summaryrefslogtreecommitdiff
path: root/debian
diff options
context:
space:
mode:
authorSteve Langasek <vorlon@debian.org>2009-02-28 12:42:42 -0800
committerSteve Langasek <steve.langasek@ubuntu.com>2019-01-03 17:28:56 -0800
commit1c72ee899982e22e9c4cb177f66bb80d506f9320 (patch)
tree212de12ade9403e5407c1654a9f21e09ca870782 /debian
parentd534d7165ddc41b5e81400b57dbd2a3efcfba10b (diff)
parentfaeffabdeec78344132789e8a3a80f560e408d74 (diff)
debian/local/pam-auth-update (et al): new interface for managing
/etc/pam.d/common-*, using drop-in config snippets provided by module packages.
Diffstat (limited to 'debian')
-rw-r--r--debian/control3
-rw-r--r--debian/libpam-cracklib.postinst9
-rw-r--r--debian/libpam-cracklib.prerm9
-rw-r--r--debian/libpam-runtime.dirs1
-rw-r--r--debian/libpam-runtime.install2
-rw-r--r--debian/libpam-runtime.lintian5
-rw-r--r--debian/libpam-runtime.manpages1
-rw-r--r--debian/libpam-runtime.postinst20
-rw-r--r--debian/libpam-runtime.postrm3
-rw-r--r--debian/libpam-runtime.prerm9
-rw-r--r--debian/libpam-runtime.templates33
-rw-r--r--debian/local/common-account19
-rw-r--r--debian/local/common-account.md5sums1
-rw-r--r--debian/local/common-auth18
-rw-r--r--debian/local/common-auth.md5sums1
-rw-r--r--debian/local/common-password32
-rw-r--r--debian/local/common-password.md5sums1
-rw-r--r--debian/local/common-session20
-rw-r--r--debian/local/common-session.md5sums1
-rwxr-xr-xdebian/local/pam-auth-update665
-rw-r--r--debian/local/pam-auth-update.8101
-rw-r--r--debian/pam-configs/cracklib9
-rw-r--r--debian/pam-configs/unix23
-rw-r--r--debian/po/POTFILES.in1
-rw-r--r--debian/po/bg.po66
-rw-r--r--debian/po/cs.po66
-rw-r--r--debian/po/de.po66
-rw-r--r--debian/po/es.po66
-rw-r--r--debian/po/eu.po66
-rw-r--r--debian/po/fi.po66
-rw-r--r--debian/po/fr.po66
-rw-r--r--debian/po/gl.po66
-rw-r--r--debian/po/it.po66
-rw-r--r--debian/po/ja.po66
-rw-r--r--debian/po/nl.po66
-rw-r--r--debian/po/pt.po66
-rw-r--r--debian/po/pt_BR.po66
-rw-r--r--debian/po/ro.po66
-rw-r--r--debian/po/ru.po66
-rw-r--r--debian/po/sk.po66
-rw-r--r--debian/po/sv.po66
-rw-r--r--debian/po/templates.pot66
-rw-r--r--debian/po/tr.po66
-rw-r--r--debian/po/vi.po66
-rw-r--r--debian/po/zh_CN.po66
-rwxr-xr-xdebian/rules5
46 files changed, 2351 insertions, 27 deletions
diff --git a/debian/control b/debian/control
index f0a224ed..a9a31f62 100644
--- a/debian/control
+++ b/debian/control
@@ -42,6 +42,7 @@ Package: libpam-runtime
Section: admin
Priority: required
Architecture: all
+Depends: debconf (>= 1.5.19)
Replaces: libpam0g-util, libpam0g-dev
Conflicts: libpam0g-util, libpam0g (<< 0.66-0)
Description: Runtime support for the PAM library
@@ -71,7 +72,7 @@ Package: libpam-cracklib
Priority: optional
Architecture: any
Replaces: libpam0g-cracklib
-Depends: ${shlibs:Depends}, cracklib-runtime, wamerican | wordlist
+Depends: ${shlibs:Depends}, libpam-runtime (>= 1.0.1-6), cracklib-runtime, wamerican | wordlist
Description: PAM module to enable cracklib support
This package includes libpam_cracklib, a PAM module that tests
passwords to make sure they are not too weak during password change.
diff --git a/debian/libpam-cracklib.postinst b/debian/libpam-cracklib.postinst
new file mode 100644
index 00000000..637d38f2
--- /dev/null
+++ b/debian/libpam-cracklib.postinst
@@ -0,0 +1,9 @@
+#!/bin/sh
+
+set -e
+
+if dpkg --compare-versions "$2" lt 1.0.1-5; then
+ pam-auth-update --package
+fi
+
+#DEBHELPER#
diff --git a/debian/libpam-cracklib.prerm b/debian/libpam-cracklib.prerm
new file mode 100644
index 00000000..1b376409
--- /dev/null
+++ b/debian/libpam-cracklib.prerm
@@ -0,0 +1,9 @@
+#!/bin/sh
+
+set -e
+
+if [ "$1" = remove ]; then
+ pam-auth-update --package --remove cracklib
+fi
+
+#DEBHELPER#
diff --git a/debian/libpam-runtime.dirs b/debian/libpam-runtime.dirs
new file mode 100644
index 00000000..fd23e8bf
--- /dev/null
+++ b/debian/libpam-runtime.dirs
@@ -0,0 +1 @@
+/var/lib/pam
diff --git a/debian/libpam-runtime.install b/debian/libpam-runtime.install
index 34ed6fe1..77dc56b3 100644
--- a/debian/libpam-runtime.install
+++ b/debian/libpam-runtime.install
@@ -3,3 +3,5 @@ debian/tmp/etc/pam.d/other etc/pam.d
debian/tmp/usr/share/pam usr/share
debian/tmp/usr/sbin/pam_getenv usr/sbin
debian/tmp/usr/share/locale usr/share
+debian/local/pam-auth-update usr/sbin
+debian/pam-configs/unix usr/share/pam-configs/
diff --git a/debian/libpam-runtime.lintian b/debian/libpam-runtime.lintian
new file mode 100644
index 00000000..d84c207a
--- /dev/null
+++ b/debian/libpam-runtime.lintian
@@ -0,0 +1,5 @@
+# deliberate.
+W: libpam-runtime: no-debconf-config
+# this warning is just plain crack, there's no reason that using debconf
+# outside of a maintainer script implies an error.
+W: libpam-runtime: debconf-is-not-a-registry ./usr/sbin/pam-auth-update
diff --git a/debian/libpam-runtime.manpages b/debian/libpam-runtime.manpages
index fe4dc477..1e7d9aed 100644
--- a/debian/libpam-runtime.manpages
+++ b/debian/libpam-runtime.manpages
@@ -2,3 +2,4 @@ debian/tmp/usr/share/man/man5/pam.conf.5
debian/tmp/usr/share/man/man5/pam.d.5
debian/tmp/usr/share/man/man8/PAM.8
debian/local/pam_getenv.8
+debian/local/pam-auth-update.8
diff --git a/debian/libpam-runtime.postinst b/debian/libpam-runtime.postinst
index 5a734671..e684db9a 100644
--- a/debian/libpam-runtime.postinst
+++ b/debian/libpam-runtime.postinst
@@ -3,19 +3,29 @@
# If the user has removed the config file, respect this sign of dementia
# -- only create on package install.
-if [ -z "$2" ] || dpkg --compare-versions "$2" lt 0.76-17
+force=
+if [ -z "$2" ] || dpkg --compare-versions "$2" lt 1.0.1-5
then
+ force=--force
for configfile in common-auth common-account common-session \
common-password
do
- if [ ! -f /etc/pam.d/$configfile ] || \
- fgrep -q `md5sum /etc/pam.d/$configfile` \
+ if [ -f /etc/pam.d/$configfile ] && \
+ ! fgrep -q `md5sum /etc/pam.d/$configfile` \
/usr/share/pam/$configfile.md5sums 2>/dev/null
then
- cp /usr/share/pam/$configfile /etc/pam.d/
+ force=
fi
done
- rm -f /etc/pam.d/other.pre-upgrade 2>/dev/null || true
+fi
+
+pam-auth-update --package $force
+
+if [ -n "$force" ]; then
+ rm -f /etc/pam.d/common-auth.pam-old \
+ /etc/pam.d/common-account.pam-old \
+ /etc/pam.d/common-password.pam-old \
+ /etc/pam.d/common-session.pam-old
fi
#DEBHELPER#
diff --git a/debian/libpam-runtime.postrm b/debian/libpam-runtime.postrm
index c2e4a94f..9a11040d 100644
--- a/debian/libpam-runtime.postrm
+++ b/debian/libpam-runtime.postrm
@@ -3,6 +3,9 @@
if [ "$1" = "purge" ]; then
rm -f /etc/pam.d/common-auth /etc/pam.d/common-account \
/etc/pam.d/common-session /etc/pam.d/common-password
+ rm -f /var/lib/pam/auth /var/lib/pam/account /var/lib/pam/session \
+ /var/lib/pam/password /var/lib/pam/seen
+ rmdir --ignore-fail-on-non-empty /var/lib/pam
fi
#DEBHELPER#
diff --git a/debian/libpam-runtime.prerm b/debian/libpam-runtime.prerm
new file mode 100644
index 00000000..ec239237
--- /dev/null
+++ b/debian/libpam-runtime.prerm
@@ -0,0 +1,9 @@
+#!/bin/sh
+
+set -e
+
+if [ "$1" = remove ]; then
+ pam-auth-update --package --remove unix
+fi
+
+#DEBHELPER#
diff --git a/debian/libpam-runtime.templates b/debian/libpam-runtime.templates
new file mode 100644
index 00000000..d2b876bd
--- /dev/null
+++ b/debian/libpam-runtime.templates
@@ -0,0 +1,33 @@
+Template: libpam-runtime/profiles
+Type: multiselect
+Choices: ${profiles}
+Choices-C: ${profile_names}
+_Description: PAM profiles to enable:
+ Pluggable Authentication Modules (PAM) determine how authentication,
+ authorization, and password changing are handled on the system, as well
+ as allowing configuration of additional actions to take when starting
+ user sessions.
