[Pam-developers] pam_unix and login.defs
Dmitry V. Levin
ldv at altlinux.org
Wed Feb 6 03:45:43 UTC 2013
On Tue, Feb 05, 2013 at 02:00:01PM +0100, Thorsten Kukuk wrote:
[...]
> @@ -81,10 +153,27 @@ int _set_ctrl(pam_handle_t *pamh, int flags, int *remember, int *rounds,
> D(("SILENT"));
> set(UNIX__QUIET, ctrl);
> }
> +
> + /* preset encryption method with value from /etc/login.defs */
> + val = search_key (LOGIN_DEFS);
> + if (val) {
> + for (j = 0; j < UNIX_CTRLS_; ++j) {
> + if (unix_args[j].token
> + && !strncasecmp(val, unix_args[j].token, strlen(unix_args[j].token))) {
> + break;
> + }
> + }
> + if (j >= UNIX_CTRLS_) {
> + pam_syslog(pamh, LOG_WARNING, "unrecognized ENCRYPTION_METHOD value [%s]", val);
> + } else {
> + ctrl &= unix_args[j].mask; /* for turning things off */
> + ctrl |= unix_args[j].flag; /* for turning things on */
> + }
> + }
> +
If I'm not mistaken, this code would allow such odd configurations as
ENCRYPT_METHOD=use_first_pass which is probably not what one could expect
from this feature.
--
ldv
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 198 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/pam-developers/attachments/20130206/1eb742de/attachment.sig>
More information about the Pam-developers
mailing list