Very Computer

by **Kai La** » Fri, 08 Feb 2002 04:19:41

I just upgraded a sparc Ultra-60 from Solaris 2.6 to 8 and installed the
full recommended patch kit. Now the user finds that when the console
screen is locked, she can't unlock it by entering her password. ("Screen
locked by user so-and-so; to unlock, enter password.") The console just
beeps and returns to the locked-screen display. Entering the root password
also does not unlock the screen. Symptoms are the same whether the lock
occurs automatically after 30 minutes idle, or by clicking the padlock icon.

The system is not hung -- users can telnet in as usual. In fact that's
what we have to do to unlock the console: telnet in and log the user out
by killing her processes. This restores the CDE login window, at which
point the user can log in again as usual.

Log files (system and ~user/.dt) don't show any suggestive errors. Could
this be a PAM issue? A ToolTalk issue? (I was aggressive in disabling
services in inetd.conf.)

--

by **Tony Curti** » Fri, 08 Feb 2002 04:24:42

>> On 6 Feb 2002 19:19:41 GMT,

> I just upgraded a sparc Ultra-60 from Solaris 2.6 to 8
> and installed the full recommended patch kit. Now the
> user finds that when the console screen is locked, she
> can't unlock it by entering her password.

I once saw this effect on a machine that had been rather
ruthlessly chmod'ed throughout /usr/dt/bin. What are the
permissions on /usr/dt/bin/dtsession? - IIRC it is
dtsession that handles locking with CDE.

hth
t
--
Oh! I've said too much. Smithers, use the amnesia ray.

by **Rich Tee** » Fri, 08 Feb 2002 05:25:15

Quote:> Log files (system and ~user/.dt) don't show any suggestive errors. Could
> this be a PAM issue? A ToolTalk issue? (I was aggressive in disabling
> services in inetd.conf.)

That might be biting you. Uncomment this line:

100083/1 tli rpc/tcp wait root /usr/dt/bin/rpc.ttdbserverd rpc.ttdbserverd

And pkill -HUP inetd.

--
Rich Teer

President,
Rite Online Inc.

Voice: +1 (250) 979-1638
URL: http://www.rite-online.net

by **Kai La** » Fri, 08 Feb 2002 09:35:23

>> Now the user finds that when the console screen is locked, she
>> can't unlock it by entering her password.

>I once saw this effect on a machine that had been rather
>ruthlessly chmod'ed throughout /usr/dt/bin. What are the
>permissions on /usr/dt/bin/dtsession?

Thanks, Tony, that was the crucial clue. The permissions on dtsession
were 555 (r-xr-xr-x), and they needed to be 4555 (r-sr-xr-x). Our
security folks have a fixperms script they recommend we run on Solaris
boxes; it had turned off the setuid and setgid bits on a handful of
files under /usr/dt/bin. Restoring setuid mode on dtsession fixed our
particular problem.

--

Very Computer

Solaris 8: user can't unlock screen

Solaris 8: user can't unlock screen

Solaris 8: user can't unlock screen

Solaris 8: user can't unlock screen

Solaris 8: user can't unlock screen