+ .
+ Some PAM module packages provide profiles that can be used to
+ automatically adjust the behavior of all PAM-using applications on the
+ system. Please indicate which of these behaviors you wish to enable.
+
+Template: libpam-runtime/conflicts
+Type: error
+_Description: Incompatible PAM profiles selected.
+ The following PAM profiles cannot be used together:
+ .
+ ${conflicts}
+ .
+ Please select a different set of modules to enable.
+
+Template: libpam-runtime/override
+Type: boolean
+Default: false
+_Description: Override local changes to /etc/pam.d/common-*?
+ One or more of the files /etc/pam.d/common-{auth,account,password,session}
+ have been locally modified. Please indicate whether these local changes
+ should be overridden using the system-provided configuration. If you
+ decline this option, you will need to manage your system's
+ authentication configuration by hand.
+
diff --git a/debian/local/common-account b/debian/local/common-account
index 67983019..84aa98d4 100644
--- a/debian/local/common-account
+++ b/debian/local/common-account
@@ -6,4 +6,21 @@
# the central access policy for use on the system. The default is to
# only deny service to users whose accounts are expired in /etc/shadow.
#
-account required pam_unix.so
+# As of pam 1.0.1-6, this file is managed by pam-auth-update by default.
+# To take advantage of this, it is recommended that you configure any
+# local modules either before or after the default block, and use
+# pam-auth-update to manage selection of other modules. See
+# pam-auth-update(8) for details.
+#
+
+# here are the per-package modules (the "Primary" block)
+$account_primary
+# here's the fallback if no module succeeds
+account requisite pam_deny.so
+# prime the stack with a positive return value if there isn't one already;
+# this avoids us returning an error just because nothing sets a success code
+# since the modules above will each just jump around
+account required pam_permit.so
+# and here are more per-package modules (the "Additional" block)
+$account_additional
+# end of pam-auth-update config
diff --git a/debian/local/common-account.md5sums b/debian/local/common-account.md5sums
new file mode 100644
index 00000000..39fbb426
--- /dev/null
+++ b/debian/local/common-account.md5sums
@@ -0,0 +1 @@
+9f04221fe44762047894adeb96ffd069 debian/local/common-account
diff --git a/debian/local/common-auth b/debian/local/common-auth
index 63d129aa..ac9d2dd3 100644
--- a/debian/local/common-auth
+++ b/debian/local/common-auth
@@ -7,4 +7,20 @@
# (e.g., /etc/shadow, LDAP, Kerberos, etc.). The default is to use the
# traditional Unix authentication mechanisms.
#
-auth required pam_unix.so nullok_secure
+# As of pam 1.0.1-6, this file is managed by pam-auth-update by default.
+# To take advantage of this, it is recommended that you configure any
+# local modules either before or after the default block, and use
+# pam-auth-update to manage selection of other modules. See
+# pam-auth-update(8) for details.
+
+# here are the per-package modules (the "Primary" block)
+$auth_primary
+# here's the fallback if no module succeeds
+auth requisite pam_deny.so
+# prime the stack with a positive return value if there isn't one already;
+# this avoids us returning an error just because nothing sets a success code
+# since the modules above will each just jump around
+auth required pam_permit.so
+# and here are more per-package modules (the "Additional" block)
+$auth_additional
+# end of pam-auth-update config
diff --git a/debian/local/common-auth.md5sums b/debian/local/common-auth.md5sums
index 31477ad0..7fd8f15c 100644
--- a/debian/local/common-auth.md5sums
+++ b/debian/local/common-auth.md5sums
@@ -1 +1,2 @@
933d757dcd5974b00619f68955743be7 /etc/pam.d/common-auth
+b58d8e0a6cadbf879df94869cca6be98 /etc/pam.d/common-auth
diff --git a/debian/local/common-password b/debian/local/common-password
index 45959eb5..dab20333 100644
--- a/debian/local/common-password
+++ b/debian/local/common-password
@@ -7,28 +7,28 @@
# Explanation of pam_unix options:
#
-# The "nullok" option allows users to change an empty password, else
-# empty passwords are treated as locked accounts.
-#
# The "md5" option enables MD5 passwords. Without this option, the
# default is Unix crypt.
#
# The "obscure" option replaces the old `OBSCURE_CHECKS_ENAB' option in
# login.defs.
#
-# You can also use the "min" option to enforce the length of the new
-# password.
-#
# See the pam_unix manpage for other options.
-password required pam_unix.so nullok obscure md5
-
-# Alternate strength checking for password. Note that this
-# requires the libpam-cracklib package to be installed.
-# You will need to comment out the password line above and
-# uncomment the next two in order to use this.
-# (Replaces the `OBSCURE_CHECKS_ENAB', `CRACKLIB_DICTPATH')
-#
-# password required pam_cracklib.so retry=3 minlen=6 difok=3
-# password required pam_unix.so use_authtok nullok md5
+# As of pam 1.0.1-6, this file is managed by pam-auth-update by default.
+# To take advantage of this, it is recommended that you configure any
+# local modules either before or after the default block, and use
+# pam-auth-update to manage selection of other modules. See
+# pam-auth-update(8) for details.
+# here are the per-package modules (the "Primary" block)
+$password_primary
+# here's the fallback if no module succeeds
+password requisite pam_deny.so
+# prime the stack with a positive return value if there isn't one already;
+# this avoids us returning an error just because nothing sets a success code
+# since the modules above will each just jump around
+password required pam_permit.so
+# and here are more per-package modules (the "Additional" block)
+$password_additional
+# end of pam-auth-update config
diff --git a/debian/local/common-password.md5sums b/debian/local/common-password.md5sums
index 569ca682..96faebf1 100644
--- a/debian/local/common-password.md5sums
+++ b/debian/local/common-password.md5sums
@@ -1,2 +1,3 @@
601ecfbc99fd359877552cb5298087ad /etc/pam.d/common-password
e5ae8ba8d00083c922d9d82a0432ef78 /etc/pam.d/common-password
+5d518818f1c6c369040b782f7852f53e /etc/pam.d/common-password
diff --git a/debian/local/common-session b/debian/local/common-session
index dc11da6d..2e94d6c7 100644
--- a/debian/local/common-session
+++ b/debian/local/common-session
@@ -4,6 +4,22 @@
# This file is included from other service-specific PAM config files,
# and should contain a list of modules that define tasks to be performed
# at the start and end of sessions of *any* kind (both interactive and
-# non-interactive). The default is pam_unix.
+# non-interactive).
#
-session required pam_unix.so
+# As of pam 1.0.1-6, this file is managed by pam-auth-update by default.
+# To take advantage of this, it is recommended that you configure any
+# local modules either before or after the default block, and use
+# pam-auth-update to manage selection of other modules. See
+# pam-auth-update(8) for details.
+
+# here are the per-package modules (the "Primary" block)
+$session_primary
+# here's the fallback if no module succeeds
+session requisite pam_deny.so
+# prime the stack with a positive return value if there isn't one already;
+# this avoids us returning an error just because nothing sets a success code
+# since the modules above will each just jump around
+session required pam_permit.so
+# and here are more per-package modules (the "Additional" block)
+$session_additional
+# end of pam-auth-update config
diff --git a/debian/local/common-session.md5sums b/debian/local/common-session.md5sums
new file mode 100644
index 00000000..b177eaa8
--- /dev/null
+++ b/debian/local/common-session.md5sums
@@ -0,0 +1 @@
+4845c1632b3561a9debe8d59be1b238e /etc/pam.d/common-session
diff --git a/debian/local/pam-auth-update b/debian/local/pam-auth-update
new file mode 100755
index 00000000..5b6b21b1
--- /dev/null
+++ b/debian/local/pam-auth-update
@@ -0,0 +1,665 @@
+#!/usr/bin/perl -w
+
+# pam-auth-update: update /etc/pam.d/common-* from /usr/share/pam-configs
+#
+# Update the /etc/pam.d/common-* files based on the per-package profiles
+# provided in /usr/share/pam-configs/ taking into consideration user's
+# preferences (as determined via debconf prompting).
+#
+# Written by Steve Langasek <steve.langasek@canonical.com>
+#
+# Copyright (C) 2008 Canonical Ltd.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of version 3 of the GNU General Public License as
+# published by the Free Software Foundation.
+#
+# # This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301,
+# USA.
+
+use strict;
+use Debconf::Client::ConfModule ':all';
+use IPC::Open2 'open2';
+
+version('2.0');
+my $capb=capb('backup');
+
+my $inputdir = '/usr/share/pam-configs';
+my $template = 'libpam-runtime/profiles';
+my $errtemplate = 'libpam-runtime/conflicts';
+my $overridetemplate = 'libpam-runtime/override';
+my $confdir = '/etc/pam.d';
+my $savedir = '/var/lib/pam';
+my (%profiles, @sorted, @enabled, @conflicts, %removals);
+my $force = 0;
+my $priority = 'high';
+my %md5sums = (
+ 'auth' => ['8d4fe17e66ba25de16a117035d1396aa'],
+ 'account' => ['3c0c362eaf3421848b679d63fd48c3fa'],
+ 'password' => [
+ '4bd7610f2e85f8ddaef79c7db7cb49eb',
+ '3532cbabf533d59f0b64218ad82f1446',
+ ],
+ 'session' => [
+ '240fb92986c885b327cdb21dd641da8c',
+ '1bd2f3e86f552c57f5ee013b93ffca2b',
+ '1a1bda3d417991dd366984ca7382f787',
+ ],
+);
+
+opendir(DIR, $inputdir) || die "could not open config directory: $!";
+while (my $profile = readdir(DIR)) {
+ next if ($profile eq '.' || $profile eq '..');
+ %{$profiles{$profile}} = parse_pam_profile($inputdir . '/' . $profile);
+}
+closedir DIR;
+
+# use a '--force' arg to specify that /etc/pam.d should be overwritten;
+# used only on upgrades where the postinst has already determined that the
+# checksums match. Module packages other than libpam-runtime itself must
+# NEVER use this option! Document with big skullses and crossboneses! It
+# needs to be exposed for libpam-runtime because that's the package that
+# decides whether we have a pristine config to be converted, and knows
+# whether the version being upgraded from is one for which the conversion
+# should be done.
