[SSSD] [PATCH] PAM: Remove authtok from PAM stack with OTP

Nathaniel McCallum npmccallum at redhat.com
Tue Oct 21 17:29:53 UTC 2014


On Tue, 2014-10-21 at 00:44 +0200, Lukas Slebodnik wrote:
> ehlo,
> 
> We remove the password from the PAM stack when OTP is used to make sure
> that other pam modules (pam-gnome-keyring, pam_mount) cannot use it anymore
> and have to request a password on their own.
> 
> Resolves: https://fedorahosted.org/sssd/ticket/2287
> 
> Simple patch is attached.

I may be wrong, but I think that making the pam_add_response() and
pam_set_item() errors non-fatal is incorrect. Attempting to use the OTP
credentials again could result in further errors, keyring problems or
account locking. It seems to me that it would better to fail the
authentication if you cannot guarantee that OTP credentials will not be
reused.

Nathaniel




More information about the sssd-devel mailing list