[linux-pam] #54: Make strings used on login screen user-friendly
by fedora-badges
#54: Make strings used on login screen user-friendly
--------------------------+------------------------------
Reporter: catanzaro | Owner: pam-developers@…
Type: enhancement | Status: new
Priority: minor | Component: modules
Version: 1.2.x | Keywords:
Blocked By: | Blocking:
--------------------------+------------------------------
Hi,
For Fedora Workstation we would like to make some changes to strings in
Linux-PAM that appear on the login screen, to make the user experience a
bit more simple. Some of these strings contain technical terminology that
we'd like to remove:
"You are required to change your password immediately (root enforced)."
The problem with this string is that we expect users do not understand
what a root account is.
"(current) UNIX password:" "Enter new UNIX password:" "Retype new UNIX
password:" The problem with these strings is that we do not expect users
to understand what UNIX is. A user might become confused as to how a UNIX
password differs from a normal password, and not realize they are the same
thing.
At first I thought we might want to add an opt-in configuration setting to
tell PAM to avoid technical terminology in its prompts, in order to avoid
changing the strings sent to command-line applications like passwd (where
the user is expected to understand concepts like UNIX and root), but since
the required changes are so simple, I think it's probably best to avoid
this...?
--
Ticket URL: <https://fedorahosted.org/linux-pam/ticket/54>
linux-pam <http://fedorahosted.org/linux-pam>
The Linux-PAM (Pluggable Authentication Modules) project
8 years
[linux-pam] #46: Fix build with musl libc
by fedora-badges
#46: Fix build with musl libc
----------------------+------------------------------
Reporter: yousong | Owner: pam-developers@…
Type: defect | Status: new
Priority: major | Component: library
Version: | Keywords:
Blocked By: | Blocking:
----------------------+------------------------------
Hi, patch files in the attachments are produced when building libpam
within OpenWrt. Not long ago, OpenWrt switched to musl as the default
libc which is relatively and different from other implementations, e.g.
crypt() function is part of musl-libc itself, many old functions are
dropped from the implementation, etc.
--
Ticket URL: <https://fedorahosted.org/linux-pam/ticket/46>
linux-pam <http://fedorahosted.org/linux-pam>
The Linux-PAM (Pluggable Authentication Modules) project
8 years
[linux-pam] #53: pam_lastlog should have option to resolve hostname
by fedora-badges
#53: pam_lastlog should have option to resolve hostname
--------------------------+------------------------------
Reporter: chowbok | Owner: pam-developers@…
Type: enhancement | Status: new
Priority: trivial | Component: modules
Version: 1.2.x | Keywords:
Blocked By: | Blocking:
--------------------------+------------------------------
pam_lastlog should be able to report what host the user last logged in
from, not just the IP. It would be very cool if this could be added as an
option.
--
Ticket URL: <https://fedorahosted.org/linux-pam/ticket/53>
linux-pam <http://fedorahosted.org/linux-pam>
The Linux-PAM (Pluggable Authentication Modules) project
8 years
pam_unix.so and IPv6 support
by Thorsten Kukuk
Hi,
while finalizing IPv6 support for the Linux NIS implementation,
I found a problem with pam_unix.so. pam_unix.so can also only
change NIS passwords, if IPv4 is used, but not with IPv6.
