[Pam-developers] pam_unix and login.defs

Dmitry V. Levin ldv at altlinux.org
Wed Feb 6 03:45:43 UTC 2013


On Tue, Feb 05, 2013 at 02:00:01PM +0100, Thorsten Kukuk wrote:
[...]
> @@ -81,10 +153,27 @@ int _set_ctrl(pam_handle_t *pamh, int flags, int *remember, int *rounds,
>  		D(("SILENT"));
>  		set(UNIX__QUIET, ctrl);
>  	}
> +
> +	/* preset encryption method with value from /etc/login.defs */
> +	val = search_key (LOGIN_DEFS);
> +	if (val) {
> +	  for (j = 0; j < UNIX_CTRLS_; ++j) {
> +	    if (unix_args[j].token
> +		&& !strncasecmp(val, unix_args[j].token, strlen(unix_args[j].token))) {
> +	      break;
> +	    }
> +	  }
> +	  if (j >= UNIX_CTRLS_) {
> +	    pam_syslog(pamh, LOG_WARNING, "unrecognized ENCRYPTION_METHOD value [%s]", val);
> +	  } else {
> +	    ctrl &= unix_args[j].mask;	/* for turning things off */
> +	    ctrl |= unix_args[j].flag;	/* for turning things on  */
> +	  }
> +	}
> +

If I'm not mistaken, this code would allow such odd configurations as
ENCRYPT_METHOD=use_first_pass which is probably not what one could expect
from this feature.


-- 
ldv
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 198 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/pam-developers/attachments/20130206/1eb742de/attachment.sig>


More information about the Pam-developers mailing list