On Wed, Feb 06, 2013 at 07:45:43AM +0400, Dmitry V. Levin wrote:
On Tue, Feb 05, 2013 at 02:00:01PM +0100, Thorsten Kukuk wrote:
[...]
> @@ -81,10 +153,27 @@ int _set_ctrl(pam_handle_t *pamh, int flags, int *remember, int
*rounds,
> D(("SILENT"));
> set(UNIX__QUIET, ctrl);
> }
> +
> + /* preset encryption method with value from /etc/login.defs */
> + val = search_key (LOGIN_DEFS);
> + if (val) {
> + for (j = 0; j < UNIX_CTRLS_; ++j) {
> + if (unix_args[j].token
> + && !strncasecmp(val, unix_args[j].token, strlen(unix_args[j].token))) {
> + break;
> + }
> + }
> + if (j >= UNIX_CTRLS_) {
> + pam_syslog(pamh, LOG_WARNING, "unrecognized ENCRYPTION_METHOD value
[%s]", val);
> + } else {
> + ctrl &= unix_args[j].mask; /* for turning things off */
> + ctrl |= unix_args[j].flag; /* for turning things on */
> + }
> + }
> +
If I'm not mistaken, this code would allow such odd configurations as
ENCRYPT_METHOD=use_first_pass which is probably not what one could expect
from this feature.
Besides that it allows invalid configurations, it still doesn't support
some valid ones, e.g. encryption related rounds= option would be silently
ignored, and ENCRYPT_METHOD with such semantics wouldn't allow one to
specify both password hashing method and its crucial option.
Is it possible to introduce a /etc/login.defs parameter with more
consistent semantics than this one?
--
ldv