/srv/hg/libpwquality: 3 new changesets
by admin@fedoraproject.org
changeset 65fde17c7310 in /srv/hg/libpwquality
details: http://hg.fedorahosted.org/hg/srv/hg/libpwquality?cmd=changeset;node=65fd...
summary: Remove stray source file.
changeset 8a3158b9d430 in /srv/hg/libpwquality
details: http://hg.fedorahosted.org/hg/srv/hg/libpwquality?cmd=changeset;node=8a31...
summary: Fix format in message.
changeset 49693f19c051 in /srv/hg/libpwquality
details: http://hg.fedorahosted.org/hg/srv/hg/libpwquality?cmd=changeset;node=4969...
summary: Create first tarball. Add spec file.
diffstat:
Makefile.am | 2 +-
README | 4 +-
configure.in | 28 +-
libpwquality.spec.in | 84 ++++++
po/cs.po | 2 +-
src/Makefile.am | 12 +-
src/pam_cracklib.c | 755 -----------------------------------------------------
src/pwquality.conf | 45 +++
8 files changed, 170 insertions(+), 762 deletions(-)
diffs (1008 lines):
diff -r c2bd0a40a581 -r 49693f19c051 Makefile.am
--- a/Makefile.am Wed Sep 21 14:19:38 2011 +0200
+++ b/Makefile.am Mon Oct 03 16:26:19 2011 +0200
@@ -12,6 +12,6 @@
M4_FILES = m4/libtool.m4
-EXTRA_DIST = config.rpath CHANGELOG $(M4_FILES)
+EXTRA_DIST = config.rpath $(M4_FILES) libpwquality.spec libpwquality.spec.in
ACLOCAL_AMFLAGS = -I m4
diff -r c2bd0a40a581 -r 49693f19c051 README
--- a/README Wed Sep 21 14:19:38 2011 +0200
+++ b/README Mon Oct 03 16:26:19 2011 +0200
@@ -1,5 +1,5 @@
-This is a libpwquality library for password quality checks
-and generation of a random passwords that pass the checks.
+This is a libpwquality library for password quality checking
+and generation of random passwords that pass the checks.
NOTES:
diff -r c2bd0a40a581 -r 49693f19c051 configure.in
--- a/configure.in Wed Sep 21 14:19:38 2011 +0200
+++ b/configure.in Mon Oct 03 16:26:19 2011 +0200
@@ -27,6 +27,22 @@
AC_PROG_LN_S
AC_PROG_LIBTOOL
+dnl and some hacks to use /etc
+test "${prefix}" = "NONE" && prefix="/usr"
+if test ${prefix} = '/usr'
+then
+dnl If we use /usr as prefix, use /etc for config files
+ if test ${sysconfdir} = '${prefix}/etc'
+ then
+ sysconfdir="/etc"
+ fi
+dnl If we use /usr as prefix, use /usr/share/man for manual pages
+ if test ${mandir} = '${prefix}/man'
+ then
+ mandir='${prefix}/share/man'
+ fi
+fi
+
dnl Localization support
AM_GNU_GETTEXT_VERSION
AM_GNU_GETTEXT([external])
@@ -61,6 +77,16 @@
[ : ] )
AM_CONDITIONAL(HAVE_LD_VERSION_SCRIPT, test "$have_ld_version_script" = "yes")
+AC_ARG_WITH(securedir,
+ AS_HELP_STRING([--with-securedir=DIR],[path to location of PAMs @<:@default=$libdir/security@:>@]),
+ SECUREDIR=$withval, SECUREDIR=$libdir/security)
+AC_SUBST(SECUREDIR)
+
+AC_ARG_WITH(sconfigdir,
+ AS_HELP_STRING([--with-sconfigdir=DIR],[path to PAM conf files @<:@default=$sysconfdir/security@:>@]),
+ SCONFIGDIR=$enableval, SCONFIGDIR=$sysconfdir/security)
+AC_SUBST(SCONFIGDIR)
+
dnl options and defaults
dnl Check for cracklib
@@ -85,5 +111,5 @@
AC_CHECK_FUNCS(strcspn strdup strspn strstr strtol)
dnl Files to be created from when we run configure
-AC_CONFIG_FILES([Makefile src/Makefile po/Makefile.in])
+AC_CONFIG_FILES([Makefile libpwquality.spec src/Makefile po/Makefile.in])
AC_OUTPUT
diff -r c2bd0a40a581 -r 49693f19c051 libpwquality.spec.in
--- /dev/null Thu Jan 01 00:00:00 1970 +0000
+++ b/libpwquality.spec.in Mon Oct 03 16:26:19 2011 +0200
@@ -0,0 +1,84 @@
+Summary: A library for password generation and password quality checking
+Name: libpwquality
+Version: @PACKAGE_VERSION@
+Release: 1%{?dist}
+# The library is BSD licensed with option to relicense as GPLv2+
+# - this option is redundant as the BSD license allows that anyway.
