On Wed, Feb 11, 2015 at 04:56:48PM +0100, Pavel Reichl wrote:
Hello,
please see attached patch. I'm not sure whether using pam_strerror() is the
right thing to do. It might be better to use our own string?
I'm also not sure about using _(STRING) macro on the output of
pam_strerror().
The _() macro will not work here. You can use it only to enclose literal
strings. The strings will then be extracted into the *.pot file and
translators can pick them for translation. In the pam_strerror() case
libpam has to take care of the translations.
I attached output of sequence of commands to show differences.
1) This is output without patch being applied.
$ su john
Password:
su: User account has expired
ssh -l john `hostname`
Connection closed by 192.168.122.166
#not matching key
$ ssh -l john `hostname` -i /tmp/local
john(a)dev.local.test's password:
Connection closed by 192.168.122.166
2) This is output when patch is applied. Please note the duplicity when
using su.
The service name is available, so you can add this only if ssh is used.
$ su john
Password:
User account has expired
su: User account has expired
$ ssh -l john `hostname`
User account has expired
Connection closed by 192.168.122.166
#not matching key
$ ssh -l john `hostname` -i /tmp/local
john(a)dev.local.test's password:
User account has expired
Connection closed by 192.168.122.166
Thanks for comments.
From 953f1721996e6c2bf8ee53ea232de2240f168d94 Mon Sep 17 00:00:00
2001
From: Pavel Reichl <preichl(a)redhat.com>
Date: Wed, 11 Feb 2015 19:38:16 -0500
Subject: [PATCH] PAM: do not reject abruptly
If account has expired use pam_conversation to pass message.
Resolves:
https://fedorahosted.org/sssd/ticket/2050
---
src/sss_client/pam_sss.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/src/sss_client/pam_sss.c b/src/sss_client/pam_sss.c
index fdf6c9e6da75c9f7eaa7c00d9a5792fbdd97eabc..767b2a839e9f001be52c5ff4c7651b0f06ba4221
100644
--- a/src/sss_client/pam_sss.c
+++ b/src/sss_client/pam_sss.c
@@ -1585,6 +1585,13 @@ static int pam_sss(enum sss_cli_command task, pam_handle_t *pamh,
D(("do_pam_conversation failed."));
}
pam_status = PAM_NEW_AUTHTOK_REQD;
+ } else if (pam_status == PAM_ACCT_EXPIRED) {
+ ret = do_pam_conversation(pamh, PAM_TEXT_INFO,
+ _(pam_strerror(pamh, pam_status)),
+ NULL, NULL);
+ if (ret != PAM_SUCCESS) {
+ D(("do_pam_conversation failed."));
+ }
I would recommend to not do this in pam_sss directly but send a
SSS_PAM_USER_INFO response back to pam_sss. This response can e.g. be
generated in the pam responder if pam_status == PAM_ACCT_EXPIRED and the
service is sshd. Doing it in the pam responder has the advantage that
you do not have to duplicate code in the backends. Additionally it is
more easy configure the behavior. E.g. you can check pam_verbosity and
only add this message is the level is 2 (1?) or higher.
bye,
Sumit
}
break;
case SSS_PAM_CHAUTHTOK:
--
2.1.0
_______________________________________________
sssd-devel mailing list
sssd-devel(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel