On Tue, Feb 05, 2013 at 02:00:01PM +0100, Thorsten Kukuk wrote:
[...]
@@ -81,10 +153,27 @@ int _set_ctrl(pam_handle_t *pamh, int flags, int
*remember, int *rounds,
D(("SILENT"));
set(UNIX__QUIET, ctrl);
}
+
+ /* preset encryption method with value from /etc/login.defs */
+ val = search_key (LOGIN_DEFS);
+ if (val) {
+ for (j = 0; j < UNIX_CTRLS_; ++j) {
+ if (unix_args[j].token
+ && !strncasecmp(val, unix_args[j].token, strlen(unix_args[j].token))) {
+ break;
+ }
+ }
+ if (j >= UNIX_CTRLS_) {
+ pam_syslog(pamh, LOG_WARNING, "unrecognized ENCRYPTION_METHOD value
[%s]", val);
+ } else {
+ ctrl &= unix_args[j].mask; /* for turning things off */
+ ctrl |= unix_args[j].flag; /* for turning things on */
+ }
+ }
+
If I'm not mistaken, this code would allow such odd configurations as
ENCRYPT_METHOD=use_first_pass which is probably not what one could expect
from this feature.
--
ldv