[SSSD] [PATCH] PAM: Remove authtok from PAM stack with OTP

Jakub Hrozek jhrozek at redhat.com
Tue Oct 21 18:06:06 UTC 2014


On Tue, Oct 21, 2014 at 01:29:53PM -0400, Nathaniel McCallum wrote:
> On Tue, 2014-10-21 at 00:44 +0200, Lukas Slebodnik wrote:
> > ehlo,
> > 
> > We remove the password from the PAM stack when OTP is used to make sure
> > that other pam modules (pam-gnome-keyring, pam_mount) cannot use it anymore
> > and have to request a password on their own.
> > 
> > Resolves: https://fedorahosted.org/sssd/ticket/2287
> > 
> > Simple patch is attached.
> 
> I may be wrong, but I think that making the pam_add_response() and
> pam_set_item() errors non-fatal is incorrect. Attempting to use the OTP
> credentials again could result in further errors, keyring problems or
> account locking. It seems to me that it would better to fail the
> authentication if you cannot guarantee that OTP credentials will not be
> reused.

On the other hand, logging in as the user in question (and then letting
him to sudo) might be the only way of getting access into the system at
all..



More information about the sssd-devel mailing list