> Category: system
> Class: sw-bug
> Release: 3.8-current
> Environment:
System : OpenBSD 3.8
Architecture: OpenBSD.i386
Machine : i386
> Description:
When the system is set to authenticate via ypbind for logins (ssh, telnet,
terminal),
authentication will suddenly fail over time. For example, a user attempting
to login
via SSH will report an unknown user in the system logs. However, ypbind remains
running
and a 'ypcat passwd' command shows what one would expect to see, so communication
to
the NIS server is still intact.
Sometimes restarting ypbind seems to clear up the issue, though not always.
Usually a
reboot of the system is required.
This bug has been in existence for several revisions of OpenBSD, but it has
finally come
time I report it.
> How-To-Repeat:
After a reboot, the system usually will allow logins as normal for a few
hours up to
a few days later, then suddenly authentication fails. Logging in as a local
user (root)
on the console succeeds at all times, though logging in as a user on NIS fails.
> Fix:
Not a "fix", but rebooting the system puts things back to normal
and logins are able to
proceed.
-----
From: Theo de Raadt <deraadt@cvs.openbsd.org>
Run ypwhich. What does it say? I have never seen this, nor have I
heard of this. I will be closing this PR because it really does not
say much.
-----
To: Theo de Raadt <deraadt@cvs.openbsd.org>
Subject: Re: system/4506: ypbind fails to authenticate over time
ypwhich shows the server name:
bouncer# ypwhich
service3
'ypcat passwd' shows entire passwd database (I am not pasting that information
here, obviously, for security
reasons).
Here's a log snippet of me trying to login (from
[cut for length]
bouncer# ypmatch gudlyf passwd
gudlyf:...:5000:360:Me:/home/gudlyf:/usr/local/bin/bash
Password cropped down to "..." for security reasons.
Contents of
bouncer# cat
root:*:0:0:Charlie &:/root:/bin/csh
(usual stuff, then)
+:*:0:0:::
-----
Subject: Re: system/4506: ypbind fails to authenticate over time
From: Theo de Raadt <deraadt@cvs.openbsd.org>
Try using ypmatch.
There are a few databases. Don't use just the one.
ypbind just keeps track of where your ypserv is.
It does not keep data. None.
If ypwhich is working, then your master is known.
If ypcat works, then your master is there.
ypbind killing will affect nothing.
You have not diagnosed this right; it has nothing to with ypbind
and you have not shown what is really failing.
-----
To: Theo de Raadt <deraadt@cvs.openbsd.org>
Subject: Re: system/4506: ypbind fails to authenticate over time
I supplied the information you're asking about.
ypwhich shows 'service3', ONE of our NIS servers which has an uptime
of 125 days.
'ypcat passwd' spews out the NIS passwd database. Again, I will not copy that
information here for security reasons. Rest assured that it looks as it should.
It looks the same as it does on many of our other OS systems on the network,
ALL
of which are able to contact the NIS server fine and authenticate by it fine.
Our only two OpenBSD systems fail to authenticate via NIS over a non-specific
amount of time. Then suddenly, users are unable to authenticate via NIS whether
it's by telnet, ssh or logging into the system directly. Logging in as a local
user (i.e., root) works at all times.
I'm aware of how ypbind works, though it does not simply tell the system where
to locate the ypserv. It also provides the communication between server and
client. Of course I realize it does not retain any data -- it's a client
communicating with a server. However, for whatever reason, OpenBSD loses touch
with the server for authentication purposes.
What more information would you like? You are not telling me what you want.
Do
you want full stack trace information? Simply telling me I'm not diagnosing
this
right is useless to both of us.
-----
From: Theo de Raadt <deraadt@cvs.openbsd.org>
Subject: Re: system/4506:
ypbind fails to authenticate over time
Bullshit. You are wrong, and now you are being antagonistic.
ypbind ONLY says where ypserv is. I wrote this shit, so don't go
spewing to me. ypbind does NOT do the communication between client
and server, that is what the
You are WRONG.
Your diagnosis is wrong.
-----
To: Theo de Raadt <deraadt@cvs.openbsd.org>
Subject: Re: system/4506: ypbind fails to authenticate over time
What help are you bing using profanity? Uncalled for.
Then please tell me what part of the OS communicates authentication between
the
OpenBSD client and the ypserv server so I may diagnose the problem right.
Jesus, you don't have to be so arrogant.
-----
Then this gets tacked onto the bug:
Synopsis: ypbind fails to authenticate over time
State-Changed-From-To: open->closed
State-Changed-By: deraadt
State-Changed-When: Tue Sep 13 18:34:20 MDT 2005
State-Changed-Why:
submitter is unable to provide test results as asks
does not understand how YP works
attempts to preach to me about how it works
what he is describing as broken must be a local configuration
issue.
since he totally does not understand the code, does not want to
give me test results, does not trust the guy who WROTE THE CODE,
screw him. this PR gets closed because it does not describe a real
bug.
-----
THEN he writes to me:
From: Theo de Raadt <deraadt@cvs.openbsd.org>
Subject: Re: system/4506: ypbind fails to authenticate over time
I am not helping you. You are an arrogant prick.
You run my code. Yet you won't even share information with me so
that I can debug it?
I wrote that damn YP code you are running. I know how it works
and I will not put up with your self-righteous yelling at me.
You are the prick here.
If I am the prick, kindly PLEASE STOP RUNNING THE CODE I WROTE
IMMEDIATELY. And you better be careful since almost ALL the fre
YP code is based on what I wrote.
Screw you. We write code precisely because not everyone is as
much an ass as you are.
Telling us how it works, like fuck.. who do you thikn you are.
You're just an admin, or you'd have written a hot shit patch
already.
---
Yeah...WOW. Well I'm sorry, but I don't give a rat's ass how much code you've written, I'll be happy not to run it if it doesn't work and there's a lack of want to help users of it get things working. Why he jumped down my throat like he did. I mean, what the fuck?
Yep, it's real freakin close. Nothing but bugs to fix and then we ship.
If we miss September, it won't be long afterwards. And if we miss, it'll
most likely be stuff other than the game (like the fact we have to ship
9 localised foreign language versions at the same time).
Robin.
-----Original Message-----
From: [Me]
Sent: Thursday, July 29, 2004 7:48 AM
To: Robin Walker
Subject: August?! Can it be true?!
Heya Rob, Gudlyf here. How's things?
So am I really going to see HL2 next month so I can get a good couple of
months of playtime in before I have a baby in my lap?;-)
Take care...
"Mr. Spock succumbs to a powerful mating urge and nearly kills Captain Kirk." -- TV Guide, describing the Star Trek episode _Amok_Time_