+License: BSD and GPLv2+
+Group: System Environment/Base
+Source0: http://fedorahosted.org/releases/l/i/libpwquality-%{version}.tar.bz2
+
+%define _moduledir /%{_lib}/security
+%define _secconfdir %{_sysconfdir}/security
+
+BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
+Requires: cracklib-dicts >= 2.8
+Requires(post): /sbin/ldconfig
+BuildRequires: cracklib-devel
+BuildRequires: gettext
+
+URL: http://libpwquality.fedorahosted.org/
+
+%description
+This is a library for password quality checks and generation
+of random passwords that pass the checks.
+This library uses the cracklib and cracklib dictionaries
+to perform some of the checks.
+
+%package devel
+Group: Development/Libraries
+Summary: Files needed for developing PAM-aware applications and modules for PAM
+Requires: libpwquality%{?_isa} = %{version}-%{release}
+
+%description devel
+Files needed for development of applications using the libpwquality
+library.
+See the pwquality.h header file for the API.
+
+%prep
+%setup -q
+
+%build
+%configure \
+ --libdir=/%{_lib} \
+ --disable-static
+
+make %{?_smp_mflags}
+
+%install
+make install DESTDIR=$RPM_BUILD_ROOT
+
+mkdir -p $RPM_BUILD_ROOT%{_libdir}
+pushd $RPM_BUILD_ROOT%{_libdir}
+ln -sf ../../%{_lib}/libpwquality.so.*.* libpwquality.so
+popd
+rm -f $RPM_BUILD_ROOT/%{_lib}/*.so
+rm -f $RPM_BUILD_ROOT/%{_lib}/*.la
+rm -f $RPM_BUILD_ROOT%{_moduledir}/*.la
+
+%find_lang libpwquality
+
+%check
+# Nothing yet
+
+%post -p /sbin/ldconfig
+
+%postun -p /sbin/ldconfig
+
+%files -f libpwquality.lang
+%defattr(-,root,root,-)
+%doc COPYING README NEWS AUTHORS
+%{_bindir}/pwmake
+%{_bindir}/pwscore
+%{_moduledir}/pam_pwquality.so
+/%{_lib}/libpwquality.so.*
+%config(noreplace) %{_secconfdir}/pwquality.conf
+
+%files devel
+%defattr(-,root,root,-)
+%{_includedir}/pwquality.h
+%{_libdir}/libpwquality.so
+
+%changelog
+* Mon Oct 3 2011 Tomas Mraz <tmraz(a)redhat.com> 0.9-1
+- first spec file for libpwquality
diff -r c2bd0a40a581 -r 49693f19c051 po/cs.po
--- a/po/cs.po Wed Sep 21 14:19:38 2011 +0200
+++ b/po/cs.po Mon Oct 03 16:26:19 2011 +0200
@@ -98,7 +98,7 @@
#: src/error.c:46
#, c-format
msgid "The password contains less than %ld digits"
-msgstr "Heslo obsahuje méně než %d číslic"
+msgstr "Heslo obsahuje méně než %ld číslic"
#: src/error.c:49
msgid "The password contains too few digits"
diff -r c2bd0a40a581 -r 49693f19c051 src/Makefile.am
--- a/src/Makefile.am Wed Sep 21 14:19:38 2011 +0200
+++ b/src/Makefile.am Mon Oct 03 16:26:19 2011 +0200
@@ -6,7 +6,11 @@
CLEANFILES = *~
-EXTRA_DIST = libpwquality.map
+securelibdir = @SECUREDIR@
+
+secureconfdir = @SCONFIGDIR@
+
+EXTRA_DIST = libpwquality.map pwquality.conf
include_HEADERS = pwquality.h
@@ -39,6 +43,10 @@
pwmake_LDADD = libpwquality.la
-lib_LTLIBRARIES = libpwquality.la pam_pwquality.la
+lib_LTLIBRARIES = libpwquality.la
+
+securelib_LTLIBRARIES = pam_pwquality.la
+
+secureconf_DATA = pwquality.conf
bin_PROGRAMS = pwscore pwmake
