/srv/hg/libpwquality: Add an 'enforcing' setting to make the che...
by admin@fedoraproject.org
changeset 79ca3b91513f in /srv/hg/libpwquality
details: http://hg.fedorahosted.org/hg/srv/hg/libpwquality?cmd=changeset;node=79ca...
summary: Add an 'enforcing' setting to make the checks to be warning-only in PAM.
diffstat:
doc/man/pam_pwquality.8.pod | 6 ++++++
doc/man/pwquality.conf.5.pod | 7 +++++++
src/pam_pwquality.c | 6 ++++--
src/pwqprivate.h | 2 ++
src/pwquality.conf | 5 +++++
src/pwquality.h | 1 +
src/settings.c | 8 ++++++++
7 files changed, 33 insertions(+), 2 deletions(-)
diffs (137 lines):
diff -r 842f68d0e021 -r 79ca3b91513f doc/man/pam_pwquality.8.pod
--- a/doc/man/pam_pwquality.8.pod Mon Oct 31 10:36:07 2016 +0100
+++ b/doc/man/pam_pwquality.8.pod Tue Nov 01 15:16:54 2016 +0100
@@ -202,6 +202,12 @@
this check is enabled. It is not performed for user names shorter
than 3 characters.
+=item B<enforcing=>I<N>
+
+If nonzero, reject the password if it fails the checks, otherwise
+only print the warning. The default is 1 which means that the weak password
+is rejected (for non-root users).
+
=item B<badwords=>I<< <list of words> >>
The words more than 3 characters long from this space separated list are
diff -r 842f68d0e021 -r 79ca3b91513f doc/man/pwquality.conf.5.pod
--- a/doc/man/pwquality.conf.5.pod Mon Oct 31 10:36:07 2016 +0100
+++ b/doc/man/pwquality.conf.5.pod Tue Nov 01 15:16:54 2016 +0100
@@ -107,6 +107,13 @@
contains the user name in some form. It is not performed for user names shorter
than 3 characters. (default 1)
+=item B<enforcing=>I<N>
+
+If nonzero, reject the password if it fails the checks, otherwise
+only print the warning. This setting applies only to the pam_pwquality module
+and possibly other applications that explicitly change their behavior
+based on it. It does not affect L<pwmake(1)> and L<pwscore(1)>. (default 1)
+
=item B<badwords>
Space separated list of words that must not be contained in the password. These
diff -r 842f68d0e021 -r 79ca3b91513f src/pam_pwquality.c
--- a/src/pam_pwquality.c Mon Oct 31 10:36:07 2016 +0100
+++ b/src/pam_pwquality.c Tue Nov 01 15:16:54 2016 +0100
@@ -235,13 +235,15 @@
if (retval < 0) {
const char *msg;
char buf[PWQ_MAX_ERROR_MESSAGE_LEN];
+ int enforcing = 1;
msg = pwquality_strerror(buf, sizeof(buf), retval, auxerror);
if (ctrl & PAM_DEBUG_ARG)
pam_syslog(pamh, LOG_DEBUG, "bad password: %s", msg);
pam_error(pamh, _("BAD PASSWORD: %s"), msg);
+ pwquality_get_int_value(options.pwq, PWQ_SETTING_ENFORCING, &enforcing);
- if (getuid() || options.enforce_for_root ||
- (flags & PAM_CHANGE_EXPIRED_AUTHTOK)) {
+ if (enforcing && (getuid() || options.enforce_for_root ||
+ (flags & PAM_CHANGE_EXPIRED_AUTHTOK))) {
pam_set_item(pamh, PAM_AUTHTOK, NULL);
retval = PAM_AUTHTOK_ERR;
continue;
diff -r 842f68d0e021 -r 79ca3b91513f src/pwqprivate.h
--- a/src/pwqprivate.h Mon Oct 31 10:36:07 2016 +0100
+++ b/src/pwqprivate.h Tue Nov 01 15:16:54 2016 +0100
@@ -26,6 +26,7 @@
int gecos_check;
int dict_check;
int user_check;
+ int enforcing;
char *bad_words;
char *dict_path;
};
@@ -44,6 +45,7 @@
#define PWQ_DEFAULT_OTH_CREDIT 0
#define PWQ_DEFAULT_DICT_CHECK 1
#define PWQ_DEFAULT_USER_CHECK 1
+#define PWQ_DEFAULT_ENFORCING 1
#define PWQ_TYPE_INT 1
#define PWQ_TYPE_STR 2
diff -r 842f68d0e021 -r 79ca3b91513f src/pwquality.conf
--- a/src/pwquality.conf Mon Oct 31 10:36:07 2016 +0100
+++ b/src/pwquality.conf Tue Nov 01 15:16:54 2016 +0100
@@ -54,5 +54,10 @@
# The check is enabled if the value is not 0.
# usercheck = 1
#
+# Whether the check is enforced by the PAM module and possibly other
+# applications.
+# The new password is rejected if it fails the check and the value is not 0.
+# enforcing = 1
+#
# Path to the cracklib dictionaries. Default is to use the cracklib default.
# dictpath =
diff -r 842f68d0e021 -r 79ca3b91513f src/pwquality.h
--- a/src/pwquality.h Mon Oct 31 10:36:07 2016 +0100
+++ b/src/pwquality.h Tue Nov 01 15:16:54 2016 +0100
@@ -29,6 +29,7 @@
#define PWQ_SETTING_MAX_SEQUENCE 14
#define PWQ_SETTING_DICT_CHECK 15
#define PWQ_SETTING_USER_CHECK 16
+#define PWQ_SETTING_ENFORCING 17
#define PWQ_MAX_ENTROPY_BITS 256
#define PWQ_MIN_ENTROPY_BITS 56
diff -r 842f68d0e021 -r 79ca3b91513f src/settings.c
--- a/src/settings.c Mon Oct 31 10:36:07 2016 +0100
+++ b/src/settings.c Tue Nov 01 15:16:54 2016 +0100
@@ -35,6 +35,7 @@
pwq->oth_credit = PWQ_DEFAULT_OTH_CREDIT;
pwq->dict_check = PWQ_DEFAULT_DICT_CHECK;
pwq->user_check = PWQ_DEFAULT_USER_CHECK;
+ pwq->enforcing = PWQ_DEFAULT_ENFORCING;
return pwq;
}
@@ -64,6 +65,7 @@
{ "gecoscheck", PWQ_SETTING_GECOS_CHECK, PWQ_TYPE_INT},
{ "dictcheck", PWQ_SETTING_DICT_CHECK, PWQ_TYPE_INT},
{ "usercheck", PWQ_SETTING_USER_CHECK, PWQ_TYPE_INT},
+ { "enforcing", PWQ_SETTING_ENFORCING, PWQ_TYPE_INT},
{ "badwords", PWQ_SETTING_BAD_WORDS, PWQ_TYPE_STR},
{ "dictpath", PWQ_SETTING_DICT_PATH, PWQ_TYPE_STR}
};
@@ -338,6 +340,9 @@
case PWQ_SETTING_USER_CHECK:
pwq->user_check = value;
break;
+ case PWQ_SETTING_ENFORCING:
+ pwq->enforcing = value;
+ break;
default:
return PWQ_ERROR_NON_INT_SETTING;
}
@@ -421,6 +426,9 @@
case PWQ_SETTING_USER_CHECK:
*value = pwq->user_check;
break;
+ case PWQ_SETTING_ENFORCING:
+ *value = pwq->enforcing;
+ break;
default:
return PWQ_ERROR_NON_INT_SETTING;
}
7 years, 5 months