Am Freitag 12 März 2010 17:58:48 schrieb Sumit Bose:
On Fri, Mar 12, 2010 at 04:37:26PM +0100, Ralf Haferkamp wrote:
> Hi,
>
> I did some testing of pam_sss and the LDAP backend's password policy
> features and ran into some issue. One of the being the getuid() == 0
> checks in pam_sss when checking whether the user needs to be
> prompted for the old password before changing the password.
>
> I guess the idention of those checks is that "root" should be able
> to change a users password without being prompted for the old
> password. There are however some issues with that:
>
> - Most PAM clients run with a real uid of root(0), so that check
> will not
>
> work correctly in many cases. A notable exception being the passwd
> command. But with password policies in place password changes can
> be triggered from almost every PAM client.
>
> - When using the LDAP backend even root would need to somehow
>
> authenticate against the LDAP Server to be able to change a users
> password.
I'm not sure if we want to support the password resets by root at all
with the LDAP backend. Typically there are a couple of different ways
for an authorized user to change the password of a different user in
an LDAP server. The same holds for a Kerberos server.
Do you have use cases which can illustrate why it would make sense to
support it in sssd?
Because it "just worked" in the past :). (Which is of
course not entirely
true when pam_ldap was used. It has some issues in that area as well).
IMO it would be enough to display a proper error message when root tries
to change the password of an LDAP user. (But AFAICS this would require
some bigger changes. The LDAP backend does currently have no information
who is trying to change which password, if I didn't overlook something)
But at least we should send a message to the user that the password
reset is not possible and maybe a configurable hint how to do it like
pam_password_prohibit_message.
bye,
Sumit
[..]
--
Ralf