[SSSD] PATCH] Password changes and getuid() == 0 checks

Ralf Haferkamp rhafer at suse.de
Fri Mar 12 15:37:26 UTC 2010


Hi,

I did some testing of pam_sss and the LDAP backend's password policy 
features and ran into some issue. One of the being the getuid() == 0 
checks in pam_sss when checking whether the user needs to be prompted for 
the old password before changing the password.

I guess the idention of those checks is that "root" should be able to 
change a users password without being prompted for the old password. 
There are however some issues with that:

- Most PAM clients run with a real uid of root(0), so that check will not
  work correctly in many cases. A notable exception being the passwd
  command. But with password policies in place password  changes can be
  triggered from almost every PAM client.

- When using the LDAP backend even root would need to somehow 
  authenticate against the LDAP Server to be able to change a users
  password.

Find a patch attached that tries to fix the former issue by checking for 
the PWEXP_FLAG that is set when pam_sm_authenticate returned 
PAM_NEW_AUTHTOK_REQD. I am not sure if this is really the best fix for 
the problem. I am open for suggestions.

I haven't started looking for a solution for the latter issue yet.

-- 
regards,
	Ralf
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-Prompt-for-old-password-even-when-running-as-root.patch
Type: text/x-patch
Size: 1345 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20100312/83a23705/attachment.bin>


More information about the sssd-devel mailing list