+
+while ($#ARGV >= 0) {
+ my $opt = shift;
+ if ($opt eq '--force') {
+ $force = 1;
+ } elsif ($opt eq '--package') {
+ $priority = 'medium';
+ } elsif ($opt eq '--remove') {
+ while ($#ARGV >= 0) {
+ last if ($ARGV[0] =~ /^--/);
+ $removals{shift @ARGV} = 1;
+ }
+ # --remove implies --package
+ $priority = 'medium' if (keys(%removals));
+ }
+}
+
+x_loadtemplatefile('/var/lib/dpkg/info/libpam-runtime.templates','libpam-runtime');
+
+# always sort by priority, so we have consistency and don't have to
+# shuffle later
+@sorted = sort { $profiles{$b}->{'Priority'} <=> $profiles{$a}->{'Priority'}
+ || $b cmp $a }
+ keys(%profiles);
+# If we're being called for package removal, filter out those options here
+@sorted = grep { !$removals{$_} } @sorted;
+
+subst($template, 'profile_names', join(', ',@sorted));
+subst($template, 'profiles',
+ join(', ', map { $profiles{$_}->{'Name'} } @sorted));
+
+my $diff = diff_profiles($confdir,$savedir);
+
+if ($diff) {
+ @enabled = grep { !$removals{$_} } @{$diff->{'mods'}};
+} else {
+ @enabled = split(/, /,get($template));
+}
+
+# find out what we've seen, so we can ignore those defaults
+my %seen;
+if (-e $savedir . '/seen') {
+ open(SEEN,$savedir . '/seen');
+ while (<SEEN>) {
+ chomp;
+ $seen{$_} = 1;
+ }
+ close(SEEN);
+}
+
+# filter out any options that are no longer available for any reason
+@enabled = grep { $profiles{$_} } @enabled;
+
+# an empty module set is an error, so in that case grab all the defaults
+if (!@enabled) {
+ %seen = ();
+ $priority = 'high' unless ($force);
+}
+
+# add any previously-unseen configs
+push(@enabled,
+ grep { $profiles{$_}->{'Default'} eq 'yes' && !$seen{$_} } @sorted);
+@enabled = sort { $profiles{$b}->{'Priority'} <=> $profiles{$a}->{'Priority'}
+ || $b cmp $a }
+ @enabled;
+my $prev = '';
+@enabled = grep { $_ ne $prev && (($prev) = $_) } @enabled;
+
+
+fset($template,'seen','false');
+set($template,join(', ', @enabled));
+
+# if diff_profiles() fails, and we weren't passed a 'force' argument
+# (because this isn't an upgrade from an old version, or the checksum
+# didn't match, or we're being called by some other module package), prompt
+# the user whether to override. If the user declines (the default), we
+# never again manage this config unless manually called with '--force'.
+if (!$diff && !$force) {
+ input('high',$overridetemplate);
+ go();
+ $force = 1 if (get($overridetemplate) eq 'true');
+}
+
+if (!$diff && !$force) {
+ print STDERR <<EOF;
+
+pam-auth-update: Local modifications to /etc/pam.d/common-*, not updating.
+pam-auth-update: Run pam-auth-update --force to override.
+
+EOF
+ exit;
+}
+
+do {
+ @conflicts = ();
+ input($priority,$template);
+ go();
+
+ @enabled = split(/, /, get($template));
+
+ # in case of conflicts, automatically unset the lower priority
+ # item of each pair
+ foreach my $elem (@enabled)
+ {
+ for (my $i=$#enabled; $i >= 0; $i--)
+ {
+ my $conflict = $enabled[$i];
+ if ($profiles{$elem}->{'Conflicts'}->{$conflict}) {
+ splice(@enabled,$i,1);
+ my $desc = $profiles{$elem}->{'Name'}
+ . ', ' . $profiles{$conflict}->{'Name'};
+ push(@conflicts,$desc);
+ }
+ }
+ }
+ if (@conflicts) {
+ subst($errtemplate, 'conflicts', join("\n", @conflicts));
+ input('high',$errtemplate);
+ }
+ fset($template,'seen','false');
+ set($template, join(', ', @enabled));
+} while (@conflicts);
+
+# the decision has been made about what configs to use, so even if
+# something fails after this, we shouldn't go munging the default
+# options again. Save the list of known configs to /var/lib/pam.
+open(SEEN,"> $savedir/seen");
+for my $i (@sorted) {
+ print SEEN "$i\n";
+}
+close(SEEN);
+
+# @enabled now contains our list of profiles to use for piecing together
+# a config
+# we have:
+# - templates into which we insert the specialness
+# - magic comments denoting the beginning and end of our managed block;
+# looking at only the functional config lines would potentially let us
+# handle more cases, at the expense of much greater complexity, so
+# pass on this at least for the first round
+# - a representation of the autogenerated config stored in /var/lib/pam,
+# that we can diff against in order to account for changed options or
+# manually dropped modules
+# - a hash describing the local modifications the user has made to the
+# config; these are always preserved unless manually overridden with
+# the --force option
+
+write_profiles(\%profiles, \@enabled, $confdir, $savedir, $diff, $force);
+
+
+# take a single line from a stock config, and merge it with the
+# information about local admin edits
+sub merge_one_line
+{
+ my ($line,$diff,$count) = @_;
+ my (@opts,$modline);
+
+ my ($adds,$removes);
+
+ $line =~ /^((\[[^]]+\]|\w+)\s+\S+)\s*(.*)/;
+
+ @opts = split(/\s+/,$3);
+ $modline = $1;
+ $modline =~ s/end/$count/g;
+ if ($diff) {
+ my $mod = $modline;
+ $mod =~ s/[0-9]+//g;
+ $adds = \%{$diff->{'add'}{$mod}};
+ $removes = \%{$diff->{'remove'}{$mod}};
+ } else {
+ $adds = $removes = undef;
+ }
+
+ for (my $i = 0; $i <= $#opts; $i++) {
+ if ($adds->{$opts[$i]}) {
+ delete $adds->{$opts[$i]};
+ }
+ if ($removes->{$opts[$i]}) {
+ splice(@opts,$i,1);
+ $i--;
+ }
+ }
+ return $modline . " " . join(' ',@opts,keys(%{$adds})) . "\n";
+}
+
+# return the lines for a given config name, type, and position in the stack
+sub lines_for_module_and_type
+{
+ my ($profiles, $mod, $type, $modpos) = @_;
+ if ($modpos == 0 && $profiles->{$mod}{$type . '-Initial'}) {
+ return $profiles->{$mod}{$type . '-Initial'};
+ }
+ return $profiles->{$mod}{$type};
+}
+
+# create a single PAM config from the indicated template and selections,
+# writing to a new file
+sub create_from_template
+{
+ my($template,$dest,$profiles,$enabled,$diff,$type) = @_;
+ my $state = 0;
+ my $uctype = ucfirst($type);
+
+ open(INPUT,$template) || return 0;
+ open(OUTPUT,">$dest") || return 0;
+
+ while (<INPUT>) {
+ if ($state == 1) {
+ if (/^# here's the fallback if no module succeeds/) {
+ print OUTPUT;
+ $state++;
+ }
+ next;
+ }
+ if ($state == 3) {
+ if (/^# end of pam-auth-update config/) {
+ print OUTPUT;
+ $state++;
+ }
+ next;
+ }
+
+ print OUTPUT;
+
+ my ($pattern,$val);
+ if ($state == 0) {
+ $pattern = '^# here are the per-package modules \(the "Primary" block\)';
+ $val = 'Primary';
+ } elsif ($state == 2) {
+ $pattern = '^# and here are more per-package modules \(the "Additional" block\)';
+ $val = 'Additional';
+ } else {
+ next;
+ }
+
+ if (/$pattern/) {
+ my $i = 0;
+ my $count = 0;
+ # first we need to get a count of lines that we're
+ # going to output, so we can fix up the jumps correctly
+ for my $mod (@{$enabled}) {
+ my $output;
+ next if (!$profiles->{$mod}{$uctype . '-Type'});
+ next if $profiles->{$mod}{$uctype . '-Type'} ne $val;
+ $output = lines_for_module_and_type($profiles, $mod, $uctype, $i++);
+ # bypasses a perl warning about @_, sigh
+ my @tmparr = split("\n+",$output);
+ $count += @tmparr;
+ }
+
+ # in case anything tries to jump in the 'additional'
+ # block, let's try not to jump off the stack...
+ $count-- if ($val eq 'Additional');
+
+ # no primary block, so output a stock pam_permit line
+ # to keep the stack intact
+ if ($val eq 'Primary' && $count == 0)
+ {
+ print OUTPUT "$type\t[default=1]\t\t\tpam_permit.so\n";
+ }
+
+ $i = 0;
+ for my $mod (@{$enabled}) {
+ my $output;
+ my @output;
+ next if (!$profiles->{$mod}{$uctype . '-Type'});
+ next if $profiles->{$mod}{$uctype . '-Type'} ne $val;
+ $output = lines_for_module_and_type($profiles, $mod, $uctype, $i++);
+ for my $line (split("\n",$output)) {
+ $line = merge_one_line($line,$diff,
+ $count);
+ print OUTPUT "$type\t$line";
+ $count--;
+ }
+ }
+ $state++;
+ }
+ }
+ close(INPUT);
+ close(OUTPUT);
+
+ if ($state < 4) {
+ unlink($dest);
+ return 0;
+ }
+ return 1;
+}
+
+# take a template file, strip out everything between the markers, and
+# return the md5sum of the remaining contents. Used for testing for
+# local modifications of the boilerplate.
+sub get_template_md5sum
+{
+ my($template) = @_;
+ my $state = 0;
+
+ open(INPUT,$template) || return '';
+ my($md5sum_fd,$output_fd);
+ my $pid = open2($md5sum_fd, $output_fd, 'md5sum');
+ return '' if (!$pid);
+
+ while (<INPUT>) {
+ if ($state == 1) {
+ if (/^# here's the fallback if no module succeeds/) {
+ print $output_fd $_;
+ $state++;
+ }
+ next;
+ }
+ if ($state == 3) {
+ if (/^# end of pam-auth-update config/) {
+ print $output_fd $_;
+ $state++;
+ }
+ next;
+ }
+
+ print $output_fd $_;
+
+ my ($pattern,$val);
+ if ($state == 0) {
+ $pattern = '^# here are the per-package modules \(the "Primary" block\)';
+ } elsif ($state == 2) {
+ $pattern = '^# and here are more per-package modules \(the "Additional" block\)';
+ } else {
+ next;
+ }
+
+ if (/$pattern/) {
+ $state++;
+ }
+ }
+ close(INPUT);
+ close($output_fd);
+ my $md5sum = <$md5sum_fd>;
+ close($md5sum_fd);
+ waitpid $pid, 0;
+
+ $md5sum = (split(/\s+/,$md5sum))[0];
+ return $md5sum;
+}
+
+# merge a set of module declarations into a set of new config files,
+# using the information returned from diff_profiles().
+sub write_profiles
+{
+ my($profiles,$enabled,$confdir,$savedir,$diff,$force) = @_;
+
+ if (! -d $savedir) {
+ mkdir($savedir);
+ }
+
+ # because we can't atomically replace both /var/lib/pam/$foo and
+ # /etc/pam.d/common-$foo at the same time, take steps to make this
+ # somewhat robust
+ for my $type ('auth','account','password','session') {
+ my $target = $confdir . '/common-' . $type;
+ my $template = $target;
+ my $dest = $template . '.pam-new';
+
+ my $diff = $diff;
+ if ($diff) {
+ $diff = \%{$diff->{$type}};
+ }
+
+ # Detect if the template is unmodified, and if so, use
+ # the version from /usr/share. Depends on knowing the
+ # md5sums of the originals.
+ my $md5sum = get_template_md5sum($template);
+ for my $i (@{$md5sums{$type}}) {
+ if ($md5sum eq $i) {
+ $template = '/usr/share/pam/common-' . $type;
+ last;
+ }
+ }
+
+ # first, write out the new config
+ if (!create_from_template($template,$dest,$profiles,$enabled,
+ $diff,$type))
+ {
+ if (!$force) {
+ return 0;
+ }
+ $template = '/usr/share/pam/common-' . $type;
+ if (!create_from_template($template,$dest,$profiles,
+ $enabled,$diff,$type))
+ {
+ return 0;
+ }
+ }
+
+ # then write out the saved config
+ if (!open(OUTPUT, "> $savedir/$type.new")) {
+ unlink($dest);
+ return 0;
+ }
+ my $i = 0;
+ my $uctype = ucfirst($type);
+ for my $mod (@{$enabled}) {
+ my $output;
+ next if (!$profiles->{$mod}{$uctype . '-Type'});
+ next if ($profiles->{$mod}{$uctype . '-Type'} eq 'Additional');
+
+ $output = lines_for_module_and_type($profiles, $mod, $uctype, $i++);
+ if ($output) {
+ print OUTPUT "Module: $mod\n";
+ print OUTPUT $output . "\n";
+ }
+ }
+
+ # no primary block, so output a stock pam_permit line
+ if ($i == 0)
+ {
+ print OUTPUT "Module: null\n";
+ print OUTPUT "[default=1]\t\t\tpam_permit.so\n";
+ }
+
+ $i = 0;
+ for my $mod (@{$enabled}) {
+ my $output;
+ next if (!$profiles->{$mod}{$uctype . '-Type'});
+ next if ($profiles->{$mod}{$uctype . '-Type'} eq 'Primary');
+
+ $output = lines_for_module_and_type($profiles, $mod, $uctype, $i++);
+ if ($output) {
+ print OUTPUT "Module: $mod\n";
+ print OUTPUT $output . "\n";
+ }
+ }
+
+ close(OUTPUT);
+
+ # then do the renames, back-to-back
+ # we have to use system because File::Copy is in
+ # perl-modules, not perl-base
+ if (-e "$target" && $force) {
+ system('cp','-f',$target,$target . '.pam-old');
+ }
+ rename($dest,$target);
+ rename("$savedir/$type.new","$savedir/$type");
+ }
+
+ # at the end of a successful write, reset the 'seen' flag and the
+ # value of the debconf override question.
+ fset($overridetemplate,'seen','false');
+ set($overridetemplate,'false');
+}
+
+# reconcile the current config in /etc/pam.d with the saved ones in
+# /var/lib/pam; returns a hash of profile names and the corresponding
+# options that should be added/removed relative to the stock config.
+# returns false if any of the markers are missing that permit a merge,
+# or on any other failure.
+sub diff_profiles
+{
+ my ($sourcedir,$savedir) = @_;
+ my (%diff);
+
+ @{$diff{'mods'}} = ();
+ # Load the saved config from /var/lib/pam, then iterate through all
+ # lines in the current config that are in the managed block.
+ # If anything fails here, just return immediately since we then
+ # have nothing to merge; instead, the caller will decide later
+ # whether to force an overwrite.
+ for my $type ('auth','account','password','session') {
+ my (@saved,$modname);
+
+ open(SAVED,$savedir . '/' . $type) || return 0;
+ while (<SAVED>) {
+ if (/^Module: (.*)/) {
+ $modname = $1;
+ next;
+ }
+ chomp;
+ # trim out the destination of any jumps; this saves
+ # us from having to re-parse everything just to fix
+ # up the jump lengths, when changes to these will
+ # already show up as inconsistencies elsewhere
+ s/(\[[^0-9]*)[0-9]+(.*\])/$1$2/g;
+ s/(\[.*)end(.*\])/$1$2/g;
+ my (@temp) = ($modname,$_);
+ push(@saved,\@temp);
+ }
+ close(SAVED);
+
+ my $state = 0;
+ my (@prev_opts,$curmod);
+
+ open(CURRENT,$sourcedir . '/common-' . $type) || return 0;
+ while (<CURRENT>) {
+ if ($state == 0) {
+ $state = 1
+ if (/^# here are the per-package modules \(the "Primary" block\)/);
+ next;
+ }
+ if ($state == 1) {
+ s/^$type\s+//;
+ if (/^# here's the fallback if no module succeeds/) {
+ $state = 2;
+ next;
+ }
+ }
+ if ($state == 2) {
+ $state = 3
+ if (/^# and here are more per-package modules \(the "Additional" block\)/);
+ next;
+ }
+ if ($state == 3) {
+ last if (/^# end of pam-auth-update config/);
+ s/^$type\s+//;
+ }
+
+ my $found = 0;
+ my $curopts;
+ while (!$found && $#saved >= 0) {
+ my $line;
+ ($modname,$line) = @{$saved[0]};
+ shift(@saved);
+ $line =~ /^((\[[^]]+\]|\w+)\s+\S+)\s*(.*)/;
+ @prev_opts = split(/\s+/,$3);
+ $curmod = $1;
+ # FIXME: the key isn't derived from the config
+ # name, so collisions are possible if more
+ # than one config references the same module
+
+ $_ =~ s/(\[[^0-9]*)[0-9]+(.*\])/$1$2/g;
+ # check if this is a match for the current line
+ if ($_ =~ /^\Q$curmod\E\s*(.*)$/) {
+ $found = 1;
+ $curopts = $1;
+ push(@{$diff{'mods'}},$modname);
+ }
+ }
+
+ # there's a line in the live config that doesn't
+ # correspond to anything from the saved config.
+ # treat this as a failure; it's very error-prone
+ # to decide what to do with an added line that
+ # didn't come from a package.
+ return 0 if (!$found);
+
+ for my $opt (split(/\s+/,$curopts)) {
+ my $found = 0;
+ for (my $i = 0; $i <= $#prev_opts; $i++) {
+ if ($prev_opts[$i] eq $opt) {
+ $found = 1;
+ splice(@prev_opts,$i,1);
+ }
+ }
+ $diff{$type}{'add'}{$curmod}{$opt} = 1 if (!$found);
+ }
+ for my $opt (@prev_opts) {
+ $diff{$type}{'remove'}{$curmod}{$opt} = 1;
+ }
+ }
+ close(CURRENT);
+
+ # we couldn't parse the config, so the merge fails
+ return 0 if ($state < 3);
+ }
+ return \%diff;
+}
+
+# simple function to parse a provided config file, in pseudo-RFC822
+# format,
+sub parse_pam_profile
+{
+ my ($profile) = $_[0];
+ my $fieldname;
+ my %profile;
+ open(PROFILE, $profile) || die "could not read profile $profile: $!";
+ while (<PROFILE>) {
+ if (/^(\S+):\s+(.*)$/) {
+ $fieldname = $1;
+ # compatibility with the first implementation round;
+ # "Auth-Final" is now just called "Auth"
+ $fieldname =~ s/-Final$//;
+ if ($fieldname eq 'Conflicts') {
+ foreach my $elem (split(/, /, $2)) {
+ $profile{'Conflicts'}->{$elem} = 1;
+ }
+ } else {
+ $profile{$fieldname} = $2;
+ }
+ } else {
+ chomp;
+ s/^\s+//;
+ $profile{$fieldname} .= "\n$_";
+ $profile{$fieldname} =~ s/^[\n\s]+//;
+ }
+ }
+ close(PROFILE);
+ return %profile;
+}
diff --git a/debian/local/pam-auth-update.8 b/debian/local/pam-auth-update.8
new file mode 100644
index 00000000..fd5e2ad4
--- /dev/null
+++ b/debian/local/pam-auth-update.8
@@ -0,0 +1,101 @@
+.\" Copyright (C) 2008 Canonical Ltd.
+.\"
+.\" Author: Steve Langasek <steve.langasek@canonical.com>
+.\"
+.\" This program is free software; you can redistribute it and/or modify
+.\" it under the terms of version 3 of the GNU General Public License as
+.\" published by the Free Software Foundation.
+.\"
+.\" .\" This program is distributed in the hope that it will be useful,
+.\" but WITHOUT ANY WARRANTY; without even the implied warranty of
+.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+.\" GNU General Public License for more details.
+.\"
+.\" You should have received a copy of the GNU General Public License
+.\" along with this program; if not, write to the Free Software
+.\" Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301,
+.\" USA.
+.TH "PAM\-AUTH\-UPDATE" "8" "08/23/2008" "Debian"
+.SH NAME
+pam\-auth\-update - manage PAM configuration using packaged profiles
+.SH SYNOPSIS
+.B pam\-auth\-update
+.RB [ \-\-package " [" \-\-remove
+.IR profile " [" profile\fR... "]]]"
+.RB [ \-\-force ]
+.SH DESCRIPTION
+.I pam\-auth\-update
+is a utility that permits configuring the central authentication policy
+for the system using pre-defined profiles as supplied by PAM module
+packages.
+Profiles shipped in the
+.I /usr/share/pam\-configs/
+directory specify the modules, with options, to enable; the preferred
+ordering with respect to other profiles; and whether a profile should be
+enabled by default.
+Packages providing PAM modules register their profiles at install time
+by calling
+.BR "pam\-auth\-update \-\-package" .
+Selection of profiles is done using the standard debconf interface.
+The profile selection question will be asked at `medium' priority when
+packages are added or removed, so no user interaction is required by
+default.
+Users may invoke
+.B pam\-auth\-update
+directly to change their authentication configuration.
+.PP
+The script makes every effort to respect local changes to
+.IR "/etc/pam.d/common-*".
+Local modifications to the list of module options will be preserved, and
+additions of modules within the managed portion of the stack will cause
+.B pam\-auth\-update
+to treat the config files as locally modified and not make further
+changes to the config files unless given the
+.B \-\-force
+option.
+.PP
+If the user specifies that
+.B pam\-auth\-update
+should override local configuration changes, the locally-modified files
+will be saved in
+.I /etc/pam.d/
+with a suffix of
+.IR "\.pam\-old" .
+.SH OPTIONS
+.TP
+.B \-\-package
+Indicate that the caller is a package maintainer script; lowers the
+priority of debconf questions to `medium' so that the user is not
+prompted by default.
+.TP
+.B \-\-remove \fIprofile \fR[\fIprofile\fR...]
+Remove the specified profiles from the system configuration.
+.B pam\-auth\-update \-\-remove
+should be used to remove profiles from the configuration before the
+modules they reference are removed from disk, to ensure that PAM is in a
+consistent and usable state at all times during package upgrades or
+removals.
+.TP
+.B \-\-force
+Overwrite the current PAM configuration, without prompting.
+This option
+.B must not
+be used by package maintainer scripts; it is intended for use by
+administrators only.
+.SH FILES
+.PP
+.I /etc/pam.d/common\-*
+.RS 4
+Global configuration of PAM, affecting all installed services.
+.RE
+.PP
+.I /usr/share/pam\-configs/
+.RS 4
+Package-supplied authentication profiles.
+.RE
+.SH AUTHOR
+Steve Langasek <steve.langasek@canonical.com>
+.SH COPYRIGHT
+Copyright (C) 2008 Canonical Ltd.
+.SH "SEE ALSO"
+PAM(7), pam.d(5), debconf(7)
diff --git a/debian/pam-configs/cracklib b/debian/pam-configs/cracklib
new file mode 100644
index 00000000..1c48274f
--- /dev/null
+++ b/debian/pam-configs/cracklib
@@ -0,0 +1,9 @@
+Name: Cracklib password strength checking
+Default: yes
+Priority: 1024
+Conflicts: unix-zany
+Password-Type: Primary
+Password:
+ requisite pam_cracklib.so retry=3 minlen=8 difok=3
+Password-Initial:
+ requisite pam_cracklib.so retry=3 minlen=8 difok=3
diff --git a/debian/pam-configs/unix b/debian/pam-configs/unix
new file mode 100644
index 00000000..4bb6bab4
--- /dev/null
+++ b/debian/pam-configs/unix
@@ -0,0 +1,23 @@
+Name: Unix authentication
+Default: yes
+Priority: 256
+Auth-Type: Primary
+Auth:
+ [success=end default=ignore] pam_unix.so nullok_secure try_first_pass
+Auth-Initial:
+ [success=end default=ignore] pam_unix.so nullok_secure
+Account-Type: Primary
+Account:
+ [success=end new_authtok_reqd=done default=ignore] pam_unix.so
+Account-Initial:
+ [success=end new_authtok_reqd=done default=ignore] pam_unix.so
+Session-Type: Additional
+Session:
+ required pam_unix.so
+Session-Initial:
+ required pam_unix.so
+Password-Type: Primary
+Password:
+ [success=end default=ignore] pam_unix.so obscure use_authtok try_first_pass md5
+Password-Initial:
+ [success=end default=ignore] pam_unix.so obscure md5
diff --git a/debian/po/POTFILES.in b/debian/po/POTFILES.in
index 26a3b044..2d55bb09 100644
--- a/debian/po/POTFILES.in
+++ b/debian/po/POTFILES.in
@@ -1,2 +1,3 @@
[type: gettext/rfc822deb] libpam0g.templates
+[type: gettext/rfc822deb] libpam-runtime.templates
[type: gettext/rfc822deb] libpam-modules.templates
diff --git a/debian/po/bg.po b/debian/po/bg.po
index a5941baa..e3fbe78f 100644
--- a/debian/po/bg.po
+++ b/debian/po/bg.po
@@ -76,6 +76,72 @@ msgid ""
"start'."
msgstr "Ще трябва сами да ги стартирате чрез „/etc/init.d/<услуга> start“."
+#. Type: multiselect
+#. Description
+#: ../libpam-runtime.templates:1001
+msgid "PAM profiles to enable:"
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../libpam-runtime.templates:1001
+msgid ""
+"Pluggable Authentication Modules (PAM) determine how authentication, "
+"authorization, and password changing are handled on the system, as well as "
+"allowing configuration of additional actions to take when starting user "
+"sessions."
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../libpam-runtime.templates:1001
+msgid ""
+"Some PAM module packages provide profiles that can be used to automatically "
+"adjust the behavior of all PAM-using applications on the system. Please "
+"indicate which of these behaviors you wish to enable."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "Incompatible PAM profiles selected."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "The following PAM profiles cannot be used together:"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "${conflicts}"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "Please select a different set of modules to enable."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../libpam-runtime.templates:3001
+msgid "Override local changes to /etc/pam.d/common-*?"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../libpam-runtime.templates:3001
+msgid ""
+"One or more of the files /etc/pam.d/common-{auth,account,password,session} "
+"have been locally modified. Please indicate whether these local changes "
+"should be overridden using the system-provided configuration. If you "
+"decline this option, you will need to manage your system's authentication "
+"configuration by hand."
+msgstr ""
+
#. Type: error
#. Description
#: ../libpam-modules.templates:1001
diff --git a/debian/po/cs.po b/debian/po/cs.po
index 25fa8d0c..8105ba3a 100644
--- a/debian/po/cs.po
+++ b/debian/po/cs.po
@@ -79,6 +79,72 @@ msgid ""
msgstr ""
"Tyto služby budete muset spustit ručně příkazem '/etc/init.d/<služba> start'."
+#. Type: multiselect
+#. Description
+#: ../libpam-runtime.templates:1001
+msgid "PAM profiles to enable:"
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../libpam-runtime.templates:1001
+msgid ""
+"Pluggable Authentication Modules (PAM) determine how authentication, "
+"authorization, and password changing are handled on the system, as well as "
+"allowing configuration of additional actions to take when starting user "
+"sessions."
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../libpam-runtime.templates:1001
+msgid ""
+"Some PAM module packages provide profiles that can be used to automatically "
+"adjust the behavior of all PAM-using applications on the system. Please "
+"indicate which of these behaviors you wish to enable."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "Incompatible PAM profiles selected."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "The following PAM profiles cannot be used together:"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "${conflicts}"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "Please select a different set of modules to enable."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../libpam-runtime.templates:3001
+msgid "Override local changes to /etc/pam.d/common-*?"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../libpam-runtime.templates:3001
+msgid ""
+"One or more of the files /etc/pam.d/common-{auth,account,password,session} "
+"have been locally modified. Please indicate whether these local changes "
+"should be overridden using the system-provided configuration. If you "
+"decline this option, you will need to manage your system's authentication "
+"configuration by hand."
+msgstr ""
+
#. Type: error
#. Description
#: ../libpam-modules.templates:1001
diff --git a/debian/po/de.po b/debian/po/de.po
index 4b570714..690e9466 100644
--- a/debian/po/de.po
+++ b/debian/po/de.po
@@ -81,6 +81,72 @@ msgstr ""
"Sie müssen diese manuell neu starten, indem Sie »/etc/init.d/<Dienst> start« "
"ausführen."
+#. Type: multiselect
+#. Description
+#: ../libpam-runtime.templates:1001
+msgid "PAM profiles to enable:"
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../libpam-runtime.templates:1001
+msgid ""
+"Pluggable Authentication Modules (PAM) determine how authentication, "
+"authorization, and password changing are handled on the system, as well as "
+"allowing configuration of additional actions to take when starting user "
+"sessions."
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../libpam-runtime.templates:1001
+msgid ""
+"Some PAM module packages provide profiles that can be used to automatically "
+"adjust the behavior of all PAM-using applications on the system. Please "
+"indicate which of these behaviors you wish to enable."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "Incompatible PAM profiles selected."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "The following PAM profiles cannot be used together:"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "${conflicts}"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "Please select a different set of modules to enable."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../libpam-runtime.templates:3001
+msgid "Override local changes to /etc/pam.d/common-*?"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../libpam-runtime.templates:3001
+msgid ""
+"One or more of the files /etc/pam.d/common-{auth,account,password,session} "
+"have been locally modified. Please indicate whether these local changes "
+"should be overridden using the system-provided configuration. If you "
+"decline this option, you will need to manage your system's authentication "
+"configuration by hand."
+msgstr ""
+
#. Type: error
#. Description
#: ../libpam-modules.templates:1001
diff --git a/debian/po/es.po b/debian/po/es.po
index 8a455860..2b722ea1 100644
--- a/debian/po/es.po
+++ b/debian/po/es.po
@@ -111,6 +111,72 @@ msgstr ""
"Deberá arrancar manualmente estos servicios ejecutando «/etc/init.d/"
"<servicio> start»."
+#. Type: multiselect
+#. Description
+#: ../libpam-runtime.templates:1001
+msgid "PAM profiles to enable:"
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../libpam-runtime.templates:1001
+msgid ""
+"Pluggable Authentication Modules (PAM) determine how authentication, "
+"authorization, and password changing are handled on the system, as well as "
+"allowing configuration of additional actions to take when starting user "
+"sessions."
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../libpam-runtime.templates:1001
+msgid ""
+"Some PAM module packages provide profiles that can be used to automatically "
+"adjust the behavior of all PAM-using applications on the system. Please "
+"indicate which of these behaviors you wish to enable."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "Incompatible PAM profiles selected."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "The following PAM profiles cannot be used together:"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "${conflicts}"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "Please select a different set of modules to enable."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../libpam-runtime.templates:3001
+msgid "Override local changes to /etc/pam.d/common-*?"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../libpam-runtime.templates:3001
+msgid ""
+"One or more of the files /etc/pam.d/common-{auth,account,password,session} "
+"have been locally modified. Please indicate whether these local changes "
+"should be overridden using the system-provided configuration. If you "
+"decline this option, you will need to manage your system's authentication "
+"configuration by hand."
+msgstr ""
+
#. Type: error
#. Description
#: ../libpam-modules.templates:1001
diff --git a/debian/po/eu.po b/debian/po/eu.po
index 3937e6fa..7bddf40d 100644
--- a/debian/po/eu.po
+++ b/debian/po/eu.po
@@ -85,6 +85,72 @@ msgstr ""
"Hauek eskuz berrabiarazi beharko dituzu '/etc/init.d/<zerbitzua> start' "
"exekutatuz."
+#. Type: multiselect
+#. Description
+#: ../libpam-runtime.templates:1001
+msgid "PAM profiles to enable:"
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../libpam-runtime.templates:1001
+msgid ""
+"Pluggable Authentication Modules (PAM) determine how authentication, "
+"authorization, and password changing are handled on the system, as well as "
+"allowing configuration of additional actions to take when starting user "
+"sessions."
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../libpam-runtime.templates:1001
+msgid ""
+"Some PAM module packages provide profiles that can be used to automatically "
+"adjust the behavior of all PAM-using applications on the system. Please "
+"indicate which of these behaviors you wish to enable."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "Incompatible PAM profiles selected."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "The following PAM profiles cannot be used together:"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "${conflicts}"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "Please select a different set of modules to enable."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../libpam-runtime.templates:3001
+msgid "Override local changes to /etc/pam.d/common-*?"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../libpam-runtime.templates:3001
+msgid ""
+"One or more of the files /etc/pam.d/common-{auth,account,password,session} "
+"have been locally modified. Please indicate whether these local changes "
+"should be overridden using the system-provided configuration. If you "
+"decline this option, you will need to manage your system's authentication "
+"configuration by hand."
+msgstr ""
+
#. Type: error
#. Description
#: ../libpam-modules.templates:1001
diff --git a/debian/po/fi.po b/debian/po/fi.po
index bec59a99..d85a32d8 100644
--- a/debian/po/fi.po
+++ b/debian/po/fi.po
@@ -80,6 +80,72 @@ msgstr ""
"Nämä palvelut tulee käynnistää uudelleen ajamalla '/etc/init.d/<palvelu> "
"start'."
+#. Type: multiselect
+#. Description
+#: ../libpam-runtime.templates:1001
+msgid "PAM profiles to enable:"
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../libpam-runtime.templates:1001
+msgid ""
+"Pluggable Authentication Modules (PAM) determine how authentication, "
+"authorization, and password changing are handled on the system, as well as "
+"allowing configuration of additional actions to take when starting user "
+"sessions."
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../libpam-runtime.templates:1001
+msgid ""
+"Some PAM module packages provide profiles that can be used to automatically "
+"adjust the behavior of all PAM-using applications on the system. Please "
+"indicate which of these behaviors you wish to enable."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "Incompatible PAM profiles selected."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "The following PAM profiles cannot be used together:"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "${conflicts}"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "Please select a different set of modules to enable."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../libpam-runtime.templates:3001
+msgid "Override local changes to /etc/pam.d/common-*?"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../libpam-runtime.templates:3001
+msgid ""
+"One or more of the files /etc/pam.d/common-{auth,account,password,session} "
+"have been locally modified. Please indicate whether these local changes "
+"should be overridden using the system-provided configuration. If you "
+"decline this option, you will need to manage your system's authentication "
+"configuration by hand."
+msgstr ""
+
#. Type: error
#. Description
#: ../libpam-modules.templates:1001
diff --git a/debian/po/fr.po b/debian/po/fr.po
index 242e169e..11b73a4d 100644
--- a/debian/po/fr.po
+++ b/debian/po/fr.po
@@ -82,6 +82,72 @@ msgstr ""
"Vous devez les démarrer vous-même avec la commande « /etc/init.d/<service> "
"start »."
+#. Type: multiselect
+#. Description
+#: ../libpam-runtime.templates:1001
+msgid "PAM profiles to enable:"
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../libpam-runtime.templates:1001
+msgid ""
+"Pluggable Authentication Modules (PAM) determine how authentication, "
+"authorization, and password changing are handled on the system, as well as "
+"allowing configuration of additional actions to take when starting user "
+"sessions."
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../libpam-runtime.templates:1001
+msgid ""
+"Some PAM module packages provide profiles that can be used to automatically "
+"adjust the behavior of all PAM-using applications on the system. Please "
+"indicate which of these behaviors you wish to enable."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "Incompatible PAM profiles selected."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "The following PAM profiles cannot be used together:"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "${conflicts}"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "Please select a different set of modules to enable."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../libpam-runtime.templates:3001
+msgid "Override local changes to /etc/pam.d/common-*?"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../libpam-runtime.templates:3001
+msgid ""
+"One or more of the files /etc/pam.d/common-{auth,account,password,session} "
+"have been locally modified. Please indicate whether these local changes "
+"should be overridden using the system-provided configuration. If you "
+"decline this option, you will need to manage your system's authentication "
+"configuration by hand."
+msgstr ""
+
#. Type: error
#. Description
#: ../libpam-modules.templates:1001
diff --git a/debian/po/gl.po b/debian/po/gl.po
index 1f903130..1263a390 100644
--- a/debian/po/gl.po
+++ b/debian/po/gl.po
@@ -81,6 +81,72 @@ msgstr ""
"Ha ter que reinicialos manualmente executando \"/etc/init.d/<servizo> start"
"\"."
+#. Type: multiselect
+#. Description
+#: ../libpam-runtime.templates:1001
+msgid "PAM profiles to enable:"
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../libpam-runtime.templates:1001
+msgid ""
+"Pluggable Authentication Modules (PAM) determine how authentication, "
+"authorization, and password changing are handled on the system, as well as "
+"allowing configuration of additional actions to take when starting user "
+"sessions."
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../libpam-runtime.templates:1001
+msgid ""
+"Some PAM module packages provide profiles that can be used to automatically "
+"adjust the behavior of all PAM-using applications on the system. Please "
+"indicate which of these behaviors you wish to enable."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "Incompatible PAM profiles selected."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "The following PAM profiles cannot be used together:"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "${conflicts}"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "Please select a different set of modules to enable."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../libpam-runtime.templates:3001
+msgid "Override local changes to /etc/pam.d/common-*?"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../libpam-runtime.templates:3001
+msgid ""
+"One or more of the files /etc/pam.d/common-{auth,account,password,session} "
+"have been locally modified. Please indicate whether these local changes "
+"should be overridden using the system-provided configuration. If you "
+"decline this option, you will need to manage your system's authentication "
+"configuration by hand."
+msgstr ""
+
#. Type: error
#. Description
#: ../libpam-modules.templates:1001
diff --git a/debian/po/it.po b/debian/po/it.po
index 489fc7f5..b80c4ed0 100644
--- a/debian/po/it.po
+++ b/debian/po/it.po
@@ -79,6 +79,72 @@ msgid ""
msgstr ""
"Bisognerà avviarli manualmente eseguendo '/etc/init.d/<servizio> start'."
+#. Type: multiselect
+#. Description
+#: ../libpam-runtime.templates:1001
+msgid "PAM profiles to enable:"
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../libpam-runtime.templates:1001
+msgid ""
+"Pluggable Authentication Modules (PAM) determine how authentication, "
+"authorization, and password changing are handled on the system, as well as "
+"allowing configuration of additional actions to take when starting user "
+"sessions."
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../libpam-runtime.templates:1001
+msgid ""
+"Some PAM module packages provide profiles that can be used to automatically "
+"adjust the behavior of all PAM-using applications on the system. Please "
+"indicate which of these behaviors you wish to enable."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "Incompatible PAM profiles selected."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "The following PAM profiles cannot be used together:"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "${conflicts}"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "Please select a different set of modules to enable."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../libpam-runtime.templates:3001
+msgid "Override local changes to /etc/pam.d/common-*?"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../libpam-runtime.templates:3001
+msgid ""
+"One or more of the files /etc/pam.d/common-{auth,account,password,session} "
+"have been locally modified. Please indicate whether these local changes "
+"should be overridden using the system-provided configuration. If you "
+"decline this option, you will need to manage your system's authentication "
+"configuration by hand."
+msgstr ""
+
#. Type: error
#. Description
#: ../libpam-modules.templates:1001
diff --git a/debian/po/ja.po b/debian/po/ja.po
index 0ea2674c..07dbe490 100644
--- a/debian/po/ja.po
+++ b/debian/po/ja.po
@@ -78,6 +78,72 @@ msgstr ""
"/etc/init.d/<サービス> start' を実行することで、これらを手動で起動する必要が"
"あります。"
+#. Type: multiselect
+#. Description
+#: ../libpam-runtime.templates:1001
+msgid "PAM profiles to enable:"
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../libpam-runtime.templates:1001
+msgid ""
+"Pluggable Authentication Modules (PAM) determine how authentication, "
+"authorization, and password changing are handled on the system, as well as "
+"allowing configuration of additional actions to take when starting user "
+"sessions."
