[SSSD] PATCH] Password changes and getuid() == 0 checks

Stephen Gallagher sgallagh at redhat.com
Mon Mar 15 12:16:41 UTC 2010


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 03/15/2010 08:01 AM, Sumit Bose wrote:
> On Fri, Mar 12, 2010 at 04:37:26PM +0100, Ralf Haferkamp wrote:
>> Hi,
>>
>> I did some testing of pam_sss and the LDAP backend's password policy 
>> features and ran into some issue. One of the being the getuid() == 0 
>> checks in pam_sss when checking whether the user needs to be prompted for 
>> the old password before changing the password.
>>
>> I guess the idention of those checks is that "root" should be able to 
>> change a users password without being prompted for the old password. 
>> There are however some issues with that:
>>
>> - Most PAM clients run with a real uid of root(0), so that check will not
>>   work correctly in many cases. A notable exception being the passwd
>>   command. But with password policies in place password  changes can be
>>   triggered from almost every PAM client.
>>
>> - When using the LDAP backend even root would need to somehow 
>>   authenticate against the LDAP Server to be able to change a users
>>   password.
>>
>> Find a patch attached that tries to fix the former issue by checking for 
>> the PWEXP_FLAG that is set when pam_sm_authenticate returned 
>> PAM_NEW_AUTHTOK_REQD. I am not sure if this is really the best fix for 
>> the problem. I am open for suggestions.
>>
>> I haven't started looking for a solution for the latter issue yet.
>>
>> -- 
>> regards,
>> 	Ralf
> 
> ACK
> 
> bye,
> Sumit


Pushed to master and 1-1-0

- -- 
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAkueJSkACgkQeiVVYja6o6NDcACfb//wYwFu/rhTtTB1gckGDJ1C
eyYAnjoHL+4x1HOGBvRoQ2c8VqtKZI1A
=xh91
-----END PGP SIGNATURE-----



More information about the sssd-devel mailing list