[SSSD] [PATCH] PAM: Remove authtok from PAM stack with OTP

Lukas Slebodnik lslebodn at redhat.com
Tue Oct 21 18:34:55 UTC 2014


On (21/10/14 20:06), Jakub Hrozek wrote:
>On Tue, Oct 21, 2014 at 01:29:53PM -0400, Nathaniel McCallum wrote:
>> On Tue, 2014-10-21 at 00:44 +0200, Lukas Slebodnik wrote:
>> > ehlo,
>> > 
>> > We remove the password from the PAM stack when OTP is used to make sure
>> > that other pam modules (pam-gnome-keyring, pam_mount) cannot use it anymore
>> > and have to request a password on their own.
>> > 
>> > Resolves: https://fedorahosted.org/sssd/ticket/2287
>> > 
>> > Simple patch is attached.
>> 
>> I may be wrong, but I think that making the pam_add_response() and
>> pam_set_item() errors non-fatal is incorrect. Attempting to use the OTP
>> credentials again could result in further errors, keyring problems or
>> account locking. It seems to me that it would better to fail the
>> authentication if you cannot guarantee that OTP credentials will not be
>> reused.
>
>On the other hand, logging in as the user in question (and then letting
>him to sudo) might be the only way of getting access into the system at
>all..
Should I change it or no?

It would be very simple change :-)

LS



More information about the sssd-devel mailing list