diff -r c2bd0a40a581 -r 49693f19c051 src/pam_cracklib.c
--- a/src/pam_cracklib.c Wed Sep 21 14:19:38 2011 +0200
+++ /dev/null Thu Jan 01 00:00:00 1970 +0000
@@ -1,755 +0,0 @@
-/*
- * libpwquality main API code
- *
- * See the end of the file for Copyright and License Information
- */
-
-#include "config.h"
-
-#include <stdlib.h>
-#include <string.h>
-#include <stdarg.h>
-#include <sys/types.h>
-#include <sys/stat.h>
-#include <ctype.h>
-#include <limits.h>
-#include <crack.h>
-
-/* For Translators: "%s%s" could be replaced with "<service> " or "". */
-#define PROMPT1 _("New %s%spassword: ")
-/* For Translators: "%s%s" could be replaced with "<service> " or "". */
-#define PROMPT2 _("Retype new %s%spassword: ")
-#define MISTYPED_PASS _("Sorry, passwords do not match.")
-
-#ifdef MIN
-#undef MIN
-#endif
-#define MIN(_a, _b) (((_a) < (_b)) ? (_a) : (_b))
-
-/*
- * here, we make a definition for the externally accessible function
- * in this file (this definition is required for static a module
- * but strongly encouraged generally) it is used to instruct the
- * modules include file to define the function prototypes.
- */
-
-#define PAM_SM_PASSWORD
-
-#include <security/pam_modules.h>
-#include <security/_pam_macros.h>
-#include <security/pam_ext.h>
-
-/* argument parsing */
-#define PAM_DEBUG_ARG 0x0001
-
-struct cracklib_options {
- int retry_times;
- int diff_ok;
- int diff_ignore;
- int min_length;
- int dig_credit;
- int up_credit;
- int low_credit;
- int oth_credit;
- int min_class;
- int max_repeat;
- int reject_user;
- const char *cracklib_dictpath;
-};
-
-#define CO_RETRY_TIMES 1
-#define CO_DIFF_OK 5
-#define CO_DIFF_IGNORE 23
-#define CO_MIN_LENGTH 9
-# define CO_MIN_LENGTH_BASE 5
-#define CO_DIG_CREDIT 1
-#define CO_UP_CREDIT 1
-#define CO_LOW_CREDIT 1
-#define CO_OTH_CREDIT 1
-
-static int
-_pam_parse (pam_handle_t *pamh, struct cracklib_options *opt,
- int argc, const char **argv)
-{
- int ctrl=0;
-
- /* step through arguments */
- for (ctrl=0; argc-- > 0; ++argv) {
- char *ep = NULL;
-
- /* generic options */
-
- if (!strcmp(*argv,"debug"))
- ctrl |= PAM_DEBUG_ARG;
- else if (!strncmp(*argv,"type=",5))
- pam_set_item (pamh, PAM_AUTHTOK_TYPE, *argv+5);
- else if (!strncmp(*argv,"retry=",6)) {
- opt->retry_times = strtol(*argv+6,&ep,10);
- if (!ep || (opt->retry_times < 1))
- opt->retry_times = CO_RETRY_TIMES;
- } else if (!strncmp(*argv,"difok=",6)) {
- opt->diff_ok = strtol(*argv+6,&ep,10);
- if (!ep || (opt->diff_ok < 0))
- opt->diff_ok = CO_DIFF_OK;
- } else if (!strncmp(*argv,"difignore=",10)) {
- opt->diff_ignore = strtol(*argv+10,&ep,10);
- if (!ep || (opt->diff_ignore < 0))
- opt->diff_ignore = CO_DIFF_IGNORE;
- } else if (!strncmp(*argv,"minlen=",7)) {
- opt->min_length = strtol(*argv+7,&ep,10);
- if (!ep || (opt->min_length < CO_MIN_LENGTH_BASE))
- opt->min_length = CO_MIN_LENGTH_BASE;
- } else if (!strncmp(*argv,"dcredit=",8)) {
