On Fri, 2012-05-25 at 15:46 +0200, Thorsten Kukuk wrote:
On Fri, May 25, Tomas Mraz wrote:
> On Thu, 2012-05-24 at 13:59 +0200, Tomas Mraz wrote:
> > The attached patch changes the semantics of the default (non enforcing
> > for root) behavior of pam_pwhistory more reasonable and aligned with the
> > default behavior of pam_cracklib. It will not enforce error but will
> > print a message in case the root changes password to a duplicate value
> > for himself or for another users. The behavior when the option
> > enforce_for_root is used stays unchanged.
> >
> > OK to commit?
>
> Any comments?
Since the info for root is only informativ and no error, if
it is not enforced for root, we shouldn't use pam_error.
This will only confuse people: getting an error message but
without the knowledge that the passwort has still be changed.
I'll replace pam_error in the non-enforcing path with pam_info.
Otherwise is it OK?
--
Tomas Mraz
No matter how far down the wrong road you've gone, turn back.
Turkish proverb