My suggested patch would be (and yes, there is no simple TIRPC
variant of SunRPC getrpcport :( ):
diff --git a/configure.ac b/configure.ac
index f33b959..bf00de5 100644
--- a/configure.ac
+++ b/configure.ac
@@ -475,9 +475,12 @@ AS_IF([test "x$enable_nis" != "xno"], [
LIBS="$LIBS $libtirpc_LIBS"
], [:;])
- AC_SEARCH_LIBS([yp_get_default_domain], [nsl])
+ PKG_CHECK_MODULES([NSL], [libnsl], [], [AC_CHECK_LIB([nsl],[yp_match],[NSL_LIBS="-lnsl"],[NSL_LIBS=""])])
+ CFLAGS="$CFLAGS $NSL_CFLAGS"
+ LIBS="$LIBS $NSL_LIBS"
AC_CHECK_FUNCS([yp_get_default_domain yperr_string yp_master yp_bind yp_match yp_unbind])
+ AC_CHECK_FUNCS([getrpcport rpcb_getaddr])
AC_CHECK_HEADERS([rpc/rpc.h rpcsvc/ypclnt.h rpcsvc/yp_prot.h])
AC_CHECK_DECLS([getrpcport], , , [
#if HAVE_RPC_RPC_H
@@ -485,16 +488,10 @@ AS_IF([test "x$enable_nis" != "xno"], [
#endif
])
- NIS_CFLAGS="${CFLAGS%${old_CFLAGS}}"
- NIS_LIBS="${LIBS%${old_LIBS}}"
-
CFLAGS="$old_CFLAGS"
LIBS="$old_LIBS"
])
-AC_SUBST([NIS_CFLAGS])
-AC_SUBST([NIS_LIBS])
-
AC_ARG_ENABLE([selinux],
AS_HELP_STRING([--disable-selinux],[do not use SELinux]),
WITH_SELINUX=$enableval, WITH_SELINUX=yes)
diff --git a/modules/pam_unix/Makefile.am b/modules/pam_unix/Makefile.am
index 56ed591..2dc2bd1 100644
--- a/modules/pam_unix/Makefile.am
+++ b/modules/pam_unix/Makefile.am
@@ -19,7 +19,7 @@ secureconfdir = $(SCONFIGDIR)
AM_CFLAGS = -I$(top_srcdir)/libpam/include -I$(top_srcdir)/libpamc/include \
-DCHKPWD_HELPER=\"$(sbindir)/unix_chkpwd\" \
-DUPDATE_HELPER=\"$(sbindir)/unix_update\" \
- $(NIS_CFLAGS)
+ @libtirpc_CFLAGS@ @NSL_CFLAGS@
if HAVE_LIBSELINUX
AM_CFLAGS += -D"WITH_SELINUX"
@@ -30,7 +30,7 @@ if HAVE_VERSIONING
pam_unix_la_LDFLAGS += -Wl,--version-script=$(srcdir)/../modules.map
endif
pam_unix_la_LIBADD = $(top_builddir)/libpam/libpam.la \
- @LIBCRYPT@ @LIBSELINUX@ $(NIS_LIBS)
+ @LIBCRYPT@ @LIBSELINUX@ @libtirpc_LIBS@ @NSL_LIBS@
securelib_LTLIBRARIES = pam_unix.la
diff --git a/modules/pam_unix/pam_unix_passwd.c b/modules/pam_unix/pam_unix_passwd.c
index c2e5de5..f7791b1 100644
--- a/modules/pam_unix/pam_unix_passwd.c
+++ b/modules/pam_unix/pam_unix_passwd.c
@@ -96,7 +96,7 @@
# include "yppasswd.h"
-# if !HAVE_DECL_GETRPCPORT
+# if !HAVE_DECL_GETRPCPORT &&!HAVE_RPCB_GETADDR
extern int getrpcport(const char *host, unsigned long prognum,
unsigned long versnum, unsigned int proto);
# endif /* GNU libc 2.1 */
@@ -118,11 +118,48 @@ extern int getrpcport(const char *host, unsigned long prognum,
#define MAX_PASSWD_TRIES 3
#ifdef HAVE_NIS
+#ifdef HAVE_RPCB_GETADDR
+static unsigned short
+__taddr2port (const struct netconfig *nconf, const struct netbuf *nbuf)
+{
+ unsigned short port = 0;
+ struct __rpc_sockinfo si;