- opt->dig_credit = strtol(*argv+8,&ep,10);
- if (!ep)
- opt->dig_credit = 0;
- } else if (!strncmp(*argv,"ucredit=",8)) {
- opt->up_credit = strtol(*argv+8,&ep,10);
- if (!ep)
- opt->up_credit = 0;
- } else if (!strncmp(*argv,"lcredit=",8)) {
- opt->low_credit = strtol(*argv+8,&ep,10);
- if (!ep)
- opt->low_credit = 0;
- } else if (!strncmp(*argv,"ocredit=",8)) {
- opt->oth_credit = strtol(*argv+8,&ep,10);
- if (!ep)
- opt->oth_credit = 0;
- } else if (!strncmp(*argv,"minclass=",9)) {
- opt->min_class = strtol(*argv+9,&ep,10);
- if (!ep)
- opt->min_class = 0;
- if (opt->min_class > 4)
- opt->min_class = 4;
- } else if (!strncmp(*argv,"maxrepeat=",10)) {
- opt->max_repeat = strtol(*argv+10,&ep,10);
- if (!ep)
- opt->max_repeat = 0;
- } else if (!strncmp(*argv,"reject_username",15)) {
- opt->reject_user = 1;
- } else if (!strncmp(*argv,"authtok_type",12)) {
- /* for pam_get_authtok, ignore */;
- } else if (!strncmp(*argv,"use_authtok",11)) {
- /* for pam_get_authtok, ignore */;
- } else if (!strncmp(*argv,"use_first_pass",14)) {
- /* for pam_get_authtok, ignore */;
- } else if (!strncmp(*argv,"try_first_pass",14)) {
- /* for pam_get_authtok, ignore */;
- } else if (!strncmp(*argv,"dictpath=",9)) {
- opt->cracklib_dictpath = *argv+9;
- if (!*(opt->cracklib_dictpath)) {
- opt->cracklib_dictpath = CRACKLIB_DICTS;
- }
- } else {
- pam_syslog(pamh,LOG_ERR,"pam_parse: unknown option; %s",*argv);
- }
- }
-
- return ctrl;
-}
-
-/* Helper functions */
-
-/*
- * can't be a palindrome - like `R A D A R' or `M A D A M'
- */
-static int palindrome(const char *new)
-{
- int i, j;
-
- i = strlen (new);
-
- for (j = 0;j < i;j++)
- if (new[i - j - 1] != new[j])
- return 0;
-
- return 1;
-}
-
-/*
- * Calculate how different two strings are in terms of the number of
- * character removals, additions, and changes needed to go from one to
- * the other
- */
-
-static int distdifferent(const char *old, const char *new,
- size_t i, size_t j)
-{
- char c, d;
-
- if ((i == 0) || (strlen(old) < i)) {
- c = 0;
- } else {
- c = old[i - 1];
- }
- if ((j == 0) || (strlen(new) < j)) {
- d = 0;
- } else {
- d = new[j - 1];
- }
- return (c != d);
-}
-
-static int distcalculate(int **distances, const char *old, const char *new,
- size_t i, size_t j)
-{
- int tmp = 0;
-
- if (distances[i][j] != -1) {
- return distances[i][j];
- }
-
- tmp = distcalculate(distances, old, new, i - 1, j - 1);
- tmp = MIN(tmp, distcalculate(distances, old, new, i, j - 1));
- tmp = MIN(tmp, distcalculate(distances, old, new, i - 1, j));
- tmp += distdifferent(old, new, i, j);
-
- distances[i][j] = tmp;
-
- return tmp;
-}
-
-static int distance(const char *old, const char *new)
-{
- int **distances = NULL;
- size_t m, n, i, j, r;
-
- m = strlen(old);
- n = strlen(new);
- distances = malloc(sizeof(int*) * (m + 1));
-
- for (i = 0; i <= m; i++) {
- distances[i] = malloc(sizeof(int) * (n + 1));
- for(j = 0; j <= n; j++) {
- distances[i][j] = -1;
- }
- }
