summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAge
* pam_unix: Use bcrypt b-variant for computing new hashes.Björn Esser2018-11-16
| | | | | | | | | | | | | | | Bcrypt hashes used the "$2a$" prefix since 1997. However, in 2011 an implementation bug was discovered in bcrypt affecting the handling of characters in passphrases with the 8th bit set. Besides fixing the bug, OpenBSD 5.5 introduced the "$2b$" prefix for a behavior that exactly matches crypt_blowfish's "$2y$", and the crypt_blowfish implementation supports it as well since v1.1. That said new computed bcrypt hashes should use the "$2b$" prefix. * modules/pam_unix/passverify.c: Use bcrypt b-variant.
* pam_tally, pam_tally2: fix grammar and spelling (#54)Dmitry V. Levin2018-06-22
| | | | | | | | | | * modules/pam_tally/pam_tally.c (tally_check): Replace "Account is temporary locked" with "The account is temporarily locked" in translated messages. * modules/pam_tally2/pam_tally2.c (tally_check): Likewise. * po/Linux-PAM.pot: Update pam_tally and pam_tally2 messages. Closes: https://github.com/linux-pam/linux-pam/issues/54
* Fix grammar of messages printed via pam_promptDmitry V. Levin2018-06-19
| | | | | | | | | | | | | | | | | | | | | | | | | Turn into proper sentences those messages that are printed without further modifications using pam_prompt in contexts where proper sentences are expected. * libpam/pam_get_authtok.c (pam_get_authtok_internal): Fix grammar of the message passed to pam_error. * modules/pam_limits/pam_limits.c (pam_sm_open_session): Likewise. * modules/pam_cracklib/pam_cracklib.c (_pam_unix_approve_pass): Fix grammar of error messages passed to pam_error. * modules/pam_mail/pam_mail.c (report_mail): Fix grammar of a message passed to pam_info. * modules/pam_timestamp/pam_timestamp.c (verbose_success): Likewise. * modules/pam_selinux/pam_selinux.c (config_context, send_text): Fix grammar of messages passed to pam_prompt. * modules/pam_tally/pam_tally.c (tally_check): Fix grammar of messages passed to pam_info. * modules/pam_tally2/pam_tally2.c (tally_check): Likewise. * modules/pam_unix/pam_unix_acct.c (pam_sm_acct_mgmt): Fix grammar of messages passed to _make_remark. * modules/pam_unix/pam_unix_passwd.c (_pam_unix_approve_pass, pam_sm_chauthtok): Likewise. * po/Linux-PAM.pot: Regenerate.
* pam_stress: do not mark messages for translationDmitry V. Levin2018-06-19
| | | | | | | | | | pam_stress is not a regular module that needs to be translated. Besides that, its messages are not easy to understand and even harder to translate properly. * modules/pam_stress/pam_stress.c (pam_sm_chauthtok): Do not mark messages for translation. * po/Linux-PAM.pot: Remove pam_stress messages.
* pam_unix: remove obsolete _UNIX_AUTHTOK, _UNIX_OLD_AUTHTOK, and ↵Dmitry V. Levin2018-05-31
| | | | | | | | | | | | | | _UNIX_NEW_AUTHTOK macros The last use of these macros was removed by commit Linux-PAM-1.3.0~5 so their definitions should go as well. * modules/pam_unix/pam_unix_auth.c (_UNIX_AUTHTOK): Remove. * modules/pam_unix/pam_unix_passwd.c (_UNIX_OLD_AUTHTOK, _UNIX_NEW_AUTHTOK): Likewise. Complements: 7e09188c5dc4 ("pam_unix: Use pam_get_authtok() instead of direct pam_prompt() calls.")
* pam_unix: remove obsolete _unix_read_password prototypeDmitry V. Levin2018-05-31
| | | | | | | | | | The function was removed by commit Linux-PAM-1.3.0~5 so the function prototype should go as well. * modules/pam_unix/support.h (_unix_read_password): Remove. Complements: 7e09188c5dc4 ("pam_unix: Use pam_get_authtok() instead of direct pam_prompt() calls.")
