[linux-pam] #4: [PATCH] po/ja.po: Fix some wrong translations and so on
by fedora-badges
#4: [PATCH] po/ja.po: Fix some wrong translations and so on
--------------------+-------------------------------------------------------
Reporter: fumiyas | Owner: pam-developers(a)lists.fedorahosted.org
Type: defect | Status: new
Priority: major | Component: library
Version: 1.1.x | Keywords: l10n
--------------------+-------------------------------------------------------
I've updated po/ja.po to fix some wrong translations and so on.
Please see and commit the attached patch to master repository if you feel
good.
Should I contact the original translator (Kiyoto Hashida
<khashida(a)redhat.com>) to check and confirm this patch?
--
Ticket URL: <https://fedorahosted.org/linux-pam/ticket/4>
linux-pam <http://fedorahosted.org/linux-pam>
The Linux-PAM (Pluggable Authentication Modules) project
8 years, 11 months
[linux-pam] #29: pam_env documentation update
by fedora-badges
#29: pam_env documentation update
--------------------------+------------------------------
Reporter: kohtala | Owner: pam-developers@…
Type: enhancement | Status: new
Priority: major | Component: documentation
Version: 1.1.x | Keywords: pam_env
Blocked By: | Blocking:
--------------------------+------------------------------
I found pam_env and pam_env.conf documents very confusing and incomplete.
Once I figured out how it works, I wrote update.
--
Ticket URL: <https://fedorahosted.org/linux-pam/ticket/29>
linux-pam <http://fedorahosted.org/linux-pam>
The Linux-PAM (Pluggable Authentication Modules) project
9 years
[linux-pam] #24: [PATCH] pam_env: Expand @{HOME} and @{SHELL}
by fedora-badges
#24: [PATCH] pam_env: Expand @{HOME} and @{SHELL}
--------------------------+------------------------------
Reporter: chrisse | Owner: pam-developers@…
Type: enhancement | Status: new
Priority: major | Component: modules
Version: | Keywords:
Blocked By: | Blocking:
--------------------------+------------------------------
I came across the problem of trying to modify XDG_DATA_HOME etc. to some
other value. pam_env seems to be the ideal point to set those variables,
and pam_env.conf supports expansions.
However, as already explained in the configuration examples, the ${HOME}
environment variable is only set later from the process calling PAM, so
there is currently no possibility to actually use this feature.
The following patch adds support to expand @{SHELL} and @{HOME}. It does
so by looking up the password database entry corresponding to the user and
returning the pw_dir and pw_shell fields.
The patch works, but it is not complete, since it does not update the
documentation. I consider it to be a proof of concept, since I didn't know
where exactly to fit in this functionality in the existing code.
--
Ticket URL: <https://fedorahosted.org/linux-pam/ticket/24>
linux-pam <http://fedorahosted.org/linux-pam>
The Linux-PAM (Pluggable Authentication Modules) project
9 years
[linux-pam] #20: compilation warnings
by fedora-badges
#20: compilation warnings
---------------------+------------------------------
Reporter: mirraz | Owner: pam-developers@…
Type: defect | Status: new
Priority: minor | Component: library
Version: | Keywords:
Blocked By: | Blocking:
---------------------+------------------------------
Building pam-1.1.6 I'v got this compilation warnings:
{{{
md5.c:145:2: warning: dereferencing type-punned pointer will break strict-
aliasing rules [-Wstrict-aliasing]
md5.c:146:2: warning: dereferencing type-punned pointer will break strict-
aliasing rules [-Wstrict-aliasing]
misc_conv.c:213:22: warning: the address of ‘line’ will always evaluate as
‘true’ [-Waddress]
misc_conv.c:325:15: warning: the address of ‘binary_prompt’ will always
evaluate as ‘true’ [-Waddress]
}}}
--
Ticket URL: <https://fedorahosted.org/linux-pam/ticket/20>
linux-pam <http://fedorahosted.org/linux-pam>
The Linux-PAM (Pluggable Authentication Modules) project
9 years
[linux-pam] #9: Allow pam_lastlog to write to utmp as an option
by fedora-badges
#9: Allow pam_lastlog to write to utmp as an option
-------------------------+-------------------------------------------------
Reporter: | Owner: pam-developers@…
shadowkyogre | Status: new
Type: | Component: modules
enhancement | Keywords: pam_lastlog utmp update patch
Priority: major | prototype
Version: 1.1.x | Blocking:
Blocked By: |
-------------------------+-------------------------------------------------
The following patch for pam_lastlog allows it to write to utmp as well as
wtmp. Part of the code is from xorg-sessreg to help make a utmp entry. I
only tested this on my desktop, which is running Arch Linux, so some
modifications may need to be made in order to make it more portable.