- for (i = 0; i <= m; i++) {
- distances[i][0] = i;
- }
- for (j = 0; j <= n; j++) {
- distances[0][j] = j;
- }
- distances[0][0] = 0;
-
- r = distcalculate(distances, old, new, m, n);
-
- for (i = 0; i <= m; i++) {
- memset(distances[i], 0, sizeof(int) * (n + 1));
- free(distances[i]);
- }
- free(distances);
-
- return r;
-}
-
-static int similar(struct cracklib_options *opt,
- const char *old, const char *new)
-{
- if (distance(old, new) >= opt->diff_ok) {
- return 0;
- }
-
- if (strlen(new) >= (strlen(old) * 2)) {
- return 0;
- }
-
- /* passwords are too similar */
- return 1;
-}
-
-/*
- * enough classes of charecters
- */
-
-static int minclass (struct cracklib_options *opt,
- const char *new)
-{
- int digits = 0;
- int uppers = 0;
- int lowers = 0;
- int others = 0;
- int total_class;
- int i;
- int retval;
-
- D(( "called" ));
- for (i = 0; new[i]; i++)
- {
- if (isdigit (new[i]))
- digits = 1;
- else if (isupper (new[i]))
- uppers = 1;
- else if (islower (new[i]))
- lowers = 1;
- else
- others = 1;
- }
-
- total_class = digits + uppers + lowers + others;
-
- D (("total class: %d\tmin_class: %d", total_class, opt->min_class));
-
- if (total_class >= opt->min_class)
- retval = 0;
- else
- retval = 1;
-
- return retval;
-}
-
-
-/*
- * a nice mix of characters.
- */
-static int simple(struct cracklib_options *opt, const char *new)
-{
- int digits = 0;
- int uppers = 0;
- int lowers = 0;
- int others = 0;
- int size;
- int i;
-
- for (i = 0;new[i];i++) {
- if (isdigit (new[i]))
- digits++;
- else if (isupper (new[i]))
- uppers++;
- else if (islower (new[i]))
- lowers++;
- else
- others++;
- }
-
- /*
- * The scam was this - a password of only one character type
- * must be 8 letters long. Two types, 7, and so on.
- * This is now changed, the base size and the credits or defaults
- * see the docs on the module for info on these parameters, the
- * defaults cause the effect to be the same as before the change
- */
-
- if ((opt->dig_credit >= 0) && (digits > opt->dig_credit))
- digits = opt->dig_credit;
-
- if ((opt->up_credit >= 0) && (uppers > opt->up_credit))
- uppers = opt->up_credit;
-
- if ((opt->low_credit >= 0) && (lowers > opt->low_credit))
- lowers = opt->low_credit;
-
- if ((opt->oth_credit >= 0) && (others > opt->oth_credit))
- others = opt->oth_credit;
-
- size = opt->min_length;
-
- if (opt->dig_credit >= 0)
- size -= digits;
- else if (digits < opt->dig_credit * -1)
- return 1;
-
- if (opt->up_credit >= 0)
- size -= uppers;
- else if (uppers < opt->up_credit * -1)
- return 1;
-
- if (opt->low_credit >= 0)
- size -= lowers;
- else if (lowers < opt->low_credit * -1)
- return 1;
-
- if (opt->oth_credit >= 0)
- size -= others;
- else if (others < opt->oth_credit * -1)
- return 1;
-
- if (size <= i)
- return 0;
-
- return 1;
-}
-
-static int consecutive(struct cracklib_options *opt, const char *new)
-{
- char c;
- int i;
- int same;
-
- if (opt->max_repeat == 0)
- return 0;
-
