[SSSD] [PATCH] Improve logging of pam_sss

Sumit Bose sbose at redhat.com
Mon Jan 25 16:44:21 UTC 2010


Hi,

this patch makes the logging of pam_sss a bit clearer and less verbose.

This should fix bz556534.

This patch might affect testing, because some log messages are changed.

bye,
Sumit
-------------- next part --------------
From 930f20f773ef401bda0dae72bd202b3c5b0051f6 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Mon, 25 Jan 2010 15:18:45 +0100
Subject: [PATCH] Improve logging of pam_sss

To avoid unnecessary messages in the log files of the system we only
send log messages for PAM modules type which are explicitly handled by
sssd. Furthermore only the authentication modules sends a log message
when the operation was successful. All other modules only sends a
message if an error occurs.

This patch should fix bz556534.
---
 sss_client/pam_sss.c |   55 +++++++++++++++++++++++++++++++++++++++++--------
 1 files changed, 46 insertions(+), 9 deletions(-)

diff --git a/sss_client/pam_sss.c b/sss_client/pam_sss.c
index 8e31cc6..2b11e26 100644
--- a/sss_client/pam_sss.c
+++ b/sss_client/pam_sss.c
@@ -581,15 +581,52 @@ static int send_and_receive(pam_handle_t *pamh, struct pam_items *pi,
         pam_status = ret;
         goto done;
     }
-    logger(pamh, (pam_status == PAM_SUCCESS ? LOG_INFO : LOG_NOTICE),
-           "authentication %s; logname=%s uid=%d euid=%d tty=%s ruser=%s "
-           "rhost=%s user=%s",
-           pam_status == PAM_SUCCESS ? "success" : "failure",
-           pi->login_name, getuid(), geteuid(), pi->pam_tty, pi->pam_ruser,
-           pi->pam_rhost, pi->pam_user);
-    if (pam_status != PAM_SUCCESS) {
-           logger(pamh, LOG_NOTICE, "received for user %s: %d (%s)",
-                  pi->pam_user, pam_status, pam_strerror(pamh,pam_status));
+
+    switch (task) {
+        case SSS_PAM_AUTHENTICATE:
+            logger(pamh, (pam_status == PAM_SUCCESS ? LOG_INFO : LOG_NOTICE),
+                   "authentication %s; logname=%s uid=%lu euid=%d tty=%s "
+                   "ruser=%s rhost=%s user=%s",
+                   pam_status == PAM_SUCCESS ? "success" : "failure",
+                   pi->login_name, getuid(), (unsigned long) geteuid(),
+                   pi->pam_tty, pi->pam_ruser, pi->pam_rhost, pi->pam_user);
+            if (pam_status != PAM_SUCCESS) {
+                   logger(pamh, LOG_NOTICE, "received for user %s: %d (%s)",
+                          pi->pam_user, pam_status,
+                          pam_strerror(pamh,pam_status));
+            }
+            break;
+        case SSS_PAM_CHAUTHTOK_PRELIM:
+            if (pam_status != PAM_SUCCESS) {
+                   logger(pamh, LOG_NOTICE,
+                          "Authentication failed for user %s: %d (%s)",
+                          pi->pam_user, pam_status,
+                          pam_strerror(pamh,pam_status));
+            }
+            break;
+        case SSS_PAM_CHAUTHTOK:
+            if (pam_status != PAM_SUCCESS) {
+                   logger(pamh, LOG_NOTICE,
+                          "Password change failed for user %s: %d (%s)",
+                          pi->pam_user, pam_status,
+                          pam_strerror(pamh,pam_status));
+            }
+            break;
+        case SSS_PAM_ACCT_MGMT:
+            if (pam_status != PAM_SUCCESS) {
+                   logger(pamh, LOG_NOTICE,
+                          "Access denied for user %s: %d (%s)",
+                          pi->pam_user, pam_status,
+                          pam_strerror(pamh,pam_status));
+            }
+            break;
+        case SSS_PAM_SETCRED:
+        case SSS_PAM_OPEN_SESSION:
+        case SSS_PAM_CLOSE_SESSION:
+            break;
+        default:
+            D(("Illegal task [%d]", task));
+            return PAM_SYSTEM_ERR;
     }
 
 done:
-- 
1.6.6



More information about the sssd-devel mailing list