+ struct sockaddr_in *sin;
+ struct sockaddr_in6 *sin6;
+ if (!__rpc_nconf2sockinfo(nconf, &si))
+ return 0;
+
+ switch (si.si_af)
+ {
+ case AF_INET:
+ sin = nbuf->buf;
+ port = sin->sin_port;
+ break;
+ case AF_INET6:
+ sin6 = nbuf->buf;
+ port = sin6->sin6_port;
+ break;
+ default:
+ break;
+ }
+
+ return htons (port);
+}
+#endif
+
static char *getNISserver(pam_handle_t *pamh, unsigned int ctrl)
{
char *master;
char *domainname;
int port, err;
+#if defined(HAVE_RPCB_GETADDR)
+ struct netconfig *nconf;
+ struct netbuf svcaddr;
+ char addrbuf[INET6_ADDRSTRLEN];
+ void *handle;
+ int found;
+#endif
+
#ifdef HAVE_YP_GET_DEFAULT_DOMAIN
if ((err = yp_get_default_domain(&domainname)) != 0) {
@@ -150,7 +187,41 @@ static char *getNISserver(pam_handle_t *pamh, unsigned int ctrl)
yperr_string(err));
return NULL;
}
+#ifdef HAVE_RPCB_GETADDR
+ svcaddr.len = 0;
+ svcaddr.maxlen = sizeof (addrbuf);
+ svcaddr.buf = addrbuf;
+ port = 0;
+ found = 0;
+
+ handle = setnetconfig();
+ while ((nconf = getnetconfig(handle)) != NULL) {
+ if (!strcmp(nconf->nc_proto, "udp")) {
+ if (rpcb_getaddr(YPPASSWDPROG, YPPASSWDPROC_UPDATE,
+ nconf, &svcaddr, master)) {
+ port = __taddr2port (nconf, &svcaddr);
+ endnetconfig (handle);
+ found=1;
+ break;
+ }
+
+ if (rpc_createerr.cf_stat != RPC_UNKNOWNHOST) {
+ clnt_pcreateerror (master);
+ pam_syslog (pamh, LOG_ERR,
+ "rpcb_getaddr (%s) failed!", master);
+ return NULL;
+ }
+ }
+ }
+
+ if (!found) {
+ pam_syslog (pamh, LOG_ERR,
+ "Cannot find suitable transport for protocol 'udp'");
+ return NULL;
+ }
+#else
port = getrpcport(master, YPPASSWDPROG, YPPASSWDPROC_UPDATE, IPPROTO_UDP);
+#endif
if (port == 0) {
pam_syslog(pamh, LOG_WARNING,
"yppasswdd not running on NIS master host");
--
Thorsten Kukuk, Senior Architect SLES & Common Code Base
SUSE LINUX GmbH, Maxfeldstr. 5, 90409 Nuernberg, Germany
GF: Felix Imendörffer, Jane Smithard, Graham Norton, HRB 21284 (AG Nürnberg)
8 years, 1 month
Patches: remove static support for Linux-PAM
by Thorsten Kukuk
Hi,
I have attached three patches for removal of static linking support.
The first one is the important one, it removes the infrastructure.
The other two remove the defines from the code.
Thorsten
--
Thorsten Kukuk, Senior Architect SLES & Common Code Base
SUSE LINUX GmbH, Maxfeldstr. 5, 90409 Nuernberg, Germany
GF: Felix Imendörffer, Jane Smithard, Graham Norton, HRB 21284 (AG Nürnberg)
8 years, 1 month
pam_access cleanup
by Thorsten Kukuk
Hi,
during the pam_static cleanup, I saw that pam_access.so
includes yp header files and will be linked against libnsl,
but will never use a yp function. If a system has yp_get_default_domain,
it will always have a getdomainname() syscall, too.