- for (i = 0; new[i]; i++) {
- if (i > 0 && new[i] == c) {
- ++same;
- if (same > opt->max_repeat)
- return 1;
- } else {
- c = new[i];
- same = 1;
- }
- }
- return 0;
-}
-
-static int usercheck(struct cracklib_options *opt, const char *new,
- char *user)
-{
- char *f, *b;
-
- if (!opt->reject_user)
- return 0;
-
- if (strstr(new, user) != NULL)
- return 1;
-
- /* now reverse the username, we can do that in place
- as it is strdup-ed */
- f = user;
- b = user+strlen(user)-1;
- while (f < b) {
- char c;
-
- c = *f;
- *f = *b;
- *b = c;
- --b;
- ++f;
- }
-
- if (strstr(new, user) != NULL)
- return 1;
- return 0;
-}
-
-static char * str_lower(char *string)
-{
- char *cp;
-
- if (!string)
- return NULL;
-
- for (cp = string; *cp; cp++)
- *cp = tolower(*cp);
- return string;
-}
-
-static const char *password_check(struct cracklib_options *opt,
- const char *old, const char *new,
- const char *user)
-{
- const char *msg = NULL;
- char *oldmono = NULL, *newmono, *wrapped = NULL;
- char *usermono = NULL;
-
- if (old && strcmp(new, old) == 0) {
- msg = _("is the same as the old one");
- return msg;
- }
-
- newmono = str_lower(x_strdup(new));
- if (!newmono)
- msg = _("memory allocation error");
-
- usermono = str_lower(x_strdup(user));
- if (!usermono)
- msg = _("memory allocation error");
-
- if (!msg && old) {
- oldmono = str_lower(x_strdup(old));
- if (oldmono)
- wrapped = malloc(strlen(oldmono) * 2 + 1);
- if (wrapped) {
- strcpy (wrapped, oldmono);
- strcat (wrapped, oldmono);
- } else {
- msg = _("memory allocation error");
- }
- }
-
- if (!msg && palindrome(newmono))
- msg = _("is a palindrome");
-
- if (!msg && oldmono && strcmp(oldmono, newmono) == 0)
- msg = _("case changes only");
-
- if (!msg && oldmono && similar(opt, oldmono, newmono))
- msg = _("is too similar to the old one");
-
- if (!msg && simple(opt, new))
- msg = _("is too simple");
-
- if (!msg && wrapped && strstr(wrapped, newmono))
- msg = _("is rotated");
-
- if (!msg && minclass (opt, new))
- msg = _("not enough character classes");
-
- if (!msg && consecutive(opt, new))
- msg = _("contains too many same characters consecutively");
-
- if (!msg && usercheck(opt, newmono, usermono))
- msg = _("contains the user name in some form");
-
- free(usermono);
- if (newmono) {
- memset(newmono, 0, strlen(newmono));
- free(newmono);
- }
- if (oldmono) {
- memset(oldmono, 0, strlen(oldmono));
- free(oldmono);
- }
- if (wrapped) {
- memset(wrapped, 0, strlen(wrapped));
- free(wrapped);
- }
-
- return msg;
-}
-
-
-static int _pam_unix_approve_pass(pam_handle_t *pamh,
- unsigned int ctrl,
- struct cracklib_options *opt,
- const char *pass_old,
- const char *pass_new)
-{
- const char *msg = NULL;
- const char *user;
- int retval;
-
- if (pass_new == NULL || (pass_old && !strcmp(pass_old,pass_new))) {
- if (ctrl & PAM_DEBUG_ARG)
- pam_syslog(pamh, LOG_DEBUG, "bad authentication token");
- pam_error(pamh, "%s", pass_new == NULL ?