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../libpam-runtime.templates:1001
+msgid ""
+"Some PAM module packages provide profiles that can be used to automatically "
+"adjust the behavior of all PAM-using applications on the system. Please "
+"indicate which of these behaviors you wish to enable."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "Incompatible PAM profiles selected."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "The following PAM profiles cannot be used together:"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "${conflicts}"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "Please select a different set of modules to enable."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../libpam-runtime.templates:3001
+msgid "Override local changes to /etc/pam.d/common-*?"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../libpam-runtime.templates:3001
+msgid ""
+"One or more of the files /etc/pam.d/common-{auth,account,password,session} "
+"have been locally modified. Please indicate whether these local changes "
+"should be overridden using the system-provided configuration. If you "
+"decline this option, you will need to manage your system's authentication "
+"configuration by hand."
+msgstr ""
+
#. Type: error
#. Description
#: ../libpam-modules.templates:1001
diff --git a/debian/po/nl.po b/debian/po/nl.po
index 2e973256..7a4320ce 100644
--- a/debian/po/nl.po
+++ b/debian/po/nl.po
@@ -81,6 +81,72 @@ msgstr ""
"U dient deze diensten handmatig op te starten via het commando '/etc/init.d/"
"<dienst> start'."
+#. Type: multiselect
+#. Description
+#: ../libpam-runtime.templates:1001
+msgid "PAM profiles to enable:"
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../libpam-runtime.templates:1001
+msgid ""
+"Pluggable Authentication Modules (PAM) determine how authentication, "
+"authorization, and password changing are handled on the system, as well as "
+"allowing configuration of additional actions to take when starting user "
+"sessions."
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../libpam-runtime.templates:1001
+msgid ""
+"Some PAM module packages provide profiles that can be used to automatically "
+"adjust the behavior of all PAM-using applications on the system. Please "
+"indicate which of these behaviors you wish to enable."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "Incompatible PAM profiles selected."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "The following PAM profiles cannot be used together:"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "${conflicts}"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "Please select a different set of modules to enable."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../libpam-runtime.templates:3001
+msgid "Override local changes to /etc/pam.d/common-*?"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../libpam-runtime.templates:3001
+msgid ""
+"One or more of the files /etc/pam.d/common-{auth,account,password,session} "
+"have been locally modified. Please indicate whether these local changes "
+"should be overridden using the system-provided configuration. If you "
+"decline this option, you will need to manage your system's authentication "
+"configuration by hand."
+msgstr ""
+
#. Type: error
#. Description
#: ../libpam-modules.templates:1001
diff --git a/debian/po/pt.po b/debian/po/pt.po
index a4edf1ff..b31846d2 100644
--- a/debian/po/pt.po
+++ b/debian/po/pt.po
@@ -81,6 +81,72 @@ msgstr ""
"Você precisa de iniciar manualmente estes serviços fazendo '/etc/init.d/"
"<service> start'."
+#. Type: multiselect
+#. Description
+#: ../libpam-runtime.templates:1001
+msgid "PAM profiles to enable:"
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../libpam-runtime.templates:1001
+msgid ""
+"Pluggable Authentication Modules (PAM) determine how authentication, "
+"authorization, and password changing are handled on the system, as well as "
+"allowing configuration of additional actions to take when starting user "
+"sessions."
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../libpam-runtime.templates:1001
+msgid ""
+"Some PAM module packages provide profiles that can be used to automatically "
+"adjust the behavior of all PAM-using applications on the system. Please "
+"indicate which of these behaviors you wish to enable."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "Incompatible PAM profiles selected."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "The following PAM profiles cannot be used together:"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "${conflicts}"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "Please select a different set of modules to enable."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../libpam-runtime.templates:3001
+msgid "Override local changes to /etc/pam.d/common-*?"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../libpam-runtime.templates:3001
+msgid ""
+"One or more of the files /etc/pam.d/common-{auth,account,password,session} "
+"have been locally modified. Please indicate whether these local changes "
+"should be overridden using the system-provided configuration. If you "
+"decline this option, you will need to manage your system's authentication "
+"configuration by hand."
+msgstr ""
+
#. Type: error
#. Description
#: ../libpam-modules.templates:1001
diff --git a/debian/po/pt_BR.po b/debian/po/pt_BR.po
index 504c0390..2e53782d 100644
--- a/debian/po/pt_BR.po
+++ b/debian/po/pt_BR.po
@@ -82,6 +82,72 @@ msgid ""
msgstr ""
"Você deverá iniciá-los manualmente executando '/etc/init.d/<serviço> start'."
+#. Type: multiselect
+#. Description
+#: ../libpam-runtime.templates:1001
+msgid "PAM profiles to enable:"
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../libpam-runtime.templates:1001
+msgid ""
+"Pluggable Authentication Modules (PAM) determine how authentication, "
+"authorization, and password changing are handled on the system, as well as "
+"allowing configuration of additional actions to take when starting user "
+"sessions."
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../libpam-runtime.templates:1001
+msgid ""
+"Some PAM module packages provide profiles that can be used to automatically "
+"adjust the behavior of all PAM-using applications on the system. Please "
+"indicate which of these behaviors you wish to enable."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "Incompatible PAM profiles selected."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "The following PAM profiles cannot be used together:"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "${conflicts}"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "Please select a different set of modules to enable."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../libpam-runtime.templates:3001
+msgid "Override local changes to /etc/pam.d/common-*?"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../libpam-runtime.templates:3001
+msgid ""
+"One or more of the files /etc/pam.d/common-{auth,account,password,session} "
+"have been locally modified. Please indicate whether these local changes "
+"should be overridden using the system-provided configuration. If you "
+"decline this option, you will need to manage your system's authentication "
+"configuration by hand."
+msgstr ""
+
#. Type: error
#. Description
#: ../libpam-modules.templates:1001
diff --git a/debian/po/ro.po b/debian/po/ro.po
index 623dd965..de01ab2c 100644
--- a/debian/po/ro.po
+++ b/debian/po/ro.po
@@ -84,6 +84,72 @@ msgstr ""
"Trebuie să reporniți manual aceste servicii rulând „/etc/init.d/<serviciu> "
"start”"
+#. Type: multiselect
+#. Description
+#: ../libpam-runtime.templates:1001
+msgid "PAM profiles to enable:"
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../libpam-runtime.templates:1001
+msgid ""
+"Pluggable Authentication Modules (PAM) determine how authentication, "
+"authorization, and password changing are handled on the system, as well as "
+"allowing configuration of additional actions to take when starting user "
+"sessions."
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../libpam-runtime.templates:1001
+msgid ""
+"Some PAM module packages provide profiles that can be used to automatically "
+"adjust the behavior of all PAM-using applications on the system. Please "
+"indicate which of these behaviors you wish to enable."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "Incompatible PAM profiles selected."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "The following PAM profiles cannot be used together:"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "${conflicts}"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "Please select a different set of modules to enable."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../libpam-runtime.templates:3001
+msgid "Override local changes to /etc/pam.d/common-*?"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../libpam-runtime.templates:3001
+msgid ""
+"One or more of the files /etc/pam.d/common-{auth,account,password,session} "
+"have been locally modified. Please indicate whether these local changes "
+"should be overridden using the system-provided configuration. If you "
+"decline this option, you will need to manage your system's authentication "
+"configuration by hand."
+msgstr ""
+
#. Type: error
#. Description
#: ../libpam-modules.templates:1001
diff --git a/debian/po/ru.po b/debian/po/ru.po
index fe3e344b..70b69a56 100644
--- a/debian/po/ru.po
+++ b/debian/po/ru.po
@@ -81,6 +81,72 @@ msgid ""
"start'."
msgstr "Вам нужно запустить их вручную, выполнив '/etc/init.d/<служба> start'."
+#. Type: multiselect
+#. Description
+#: ../libpam-runtime.templates:1001
+msgid "PAM profiles to enable:"
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../libpam-runtime.templates:1001
+msgid ""
+"Pluggable Authentication Modules (PAM) determine how authentication, "
+"authorization, and password changing are handled on the system, as well as "
+"allowing configuration of additional actions to take when starting user "
+"sessions."
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../libpam-runtime.templates:1001
+msgid ""
+"Some PAM module packages provide profiles that can be used to automatically "
+"adjust the behavior of all PAM-using applications on the system. Please "
+"indicate which of these behaviors you wish to enable."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "Incompatible PAM profiles selected."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "The following PAM profiles cannot be used together:"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "${conflicts}"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "Please select a different set of modules to enable."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../libpam-runtime.templates:3001
+msgid "Override local changes to /etc/pam.d/common-*?"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../libpam-runtime.templates:3001
+msgid ""
+"One or more of the files /etc/pam.d/common-{auth,account,password,session} "
+"have been locally modified. Please indicate whether these local changes "
+"should be overridden using the system-provided configuration. If you "
+"decline this option, you will need to manage your system's authentication "
+"configuration by hand."
+msgstr ""
+
#. Type: error
#. Description
#: ../libpam-modules.templates:1001
diff --git a/debian/po/sk.po b/debian/po/sk.po
index d18e19a8..d1acc598 100644
--- a/debian/po/sk.po
+++ b/debian/po/sk.po
@@ -78,6 +78,72 @@ msgid ""
msgstr ""
"Budete ich musieť reštartovať ručne spustením „/etc/init.d/<service> start”."
+#. Type: multiselect
+#. Description
+#: ../libpam-runtime.templates:1001
+msgid "PAM profiles to enable:"
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../libpam-runtime.templates:1001
+msgid ""
+"Pluggable Authentication Modules (PAM) determine how authentication, "
+"authorization, and password changing are handled on the system, as well as "
+"allowing configuration of additional actions to take when starting user "
+"sessions."