--
Ticket URL: <https://fedorahosted.org/linux-pam/ticket/9>
linux-pam <http://fedorahosted.org/linux-pam>
The Linux-PAM (Pluggable Authentication Modules) project
9 years
[linux-pam] #27: pam_timestamp path traversal issue
by fedora-badges
#27: pam_timestamp path traversal issue
-----------------------+------------------------------
Reporter: tmraz | Owner: pam-developers@…
Type: security | Status: new
Priority: major | Component: modules
Version: | Keywords:
Blocked By: | Blocking:
-----------------------+------------------------------
pam_timestamp uses PAM_RUSER and PAM_TTY directly without any checks. If
the user can mainpulate PAM_RUSER and PAM_TTY contents (which is mostly
not possible, but there might be scenarios where it is) he would be able
to get access to a service without proper checking.
See http://seclists.org/oss-sec/2014/q1/645 for the original report by
Sebastian Krahmer.
I suppose sufficient mitigation would be to look for ".." in both
PAM_RUSER and PAM_TTY and reject authentication attempt if they contain
this string.
I would also document that the module should never be used with services
where the authenticating user can manipulate the PAM_RUSER variable
contents.
--
Ticket URL: <https://fedorahosted.org/linux-pam/ticket/27>
linux-pam <http://fedorahosted.org/linux-pam>
The Linux-PAM (Pluggable Authentication Modules) project
9 years, 4 months
[linux-pam] #30: Support for skipping to labels instead of numbers of rules.
by fedora-badges
#30: Support for skipping to labels instead of numbers of rules.
--------------------------+------------------------------
Reporter: antarus | Owner: pam-developers@…
Type: enhancement | Status: new
Priority: minor | Component: library
Version: | Keywords:
Blocked By: | Blocking:
--------------------------+------------------------------
Currently the advanced control syntax allows things like:
auth [success=1] pam_module.so
However, some sites (such as mine) have quite a complicated authentication
structure, there are numerous authmechs, some are optional, and it is
altogether a bit annoying to choose the correct number of rules to skip.
Currently we try to keep the number of skip rules the same by injecting
pam_permit.so lines with [default=ignore].
However we view this as fragile. I think what we would like to see is a
label system.
An example config for our mechs:
### Begin SSO Stack
auth [success=ok new_authtok_reqd=ok default=3] pam_sso.so
<% if @enabled_pam_krb5 %>
auth [default=ignore] pam_krb5.so try_first_pass
<% else %>
# This null rule allows us to keep a deterministic skip value.
auth [default=ignore] pam_permit.so
<% end %>
# Auth succeeded, don't try any more stacks.
auth [default=ignore] pam_group.so
auth [default=done] pam_permit.so
### End SSO Stack
### Begin KRB5 Stack
auth [success=ok new_authtok_reqd=ok default=1] pam_krb5.so try_first_pass
# Auth succeeded, don't try any more stacks.
auth [default=ignore] pam_group.so
auth [default=done] pam_permit.so
### End KRB5 Stack
### Begin Unix Stack
auth [success=ok new_authtok_reqd=ok default=die] pam_unix.so
try_first_pass
auth [default=ignore] pam_group.so
auth [default=done] pam_permit.so
### End Unix Stack
A config with labels might be:
### Begin SSO Stack
auth [success=ok new_authtok_reqd=ok default=@sso_end] pam_sso.so
<% if @enabled_pam_krb5 %>
# We need pam_krb5 even if CorpSSO worked because we need to get a
kerberos TGT (not possible using pam-session alone.)
auth [default=ignore] pam_krb5.so try_first_pass
<% else %>
# This null rule allows us to keep a deterministic skip value.
auth [default=ignore] pam_empty.so
<% end %>
# Auth succeeded, don't try any more stacks.
auth [default=ignore] pam_group.so
auth [default=done] pam_permit.so
label @sso_end
### End CorpSSO Stack
### Begin KRB5 Stack
auth [success=ok new_authtok_reqd=ok default=@krb5_end] pam_krb5.so
try_first_pass
# Auth succeeded, don't try any more stacks.
auth [default=ignore] pam_group.so
auth [default=done] pam_permit.so
label @krb5_end
### End KRB5 Stack
### Begin Unix Stack
auth [success=ok new_authtok_reqd=ok default=die] pam_unix.so
try_first_pass
auth [default=ignore] pam_group.so
auth [default=done] pam_permit.so
### End Unix Stack
The label rules allow us to jump to the 'end of a ruleset' in an obvious
way. It also means if we add more rules in a ruleset, we don't need to
keep the skip numbers in sync with the number of rules; although we do
need to keep rule ordered (label rules are last, in this use case.)
If we define a new rule type (a label rule) I believe we can implement
this briefly in libpam/pam_dispatch.c by handling jump actions as strings
as well as integers (strings prefix with @ to indicate labels.)
We can then iterate over the current stack looking for a label rule with a
matching string. A failed match is similar to a failed skip rule as it is
implemented today.
-A
--
Ticket URL: <https://fedorahosted.org/linux-pam/ticket/30>
linux-pam <http://fedorahosted.org/linux-pam>
The Linux-PAM (Pluggable Authentication Modules) project
10 years