[SSSD] PATCH] Password changes and getuid() == 0 checks

Ralf Haferkamp rhafer at suse.de
Fri Mar 12 19:28:11 UTC 2010


Am Freitag 12 März 2010 17:58:48 schrieb Sumit Bose:
> On Fri, Mar 12, 2010 at 04:37:26PM +0100, Ralf Haferkamp wrote:
> > Hi,
> > 
> > I did some testing of pam_sss and the LDAP backend's password policy
> > features and ran into some issue. One of the being the getuid() == 0
> > checks in pam_sss when checking whether the user needs to be
> > prompted for the old password before changing the password.
> > 
> > I guess the idention of those checks is that "root" should be able
> > to change a users password without being prompted for the old
> > password. There are however some issues with that:
> > 
> > - Most PAM clients run with a real uid of root(0), so that check
> > will not
> > 
> >   work correctly in many cases. A notable exception being the passwd
> >   command. But with password policies in place password  changes can
> >   be triggered from almost every PAM client.
> > 
> > - When using the LDAP backend even root would need to somehow
> > 
> >   authenticate against the LDAP Server to be able to change a users
> >   password.
> 
> I'm not sure if we want to support the password resets by root at all
> with the LDAP backend. Typically there are a couple of different ways
> for an authorized user to change the password of a different user in
> an LDAP server. The same holds for a Kerberos server.
> 
> Do you have use cases which can illustrate why it would make sense to
> support it in sssd?
Because it "just worked" in the past :). (Which is of course not entirely 
true when pam_ldap was used. It has some issues in that area as well). 
IMO it would be enough to display a proper error message when root tries 
to change the password of an LDAP user. (But AFAICS this would require 
some bigger changes. The LDAP backend does currently have no information 
who is trying to change which password, if I didn't overlook something)

> But at least we should send a message to the user that the password
> reset is not possible and maybe a configurable hint how to do it like
> pam_password_prohibit_message.
> 
> bye,
> Sumit
[..]
-- 
Ralf



More information about the sssd-devel mailing list