[PATCH] Add better checks on PAM socket
by Sumit Bose
Hi,
this patch adds a check the public PAM socket it a socket that belongs
to root for all plattforms and uses a SCM_CREDENTIALS ancillary
message to identify the uid/gid/pid of the peer if these messages are
available.
bye,
Sumit
13 years, 2 months
PATCH] Password changes and getuid() == 0 checks
by Ralf Haferkamp
Hi,
I did some testing of pam_sss and the LDAP backend's password policy
features and ran into some issue. One of the being the getuid() == 0
checks in pam_sss when checking whether the user needs to be prompted for
the old password before changing the password.
I guess the idention of those checks is that "root" should be able to
change a users password without being prompted for the old password.
There are however some issues with that:
- Most PAM clients run with a real uid of root(0), so that check will not
work correctly in many cases. A notable exception being the passwd
command. But with password policies in place password changes can be
triggered from almost every PAM client.
- When using the LDAP backend even root would need to somehow
authenticate against the LDAP Server to be able to change a users
password.
Find a patch attached that tries to fix the former issue by checking for
the PWEXP_FLAG that is set when pam_sm_authenticate returned
PAM_NEW_AUTHTOK_REQD. I am not sure if this is really the best fix for
the problem. I am open for suggestions.
I haven't started looking for a solution for the latter issue yet.
--
regards,
Ralf
13 years, 2 months
[PATCH] Various fixes/improvment to ldap ppolicy handling
by Ralf Haferkamp
Hi,
here are some more patches regarding the handling of the LDAP ppolicy
control.
Patch1: An error code of LDAP_INVALID_CREDENTIALS + a ppolicy control
with the error PP_passwordExpired indicates an expire password
as well.
Patch2: When doing LDAP authentiation for PAM_PRELIM_CHECK, treat
SDAP_AUTH_PW_EXPIRED as a successful authentication to be able to
continue the the password change
Patch3: Display a messages to the user when a password change is going to
be initiated because of an expired password.
feedback is of course welcome,
Ralf
13 years, 2 months
[PATCH] Remove unused M4 code
by Jakub Hrozek
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
I could swear I removed this dead code some time ago. Apparently it
keeps coming back :-)
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAkuanPIACgkQHsardTLnvCUFfQCdFCNpuaxtaMm0OAqYnYOabx+L
ZAkAn2f0ZipJ2cvs6hz241DdhgvCWajv
=MQQ2
-----END PGP SIGNATURE-----
13 years, 2 months
[PATCH] Unbreak the build when check-devel is not installed or of sufficient version
by Stephen Gallagher
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
I discovered when trying to build RPMs on EPEL5 (which does not have a
compatible version of check) that the build failed trying to link the
common.c test utilities.
- --
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAkuXwF4ACgkQeiVVYja6o6NCUgCdGbpsKZEDI0emBFgOhS3yqg+Z
Vz4AoKnyHL9/BhzvlfByotjJDBcYn/YO
=oWLF
-----END PGP SIGNATURE-----
13 years, 2 months