[SSSD] PATCH] Password changes and getuid() == 0 checks
Sumit Bose
sbose at redhat.com
Mon Mar 15 12:01:23 UTC 2010
On Fri, Mar 12, 2010 at 04:37:26PM +0100, Ralf Haferkamp wrote:
> Hi,
>
> I did some testing of pam_sss and the LDAP backend's password policy
> features and ran into some issue. One of the being the getuid() == 0
> checks in pam_sss when checking whether the user needs to be prompted for
> the old password before changing the password.
>
> I guess the idention of those checks is that "root" should be able to
> change a users password without being prompted for the old password.
> There are however some issues with that:
>
> - Most PAM clients run with a real uid of root(0), so that check will not
> work correctly in many cases. A notable exception being the passwd
> command. But with password policies in place password changes can be
> triggered from almost every PAM client.
>
> - When using the LDAP backend even root would need to somehow
> authenticate against the LDAP Server to be able to change a users
> password.
>
> Find a patch attached that tries to fix the former issue by checking for
> the PWEXP_FLAG that is set when pam_sm_authenticate returned
> PAM_NEW_AUTHTOK_REQD. I am not sure if this is really the best fix for
> the problem. I am open for suggestions.
>
> I haven't started looking for a solution for the latter issue yet.
>
> --
> regards,
> Ralf
ACK
bye,
Sumit
More information about the sssd-devel
mailing list