[Pam-developers] pam_unix and login.defs

Dmitry V. Levin ldv at altlinux.org
Wed Feb 6 14:57:44 UTC 2013


On Wed, Feb 06, 2013 at 07:45:43AM +0400, Dmitry V. Levin wrote:
> On Tue, Feb 05, 2013 at 02:00:01PM +0100, Thorsten Kukuk wrote:
> [...]
> > @@ -81,10 +153,27 @@ int _set_ctrl(pam_handle_t *pamh, int flags, int *remember, int *rounds,
> >  		D(("SILENT"));
> >  		set(UNIX__QUIET, ctrl);
> >  	}
> > +
> > +	/* preset encryption method with value from /etc/login.defs */
> > +	val = search_key (LOGIN_DEFS);
> > +	if (val) {
> > +	  for (j = 0; j < UNIX_CTRLS_; ++j) {
> > +	    if (unix_args[j].token
> > +		&& !strncasecmp(val, unix_args[j].token, strlen(unix_args[j].token))) {
> > +	      break;
> > +	    }
> > +	  }
> > +	  if (j >= UNIX_CTRLS_) {
> > +	    pam_syslog(pamh, LOG_WARNING, "unrecognized ENCRYPTION_METHOD value [%s]", val);
> > +	  } else {
> > +	    ctrl &= unix_args[j].mask;	/* for turning things off */
> > +	    ctrl |= unix_args[j].flag;	/* for turning things on  */
> > +	  }
> > +	}
> > +
> 
> If I'm not mistaken, this code would allow such odd configurations as
> ENCRYPT_METHOD=use_first_pass which is probably not what one could expect
> from this feature.

Besides that it allows invalid configurations, it still doesn't support
some valid ones, e.g. encryption related rounds= option would be silently
ignored, and ENCRYPT_METHOD with such semantics wouldn't allow one to
specify both password hashing method and its crucial option.
Is it possible to introduce a /etc/login.defs parameter with more
consistent semantics than this one?


-- 
ldv
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 198 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/pam-developers/attachments/20130206/dd975da0/attachment.sig>


More information about the Pam-developers mailing list