* Release version 1.3.1Thorsten Kukuk2018-05-18
|
* Add xz compressionThorsten Kukuk2018-05-18
|
* pam_motd: add support for a motd.d directory (#48)Allison Karlitskaya2018-05-16
| | | | | | | | | | | | | | | Add a new feature to pam_motd to allow packages to install their own message files in a "motd.d" directory, to be displayed after the primary motd. Add an option motd_d= to specify the location of this directory. Modify the defaults, in the case where no options are given, to display both /etc/motd and /etc/motd.d. Fixes #47 * modules/pam_motd/pam_motd.c: add support for motd.d * modules/pam_motd/pam_motd.8.xml: update the manpage
* pam_umask: Fix documentation to align with order of loading umaskTomas Mraz2018-05-02
| | | | | * modules/pam_umask/pam_umask.8.xml: Document the real order of loading umask.
* Fix missing word in documentation.Joey Chagnon2018-04-10
| | | * doc/man/pam_get_user.3.xml: Fix it.
* pam_tally2 --reset: avoid creating a missing tallylog fileDmitry V. Levin2017-11-10
| | | | | | | | | | | | | | | | There is no need for pam_tally2 in --reset=0 mode to create a missing tallylog file because its absence has the same meaning as its existence with the appropriate entry reset. This was not a big deal until useradd(8) from shadow suite release 4.5 started to invoke /sbin/pam_tally2 --reset routinely regardless of PAM configuration. The positive effect of this change is noticeable when using tools like cpio(1) that cannot archive huge sparse files efficiently. * modules/pam_tally2/pam_tally2.c [MAIN] (main) <cline_user>: Stat cline_filename when cline_reset == 0, exit early if the file is missing.
* pam_mkhomedir: Allow creating parent of homedir under /Tomas Mraz2017-11-10
| | | | | * modules/pam_mkhomedir/mkhomedir_helper.c (make_parent_dirs): Do not skip creating the directory if we are under /.
* pam_tty_audit: Fix regression introduced by adding the uid range support.Tomas Mraz2017-10-09
| | | | | | | * modules/pam_tty_audit/pam_tty_audit.c (parse_uid_range): Fix constification and remove unneeded code carried from pam_limits. (pam_sm_open_session): When multiple enable/disable options are present do not stop after first match.
* pam_access: Add note about spaces around ':' in access.conf(5)Tomas Mraz2017-09-06
| | | | * modules/pam_access/access.conf.5.xml: Add note about spaces around ':'
* Workaround formatting problem in pam(8)Tomas Mraz2017-09-06
| | | | * doc/man/pam.8.xml: Workaround formatting problem.
* pam_unix: Check return value of malloc used for setcred data (#24)Peter Urbanec2017-07-12
| | | | | | | | Check the return value of malloc and if it failed print debug info, send a syslog message and return an error code. The test in AUTH_RETURN for ret_data not being NULL becomes redundant. Signed-off-by: Peter Urbanec <git.user@urbanec.net>
* pam_cracklib: Drop unused prompt macros.Tomas Mraz2017-07-10
| | | | * modules/pam_cracklib/pam_cracklib.c: Drop the unused macros.
* pam_tty_audit: Support matching users by uid range.Tomas Mraz2017-06-28
| | | | | | | * modules/pam_tty_audit/pam_tty_audit.c (parse_uid_range): New function to parse the uid range. (pam_sm_open_session): Call parse_uid_range() and behave according to its result. * modules/pam_tty_audit/pam_tty_audit.8.xml: Document the uid range matching.
* pam_access: support parsing files in /etc/security/access.d/*.confTomas Mraz2017-05-31
| | | | | | | | | * modules/pam_access/pam_access.c (login_access): Return NOMATCH if there was no match in the parsed file. (pam_sm_authenticate): Add glob() call to go through the ACCESS_CONF_GLOB subdirectory and call login_access() on the individual files matched. * modules/pam_access/pam_access.8.xml: Document the addition. * modules/pam_access/Makefile.am: Add ACCESS_CONF_GLOB definition.
* pam_localuser: Correct the example in documentation.Tomas Mraz2017-04-11
| | | | | * modules/pam_localuser/pam_localuser.8.xml: The example configuration does something different.
* pam_localuser: Correct documentation of return value.Tomas Mraz2017-04-11
| | | | | * modules/pam_localuser/pam_localuser.8.xml: The module returns PAM_PERM_DENIED when the user is not listed.
* Make maxclassrepeat=1 behavior consistent with docs (#9)Saul Johnson2017-03-10
| | | * modules/pam_cracklib/pam_cracklib.c (simple): Apply the maxclassrepeat when greater than 0.
* Properly test for strtol() failure to find any digits.Josef Moellers2017-02-09
| | | | | * modules/pam_access/pam_access.c (network_netmask_match): Test for endptr set to beginning and not NULL.
