[linux-pam] #61: pam_ftp 'users=' can only accept one user account
by fedora-badges
#61: pam_ftp 'users=' can only accept one user account
----------------------+------------------------------
Reporter: purecfs | Owner: pam-developers@…
Type: defect | Status: new
Priority: major | Component: modules
Version: | Keywords: pam_ftp
Blocked By: | Blocking:
----------------------+------------------------------
While the documentation says that for the pam_ftp module, multiple
"anonymous" users can be defined separated by a comma. However, in
practice this fails because PAM_USER is changed from the username to the
user name list specified causing subsequent modules to fail (like
pam_unix).
Here's a fix:
{{{
--- Linux-PAM-1.3.0-orig/modules/pam_ftp/pam_ftp.c 2016-05-24
14:33:39.000000000 -0700
+++ Linux-PAM-1.3.0/modules/pam_ftp/pam_ftp.c 2016-05-24
14:33:56.000000000 -0700
@@ -86,7 +86,6 @@
while (list_copy && (l = strtok_r(x, ",", &sptr))) {
x = NULL;
if (!strcmp(name, l)) {
- *_user = list;
anon = 1;
}
}
}}}
--
Ticket URL: <https://fedorahosted.org/linux-pam/ticket/61>
linux-pam <http://fedorahosted.org/linux-pam>
The Linux-PAM (Pluggable Authentication Modules) project
7 years, 6 months
Re: [linux-pam] #61: pam_ftp 'users=' can only accept one user account
by Tomas Mraz
On St, 2016-05-25 at 13:02 -0700, Charles Stephens wrote:
> Your patch doesn't actually fix the problem. It still sets PAM_USER
> as the value of users= . lookup() merely determines if PAM_USER is
> on the list of anonymous users, either specified in the users=
> argument or the default list ("ftp" or "anonymous"). All your patch
> does is create superfluous copies of either the list of specified
> users (which causes the original failure) or one of the pre-canned
> anonymous users. Neither is needed because pam_set_item copies
> strings for you.
>
> A truly complete fix would drop the third argument to lookup() and
> also remove the stanza that calls pam_set_item(pamh, PAM_USER... but
> I was going for the lease risky change.
No, not really. See the manual page of strtok_r() for how it works.
And see the manual page of pam_ftp on what the PAM_USER should be set
to after the pam_ftp processing is done if the user is anonymous.
My patch is correct.
Regards,
--
Tomas Mraz
No matter how far down the wrong road you've gone, turn back.
Turkish proverb
(You'll never know whether the road is wrong though.)
7 years, 11 months
[linux-pam] #60: avoid non-portable == with `test`
by fedora-badges
#60: avoid non-portable == with `test`
---------------------+------------------------------
Reporter: vapier | Owner: pam-developers@…
Type: defect | Status: new
Priority: major | Component: library
Version: | Keywords:
Blocked By: | Blocking:
---------------------+------------------------------
POSIX says `test` only accepts =. some shells (including bash) accept ==,
but we should still stick to = for portability.
--
Ticket URL: <https://fedorahosted.org/linux-pam/ticket/60>
linux-pam <http://fedorahosted.org/linux-pam>
The Linux-PAM (Pluggable Authentication Modules) project
7 years, 11 months