I propose to remove that dead code:
diff --git a/modules/pam_access/Makefile.am b/modules/pam_access/Makefile.am
index 0527674..6c0f738 100644
--- a/modules/pam_access/Makefile.am
+++ b/modules/pam_access/Makefile.am
@@ -15,14 +15,14 @@ securelibdir = $(SECUREDIR)
secureconfdir = $(SCONFIGDIR)
AM_CFLAGS = -I$(top_srcdir)/libpam/include -I$(top_srcdir)/libpamc/include \
- -DPAM_ACCESS_CONFIG=\"$(SCONFIGDIR)/access.conf\" $(NIS_CFLAGS)
+ -DPAM_ACCESS_CONFIG=\"$(SCONFIGDIR)/access.conf\"
AM_LDFLAGS = -no-undefined -avoid-version -module
if HAVE_VERSIONING
AM_LDFLAGS += -Wl,--version-script=$(srcdir)/../modules.map
endif
securelib_LTLIBRARIES = pam_access.la
-pam_access_la_LIBADD = $(top_builddir)/libpam/libpam.la $(NIS_LIBS)
+pam_access_la_LIBADD = $(top_builddir)/libpam/libpam.la
secureconf_DATA = access.conf
diff --git a/modules/pam_access/pam_access.c b/modules/pam_access/pam_access.c
index ca73545..3ac1ad0 100644
--- a/modules/pam_access/pam_access.c
+++ b/modules/pam_access/pam_access.c
@@ -44,9 +44,6 @@
#include <arpa/inet.h>
#include <netdb.h>
#include <sys/socket.h>
-#ifdef HAVE_RPCSVC_YPCLNT_H
-#include <rpcsvc/ypclnt.h>
-#endif
#ifdef HAVE_LIBAUDIT
#include <libaudit.h>
#endif
@@ -470,8 +467,6 @@ netgroup_match (pam_handle_t *pamh, const char *netgroup,
{
int retval;
char *mydomain = NULL;
-
-#if defined(HAVE_GETDOMAINNAME)
char domainname_res[256];
if (getdomainname (domainname_res, sizeof (domainname_res)) == 0)
@@ -481,9 +476,6 @@ netgroup_match (pam_handle_t *pamh, const char *netgroup,
mydomain = domainname_res;
}
}
-#elif defined(HAVE_YP_GET_DEFAULT_DOMAIN)
- yp_get_default_domain(&mydomain);
-#endif
#ifdef HAVE_INNETGR
retval = innetgr (netgroup, machine, user, mydomain);
--
Thorsten Kukuk, Senior Architect SLES & Common Code Base
SUSE LINUX GmbH, Maxfeldstr. 5, 90409 Nuernberg, Germany
GF: Felix Imendörffer, Jane Smithard, Graham Norton, HRB 21284 (AG Nürnberg)
8 years, 1 month
linux-pam and static linking?
by Thorsten Kukuk
Hi,
I tried to compile Linux-PAM today with "--enable-static-modules".
It's a nightmare :(
Some problems are easy fixable, but we have a structural problem:
I get a verlong long list of "multiple definition of" errors.
Every module compiled static provides the same function names:
pam_sm_open_session, pam_sm_close_session, etc.
Looks like current toolchain does not like this.
The question now is: should we really try to fix that,
or should we remove the --enable-static-modules option
and the code for this?
I would vote for removal, I don't see any sense in this option
anymore. Beside, that I doubt that it will really work, if it
does not even compile ...
Thorsten
--
Thorsten Kukuk, Senior Architect SLES & Common Code Base
SUSE LINUX GmbH, Maxfeldstr. 5, 90409 Nuernberg, Germany
GF: Felix Imendörffer, Jane Smithard, Graham Norton, HRB 21284 (AG Nürnberg)
8 years, 1 month
localtime() might return NULL
by Tomas Mraz
On platforms with 64 bit time_t localtime() might return NULL if the
time passed to it is bogus. The following patch adds proper checking
for that. I did not patch occurrences where localtime() is called on
time obtained from time() call. OK to commit?