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../libpam-runtime.templates:1001
+msgid ""
+"Some PAM module packages provide profiles that can be used to automatically "
+"adjust the behavior of all PAM-using applications on the system. Please "
+"indicate which of these behaviors you wish to enable."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "Incompatible PAM profiles selected."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "The following PAM profiles cannot be used together:"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "${conflicts}"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "Please select a different set of modules to enable."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../libpam-runtime.templates:3001
+msgid "Override local changes to /etc/pam.d/common-*?"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../libpam-runtime.templates:3001
+msgid ""
+"One or more of the files /etc/pam.d/common-{auth,account,password,session} "
+"have been locally modified. Please indicate whether these local changes "
+"should be overridden using the system-provided configuration. If you "
+"decline this option, you will need to manage your system's authentication "
+"configuration by hand."
+msgstr ""
+
#. Type: error
#. Description
#: ../libpam-modules.templates:1001
diff --git a/debian/po/sv.po b/debian/po/sv.po
index 7ed5fea1..d18616ce 100644
--- a/debian/po/sv.po
+++ b/debian/po/sv.po
@@ -79,6 +79,72 @@ msgstr ""
"Du behöver starta om dessa manuellt genom att köra \"/etc/init.d/<tjänst> "
"start\"."
+#. Type: multiselect
+#. Description
+#: ../libpam-runtime.templates:1001
+msgid "PAM profiles to enable:"
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../libpam-runtime.templates:1001
+msgid ""
+"Pluggable Authentication Modules (PAM) determine how authentication, "
+"authorization, and password changing are handled on the system, as well as "
+"allowing configuration of additional actions to take when starting user "
+"sessions."
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../libpam-runtime.templates:1001
+msgid ""
+"Some PAM module packages provide profiles that can be used to automatically "
+"adjust the behavior of all PAM-using applications on the system. Please "
+"indicate which of these behaviors you wish to enable."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "Incompatible PAM profiles selected."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "The following PAM profiles cannot be used together:"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "${conflicts}"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "Please select a different set of modules to enable."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../libpam-runtime.templates:3001
+msgid "Override local changes to /etc/pam.d/common-*?"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../libpam-runtime.templates:3001
+msgid ""
+"One or more of the files /etc/pam.d/common-{auth,account,password,session} "
+"have been locally modified. Please indicate whether these local changes "
+"should be overridden using the system-provided configuration. If you "
+"decline this option, you will need to manage your system's authentication "
+"configuration by hand."
+msgstr ""
+
#. Type: error
#. Description
#: ../libpam-modules.templates:1001
diff --git a/debian/po/templates.pot b/debian/po/templates.pot
index bd39ab78..a4a5c9ca 100644
--- a/debian/po/templates.pot
+++ b/debian/po/templates.pot
@@ -69,6 +69,72 @@ msgid ""
"start'."
msgstr ""
+#. Type: multiselect
+#. Description
+#: ../libpam-runtime.templates:1001
+msgid "PAM profiles to enable:"
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../libpam-runtime.templates:1001
+msgid ""
+"Pluggable Authentication Modules (PAM) determine how authentication, "
+"authorization, and password changing are handled on the system, as well as "
+"allowing configuration of additional actions to take when starting user "
+"sessions."
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../libpam-runtime.templates:1001
+msgid ""
+"Some PAM module packages provide profiles that can be used to automatically "
+"adjust the behavior of all PAM-using applications on the system. Please "
+"indicate which of these behaviors you wish to enable."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "Incompatible PAM profiles selected."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "The following PAM profiles cannot be used together:"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "${conflicts}"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "Please select a different set of modules to enable."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../libpam-runtime.templates:3001
+msgid "Override local changes to /etc/pam.d/common-*?"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../libpam-runtime.templates:3001
+msgid ""
+"One or more of the files /etc/pam.d/common-{auth,account,password,session} "
+"have been locally modified. Please indicate whether these local changes "
+"should be overridden using the system-provided configuration. If you "
+"decline this option, you will need to manage your system's authentication "
+"configuration by hand."
+msgstr ""
+
#. Type: error
#. Description
#: ../libpam-modules.templates:1001
diff --git a/debian/po/tr.po b/debian/po/tr.po
index 0027cacc..de95af3a 100644
--- a/debian/po/tr.po
+++ b/debian/po/tr.po
@@ -83,6 +83,72 @@ msgstr ""
"Bu hizmetleri '/etc/init.d/<hizmet> start' komutunu kullanarak elinizle "
"başlatmanız gerekecek."
+#. Type: multiselect
+#. Description
+#: ../libpam-runtime.templates:1001
+msgid "PAM profiles to enable:"
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../libpam-runtime.templates:1001
+msgid ""
+"Pluggable Authentication Modules (PAM) determine how authentication, "
+"authorization, and password changing are handled on the system, as well as "
+"allowing configuration of additional actions to take when starting user "
+"sessions."
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../libpam-runtime.templates:1001
+msgid ""
+"Some PAM module packages provide profiles that can be used to automatically "
+"adjust the behavior of all PAM-using applications on the system. Please "
+"indicate which of these behaviors you wish to enable."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "Incompatible PAM profiles selected."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "The following PAM profiles cannot be used together:"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "${conflicts}"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "Please select a different set of modules to enable."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../libpam-runtime.templates:3001
+msgid "Override local changes to /etc/pam.d/common-*?"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../libpam-runtime.templates:3001
+msgid ""
+"One or more of the files /etc/pam.d/common-{auth,account,password,session} "
+"have been locally modified. Please indicate whether these local changes "
+"should be overridden using the system-provided configuration. If you "
+"decline this option, you will need to manage your system's authentication "
+"configuration by hand."
+msgstr ""
+
#. Type: error
#. Description
#: ../libpam-modules.templates:1001
diff --git a/debian/po/vi.po b/debian/po/vi.po
index d8bafd23..4dddd25b 100644
--- a/debian/po/vi.po
+++ b/debian/po/vi.po
@@ -81,6 +81,72 @@ msgstr ""
"Bạn cần phải tự khởi chạy lại chúng bằng cách chạy câu lệnh « /etc/init.d/"
"<tên_dịch_vụ> start »."
+#. Type: multiselect
+#. Description
+#: ../libpam-runtime.templates:1001
+msgid "PAM profiles to enable:"
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../libpam-runtime.templates:1001
+msgid ""
+"Pluggable Authentication Modules (PAM) determine how authentication, "
+"authorization, and password changing are handled on the system, as well as "
+"allowing configuration of additional actions to take when starting user "
+"sessions."
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../libpam-runtime.templates:1001
+msgid ""
+"Some PAM module packages provide profiles that can be used to automatically "
+"adjust the behavior of all PAM-using applications on the system. Please "
+"indicate which of these behaviors you wish to enable."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "Incompatible PAM profiles selected."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "The following PAM profiles cannot be used together:"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "${conflicts}"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "Please select a different set of modules to enable."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../libpam-runtime.templates:3001
+msgid "Override local changes to /etc/pam.d/common-*?"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../libpam-runtime.templates:3001
+msgid ""
+"One or more of the files /etc/pam.d/common-{auth,account,password,session} "
+"have been locally modified. Please indicate whether these local changes "
+"should be overridden using the system-provided configuration. If you "
+"decline this option, you will need to manage your system's authentication "
+"configuration by hand."
+msgstr ""
+
#. Type: error
#. Description
#: ../libpam-modules.templates:1001
diff --git a/debian/po/zh_CN.po b/debian/po/zh_CN.po
index c5d00a22..46fad3e8 100644
--- a/debian/po/zh_CN.po
+++ b/debian/po/zh_CN.po
@@ -80,6 +80,72 @@ msgid ""
"start'."
msgstr "您需要运行“/etc/init.d/<服务> start”来手动启动这些服务。"
+#. Type: multiselect
+#. Description
+#: ../libpam-runtime.templates:1001
+msgid "PAM profiles to enable:"
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../libpam-runtime.templates:1001
+msgid ""
+"Pluggable Authentication Modules (PAM) determine how authentication, "
+"authorization, and password changing are handled on the system, as well as "
+"allowing configuration of additional actions to take when starting user "
+"sessions."
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../libpam-runtime.templates:1001
+msgid ""
+"Some PAM module packages provide profiles that can be used to automatically "
+"adjust the behavior of all PAM-using applications on the system. Please "
+"indicate which of these behaviors you wish to enable."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "Incompatible PAM profiles selected."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "The following PAM profiles cannot be used together:"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "${conflicts}"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libpam-runtime.templates:2001
+msgid "Please select a different set of modules to enable."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../libpam-runtime.templates:3001
+msgid "Override local changes to /etc/pam.d/common-*?"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../libpam-runtime.templates:3001
+msgid ""
+"One or more of the files /etc/pam.d/common-{auth,account,password,session} "
+"have been locally modified. Please indicate whether these local changes "
+"should be overridden using the system-provided configuration. If you "
+"decline this option, you will need to manage your system's authentication "
+"configuration by hand."
+msgstr ""
+
#. Type: error
#. Description
#: ../libpam-modules.templates:1001
diff --git a/debian/rules b/debian/rules
index edac90c2..4ea85b83 100755
--- a/debian/rules
+++ b/debian/rules
@@ -96,6 +96,7 @@ binary-indep: install
dh_installman -i
dh_installdocs -i
+ dh_installdebconf -i
dh_installchangelogs -i $(BUILD_TREE)/ChangeLog
dh_compress -i -X.html
dh_link -i
@@ -113,6 +114,8 @@ binary-arch: install
mv debian/tmp/lib/*.a debian/tmp/usr/lib
dh_movefiles -plibpam0g-dev -plibpam-cracklib -plibpam0g
dh_movefiles -plibpam-modules `cd $(d)/tmp && ls lib/security/*.so`
+ mkdir -p debian/libpam-cracklib/usr/share/pam-configs
+ $(i) $(d)/pam-configs/cracklib debian/libpam-cracklib/usr/share/pam-configs/cracklib
dh_link -a
dh_installman -a
rm -rf $(d)/libpam-modules/usr/share/man/man7
@@ -128,7 +131,7 @@ binary-arch: install
dh_installcron -a
dh_installchangelogs -a $(BUILD_TREE)/ChangeLog
- for pkg in libpam0g libpam-modules; do \
+ for pkg in libpam0g libpam-modules libpam-runtime; do \
install -m 0644 -D $(d)/$$pkg.lintian $(d)/$$pkg/usr/share/lintian/overrides/$$pkg || exit; \
done