[Pam-developers] pam_unix and login.defs
Dmitry V. Levin
ldv at altlinux.org
Wed Feb 6 14:57:44 UTC 2013
On Wed, Feb 06, 2013 at 07:45:43AM +0400, Dmitry V. Levin wrote:
> On Tue, Feb 05, 2013 at 02:00:01PM +0100, Thorsten Kukuk wrote:
> [...]
> > @@ -81,10 +153,27 @@ int _set_ctrl(pam_handle_t *pamh, int flags, int *remember, int *rounds,
> > D(("SILENT"));
> > set(UNIX__QUIET, ctrl);
> > }
> > +
> > + /* preset encryption method with value from /etc/login.defs */
> > + val = search_key (LOGIN_DEFS);
> > + if (val) {
> > + for (j = 0; j < UNIX_CTRLS_; ++j) {
> > + if (unix_args[j].token
> > + && !strncasecmp(val, unix_args[j].token, strlen(unix_args[j].token))) {
> > + break;
> > + }
> > + }
> > + if (j >= UNIX_CTRLS_) {
> > + pam_syslog(pamh, LOG_WARNING, "unrecognized ENCRYPTION_METHOD value [%s]", val);
> > + } else {
> > + ctrl &= unix_args[j].mask; /* for turning things off */
> > + ctrl |= unix_args[j].flag; /* for turning things on */
> > + }
> > + }
> > +
>
> If I'm not mistaken, this code would allow such odd configurations as
> ENCRYPT_METHOD=use_first_pass which is probably not what one could expect
> from this feature.
Besides that it allows invalid configurations, it still doesn't support
some valid ones, e.g. encryption related rounds= option would be silently
ignored, and ENCRYPT_METHOD with such semantics wouldn't allow one to
specify both password hashing method and its crucial option.
Is it possible to introduce a /etc/login.defs parameter with more
consistent semantics than this one?
--
ldv
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 198 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/pam-developers/attachments/20130206/dd975da0/attachment.sig>
More information about the Pam-developers
mailing list