- _("No password supplied"):_("Password unchanged"));
- return PAM_AUTHTOK_ERR;
- }
-
- retval = pam_get_user(pamh, &user, NULL);
- if (retval != PAM_SUCCESS || user == NULL) {
- if (ctrl & PAM_DEBUG_ARG)
- pam_syslog(pamh,LOG_ERR,"Can not get username");
- return PAM_AUTHTOK_ERR;
- }
- /*
- * if one wanted to hardwire authentication token strength
- * checking this would be the place
- */
- msg = password_check(opt, pass_old, pass_new, user);
-
- if (msg) {
- if (ctrl & PAM_DEBUG_ARG)
- pam_syslog(pamh, LOG_NOTICE,
- "new passwd fails strength check: %s", msg);
- pam_error(pamh, _("BAD PASSWORD: %s"), msg);
- return PAM_AUTHTOK_ERR;
- };
- return PAM_SUCCESS;
-
-}
-
-/* The Main Thing (by Cristian Gafton, CEO at this module :-)
- * (stolen from http://home.netscape.com)
- */
-PAM_EXTERN int pam_sm_chauthtok(pam_handle_t *pamh, int flags,
- int argc, const char **argv)
-{
- unsigned int ctrl;
- struct cracklib_options options;
-
- D(("called."));
-
- memset(&options, 0, sizeof(options));
- options.retry_times = CO_RETRY_TIMES;
- options.diff_ok = CO_DIFF_OK;
- options.diff_ignore = CO_DIFF_IGNORE;
- options.min_length = CO_MIN_LENGTH;
- options.dig_credit = CO_DIG_CREDIT;
- options.up_credit = CO_UP_CREDIT;
- options.low_credit = CO_LOW_CREDIT;
- options.oth_credit = CO_OTH_CREDIT;
- options.cracklib_dictpath = CRACKLIB_DICTS;
-
- ctrl = _pam_parse(pamh, &options, argc, argv);
-
- if (flags & PAM_PRELIM_CHECK) {
- /* Check for passwd dictionary */
- /* We cannot do that, since the original path is compiled
- into the cracklib library and we don't know it. */
- return PAM_SUCCESS;
- } else if (flags & PAM_UPDATE_AUTHTOK) {
- int retval;
- const void *oldtoken;
- int tries;
-
- D(("do update"));
-
-
- retval = pam_get_item (pamh, PAM_OLDAUTHTOK, &oldtoken);
- if (retval != PAM_SUCCESS) {
- if (ctrl & PAM_DEBUG_ARG)
- pam_syslog(pamh,LOG_ERR,"Can not get old passwd");
- oldtoken = NULL;
- }
-
- tries = 0;
- while (tries < options.retry_times) {
- const char *crack_msg;
- const char *newtoken = NULL;
-
-
- tries++;
-
- /* Planned modus operandi:
- * Get a passwd.
- * Verify it against cracklib.
- * If okay get it a second time.
- * Check to be the same with the first one.
- * set PAM_AUTHTOK and return
- */
-
- retval = pam_get_authtok_noverify (pamh, &newtoken, NULL);
- if (retval != PAM_SUCCESS) {
- pam_syslog(pamh, LOG_ERR, "pam_get_authtok_noverify returned error: %s",
- pam_strerror (pamh, retval));
- continue;
- } else if (newtoken == NULL) { /* user aborted password change, quit */
- return PAM_AUTHTOK_ERR;
- }
-
- D(("testing password"));
- /* now test this passwd against cracklib */
-
- D(("against cracklib"));
- if ((crack_msg = FascistCheck (newtoken, options.cracklib_dictpath))) {
- if (ctrl & PAM_DEBUG_ARG)
- pam_syslog(pamh,LOG_DEBUG,"bad password: %s",crack_msg);
- pam_error (pamh, _("BAD PASSWORD: %s"), crack_msg);
- if (getuid() || (flags & PAM_CHANGE_EXPIRED_AUTHTOK))
- {
- pam_set_item (pamh, PAM_AUTHTOK, NULL);
- retval = PAM_AUTHTOK_ERR;
- continue;
- }
- }
-
- /* check it for strength too... */
- D(("for strength"));
- retval = _pam_unix_approve_pass (pamh, ctrl, &options,
- oldtoken, newtoken);
- if (retval != PAM_SUCCESS) {
- if (getuid() || (flags & PAM_CHANGE_EXPIRED_AUTHTOK))
- {
- pam_set_item(pamh, PAM_AUTHTOK, NULL);
- retval = PAM_AUTHTOK_ERR;
- continue;
- }
- }
-
- retval = pam_get_authtok_verify (pamh, &newtoken, NULL);
- if (retval != PAM_SUCCESS) {
- pam_syslog(pamh, LOG_ERR, "pam_get_authtok_verify returned error: %s",
- pam_strerror (pamh, retval));
- pam_set_item(pamh, PAM_AUTHTOK, NULL);
- continue;
- } else if (newtoken == NULL) { /* user aborted password change, quit */
- return PAM_AUTHTOK_ERR;
- }
-
- return PAM_SUCCESS;
- }
-
- D(("returning because maxtries reached"));
-
- pam_set_item (pamh, PAM_AUTHTOK, NULL);
-
- /* if we have only one try, we can use the real reason,
- else say that there were too many tries. */
- if (options.retry_times > 1)
- return PAM_MAXTRIES;
- else
- return retval;
-
- } else {
- if (ctrl & PAM_DEBUG_ARG)
- pam_syslog(pamh, LOG_NOTICE, "UNKNOWN flags setting %02X",flags);
- return PAM_SERVICE_ERR;
- }
-
- /* Not reached */
- return PAM_SERVICE_ERR;
-}
-
-
-
-#ifdef PAM_STATIC
-/* static module data */
-struct pam_module _pam_cracklib_modstruct = {
- "pam_cracklib",
- NULL,
- NULL,
- NULL,
- NULL,
- NULL,
- pam_sm_chauthtok
-};
-#endif
-
-/*
- * Copyright (c) Cristian Gafton <gafton(a)redhat.com>, 1996.