diff --git a/modules/pam_lastlog/pam_lastlog.c b/modules/pam_lastlog/pam_lastlog.c
index 50d33e4..76a33e4 100644
--- a/modules/pam_lastlog/pam_lastlog.c
+++ b/modules/pam_lastlog/pam_lastlog.c
@@ -276,12 +276,12 @@ last_login_read(pam_handle_t *pamh, int announce, int last_fd, uid_t uid, time_t
time_t ll_time;
ll_time = last_login.ll_time;
- tm = localtime_r (&ll_time, &tm_buf);
- strftime (the_time, sizeof (the_time),
- /* TRANSLATORS: "strftime options for date of last login" */
- _(" %a %b %e %H:%M:%S %Z %Y"), tm);
-
- date = the_time;
+ if ((tm = localtime_r (&ll_time, &tm_buf)) != NULL) {
+ strftime (the_time, sizeof (the_time),
+ /* TRANSLATORS: "strftime options for date of last login" */
+ _(" %a %b %e %H:%M:%S %Z %Y"), tm);
+ date = the_time;
+ }
}
/* we want & have the host? */
diff --git a/modules/pam_tally2/pam_tally2.c b/modules/pam_tally2/pam_tally2.c
index e513f64..9187cbf 100644
--- a/modules/pam_tally2/pam_tally2.c
+++ b/modules/pam_tally2/pam_tally2.c
@@ -924,7 +924,7 @@ static void
print_one(const struct tallylog *tally, uid_t uid)
{
static int once;
- char *cp;
+ char *cp = "[UNKNOWN]";
time_t fail_time;
struct tm *tm;
struct passwd *pwent;
@@ -933,9 +933,10 @@ print_one(const struct tallylog *tally, uid_t uid)
pwent = getpwuid(uid);
fail_time = tally->fail_time;
- tm = localtime(&fail_time);
- strftime (ptime, sizeof (ptime), "%D %H:%M:%S", tm);
- cp = ptime;
+ if ((tm = localtime(&fail_time)) != NULL) {
+ strftime (ptime, sizeof (ptime), "%D %H:%M:%S", tm);
+ cp = ptime;
+ }
if (pwent) {
username = pwent->pw_name;
}
--
Tomas Mraz
No matter how far down the wrong road you've gone, turn back.
Turkish proverb
(You'll never know whether the road is wrong though.)
8 years, 1 month
Cleanup of warnings in pam_unix
by Tomas Mraz
There are two warning when compiling pam_unix with -Wall on current
gcc. The following patch fixes them and corrects a minor bug. It also
removes useless macro in support.c.
diff --git a/modules/pam_unix/passverify.c b/modules/pam_unix/passverify.c
index 078adc6..5d6a148 100644
--- a/modules/pam_unix/passverify.c
+++ b/modules/pam_unix/passverify.c
@@ -31,7 +31,7 @@
#ifdef WITH_SELINUX
#include <selinux/selinux.h>
-#define SELINUX_ENABLED is_selinux_enabled()>0
+#define SELINUX_ENABLED (is_selinux_enabled()>0)
#else
#define SELINUX_ENABLED 0
#endif
@@ -958,7 +958,7 @@ PAMH_ARG_DECL(int unix_update_shadow,
fclose(opwfile);
if (!wroteentry && !err) {
- spwdent.sp_namp = forwho;
+ spwdent.sp_namp = (char *)forwho;
spwdent.sp_pwdp = towhat;
spwdent.sp_lstchg = time(NULL) / (60 * 60 * 24);
if (spwdent.sp_lstchg == 0)
diff --git a/modules/pam_unix/support.c b/modules/pam_unix/support.c
index abccd82..0fd1dba 100644
--- a/modules/pam_unix/support.c
+++ b/modules/pam_unix/support.c
@@ -30,12 +30,6 @@
#include "support.h"
#include "passverify.h"
-#ifdef WITH_SELINUX
-#include <selinux/selinux.h>
-#define SELINUX_ENABLED is_selinux_enabled()>0
-#else
-#define SELINUX_ENABLED 0
-#endif
static char *
search_key (const char *key, const char *filename)
--
Tomas Mraz
No matter how far down the wrong road you've gone, turn back.
Turkish proverb
(You'll never know whether the road is wrong though.)
8 years, 1 month