On Mon, 2009-11-09 at 08:21 -0500, Brian J. Murrell wrote:
On Mon, 2009-11-09 at 08:05 -0500, Stephen Gallagher wrote:
>
> Sorry Brian, we discussed this off-list in #freeipa the other day.
> Transcript included here for posterity.
OK...
> ======================================================================
> 07:51:45 AM) sgallagh: sbose: Unrelated: Do you have any comments to add
> on the shadow "x" vs. "*" discussion on sssd-devel? I think
Brian and I
> are talking in circles :-/
> (08:29:07 AM) sbose: sgallagh: concerning '*' vs 'x', I found "
} else
> if (!p || *hash == '*' || *hash == '!') { retval =
PAM_AUTH_ERR;" in the
> pam_unix source code. So I think pam_unix will always fail with '*', al
> least on Linux.
OK. But that's for "authentication" which is orthogonal to the issue of
"x" leading to pam_unix wanting to see a shadow entry. Indeed, I would
expect a password of "*" to fail an authentication check, against the
passwd database (which we ignore of course, when using kerberos.
> (08:38:43 AM) sbose: simo: yes this was authentication, pam_sm_acct_mgmt
> only checks for "*NP*", indicating NIS+, and 'x' or two or more
'#',
> indicating shadow, everything else lead to PAM_SUCESS
Ahhh. So, it seems that sbose concurs that "x" in the password field
does mean there should be a shadow entry available.
> (09:01:00 AM) simo: sbose, ah ok so 'x' is indeed a bad idea ?
> (09:01:29 AM) ***simo tempted to make what we return configurable ...
> (09:02:26 AM) sbose: simo: I think this would be a good idea, because
> how knows how HP-UX handles this.
OK. So the thought is to make sssd configurable in what it returns in
the password field of the passwd file?
If someone opens a bug for that, yes :-)
However keep in mind that I don't care much for what pam_unix does in
any pam target, you can always make it so that an error from pam_unix
(using sufficient instead of required) is ignored if pam_sss succeed.
Simo.
--
Simo Sorce * Red Hat, Inc * New York