- * All rights reserved
- * Copyright (c) Red Hat, Inc, 2011
- * Copyright (c) Tomas Mraz <tm(a)t8m.info>, 2011
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- * notice, and the entire permission notice in its entirety,
- * including the disclaimer of warranties.
- * 2. Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in the
- * documentation and/or other materials provided with the distribution.
- * 3. The name of the author may not be used to endorse or promote
- * products derived from this software without specific prior
- * written permission.
- *
- * ALTERNATIVELY, this product may be distributed under the terms of
- * the GNU Public License, in which case the provisions of the GPL are
- * required INSTEAD OF the above restrictions. (This clause is
- * necessary due to a potential bad interaction between the GPL and
- * the restrictions contained in a BSD-style copyright.)
- *
- * THIS SOFTWARE IS PROVIDED `AS IS'' AND ANY EXPRESS OR IMPLIED
- * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
- * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
- * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- *
- * The following copyright was appended for the long password support
- * added with the libpam 0.58 release:
- *
- * Modificaton Copyright (c) Philip W. Dalrymple III <pwd(a)mdtsoft.com>
- * 1997. All rights reserved
- *
- * THE MODIFICATION THAT PROVIDES SUPPORT FOR LONG PASSWORD TYPE CHECKING TO
- * THIS SOFTWARE IS PROVIDED `AS IS'' AND ANY EXPRESS OR IMPLIED
- * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
- * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
- * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- */
diff -r c2bd0a40a581 -r 49693f19c051 src/pwquality.conf
--- /dev/null Thu Jan 01 00:00:00 1970 +0000
+++ b/src/pwquality.conf Mon Oct 03 16:26:19 2011 +0200
@@ -0,0 +1,45 @@
+# Configuration for systemwide password quality limits
+# Defaults:
+#
+# Number of characters in the new password that must not be present in the
+# old password.
+# difok = 5
+#
+# How many characters should the password have before difok will be
+# ignored.
+# difignore = 23
+#
+# Minimum acceptable size for the new password (plus one if
+# credits are not disabled which is the default). (See pam_cracklib manual.)
+# Cannot be set to lower value than 6.
+# minlen = 9
+#
+# The maximum credit for having digits in the new password. If less than 0
+# it is the minimum number of digits in the new password.
+# dcredit = 1
+#
+# The maximum credit for having uppercase characters in the new password.
+# If less than 0 it is the minimum number of uppercase characters in the new
+# password.
+# ucredit = 1
+#
+# The maximum credit for having lowercase characters in the new password.
+# If less than 0 it is the minimum number of lowercase characters in the new
+# password.
+# lcredit = 1
+#
+# The maximum credit for having other characters in the new password.
+# If less than 0 it is the minimum number of other characters in the new
+# password.
+# ocredit = 1
+#
+# The minimum number of required classes of characters for the new
+# password (digits, uppercase, lowercase, others).
+# minclass = 0
+#
+# The maximum number of allowed consecutive characters in the new password.
+# The check is disabled if the value is 0.
+# maxrepeat = 0
+#
+# Path to the cracklib dictionaries. Default is to use the cracklib default.
+# dictpath =
12 years, 6 months