[SSSD] should not return "x" for password when there is no shadow information
Simo Sorce
ssorce at redhat.com
Mon Nov 9 13:59:52 UTC 2009
On Mon, 2009-11-09 at 08:21 -0500, Brian J. Murrell wrote:
> On Mon, 2009-11-09 at 08:05 -0500, Stephen Gallagher wrote:
> >
> > Sorry Brian, we discussed this off-list in #freeipa the other day.
> > Transcript included here for posterity.
>
> OK...
>
> > ======================================================================
> > 07:51:45 AM) sgallagh: sbose: Unrelated: Do you have any comments to add
> > on the shadow "x" vs. "*" discussion on sssd-devel? I think Brian and I
> > are talking in circles :-/
> > (08:29:07 AM) sbose: sgallagh: concerning '*' vs 'x', I found " } else
> > if (!p || *hash == '*' || *hash == '!') { retval = PAM_AUTH_ERR;" in the
> > pam_unix source code. So I think pam_unix will always fail with '*', al
> > least on Linux.
>
> OK. But that's for "authentication" which is orthogonal to the issue of
> "x" leading to pam_unix wanting to see a shadow entry. Indeed, I would
> expect a password of "*" to fail an authentication check, against the
> passwd database (which we ignore of course, when using kerberos.
>
> > (08:38:43 AM) sbose: simo: yes this was authentication, pam_sm_acct_mgmt
> > only checks for "*NP*", indicating NIS+, and 'x' or two or more '#',
> > indicating shadow, everything else lead to PAM_SUCESS
>
> Ahhh. So, it seems that sbose concurs that "x" in the password field
> does mean there should be a shadow entry available.
>
> > (09:01:00 AM) simo: sbose, ah ok so 'x' is indeed a bad idea ?
> > (09:01:29 AM) ***simo tempted to make what we return configurable ...
> > (09:02:26 AM) sbose: simo: I think this would be a good idea, because
> > how knows how HP-UX handles this.
>
> OK. So the thought is to make sssd configurable in what it returns in
> the password field of the passwd file?
If someone opens a bug for that, yes :-)
However keep in mind that I don't care much for what pam_unix does in
any pam target, you can always make it so that an error from pam_unix
(using sufficient instead of required) is ignored if pam_sss succeed.
Simo.
--
Simo Sorce * Red Hat, Inc * New York
More information about the sssd-devel
mailing list