* pam_exec: fix a potential null pointer dereferenceDaniel Abrecht2017-01-19
| | | | | | | | | | Fix a null pointer dereference when pam_prompt returns PAM_SUCCESS but the response is set to NULL. * modules/pam_exec/pam_exec.c (call_exec): Do not invoke strndupa with a null pointer. Closes: https://github.com/linux-pam/linux-pam/pull/2
* Add missing comma in the limits.conf.5 manpage.Antonio Ospite2016-12-07
| | | | * modules/pam_limits/limits.conf.5.xml: add a missing comma
* Regular links doesn't work with -no-numbering -no-references.Tomas Mraz2016-11-14
| | | | * configure.ac: Use elinks instead of links.
* pam_access: First check for the (group) match.Tomas Mraz2016-11-01
| | | | | | | The (group) match is performed first to allow for groups containing '@'. * modules/pam_access/pam_access.c (user_match): First check for the (group) match.
* pam_ftp: Properly use the first name from the supplied listTomas Mraz2016-10-17
| | | | | | * modules/pam_ftp/pam_ftp.c (lookup): Return first user from the list of anonymous users if user name matches. (pam_sm_authenticate): Free the returned value allocated in lookup().
* pam_issue: Fix no prompting in parse escape codes mode.Bartos-Elekes Zsolt2016-09-12
| | | | * modules/pam_issue/pam_issue.c (read_issue_quoted): Fix misplaced strcat().
* xtests: remove bash dependencyMaxin B. John2016-06-30
| | | | | | | | There are no bash specific syntax in the xtest scripts. So, remove the bash dependency. Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Maxin B. John <maxin.john@intel.com>
* Unification and cleanup of syslog log levels.Tomas Mraz2016-06-30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * libpam/pam_handlers.c: Make memory allocation failures LOG_CRIT. * libpam/pam_modutil_priv.c: Make memory allocation failures LOG_CRIT. * modules/pam_echo/pam_echo.c: Make memory allocation failures LOG_CRIT. * modules/pam_env/pam_env.c: Make memory allocation failures LOG_CRIT. * modules/pam_exec/pam_exec.c: Make memory allocation failures LOG_CRIT. * modules/pam_filter/pam_filter.c: Make all non-memory call errors LOG_ERR. * modules/pam_group/pam_group.c: Make memory allocation failures LOG_CRIT. * modules/pam_issue/pam_issue.c: Make memory allocation failures LOG_CRIT. * modules/pam_lastlog/pam_lastlog.c: The lastlog file creation is syslogged with LOG_NOTICE, memory allocation errors with LOG_CRIT, other errors with LOG_ERR. * modules/pam_limits/pam_limits.c: User login limit messages are syslogged with LOG_NOTICE, stale utmp entry with LOG_INFO, non-memory errors with LOG_ERR. * modules/pam_listfile/pam_listfile.c: Rejection of user is syslogged with LOG_NOTICE. * modules/pam_namespace/pam_namespace.c: Make memory allocation failures LOG_CRIT. * modules/pam_nologin/pam_nologin.c: Make memory allocation failures LOG_CRIT, other errors LOG_ERR. * modules/pam_securetty/pam_securetty.c: Rejection of access is syslogged with LOG_NOTICE, non-memory errors with LOG_ERR. * modules/pam_selinux/pam_selinux.c: Make memory allocation failures LOG_CRIT. * modules/pam_succeed_if/pam_succeed_if.c: Make all non-memory call errors LOG_ERR. * modules/pam_time/pam_time.c: Make memory allocation failures LOG_CRIT. * modules/pam_timestamp/pam_timestamp.c: Make memory allocation failures LOG_CRIT. * modules/pam_unix/pam_unix_acct.c: Make all non-memory call errors LOG_ERR. * modules/pam_unix/pam_unix_passwd.c: Make memory allocation failures LOG_CRIT, other errors LOG_ERR. * modules/pam_unix/pam_unix_sess.c: Make all non-memory call errors LOG_ERR. * modules/pam_unix/passverify.c: Unknown user is syslogged with LOG_NOTICE. * modules/pam_unix/support.c: Unknown user is syslogged with LOG_NOTICE and max retries ignorance by application likewise. * modules/pam_unix/unix_chkpwd.c: Make all non-memory call errors LOG_ERR. * modules/pam_userdb/pam_userdb.c: Password authentication error is syslogged with LOG_NOTICE. * modules/pam_xauth/pam_xauth.c: Make memory allocation failures LOG_CRIT.
* pam_timestamp: fix typo in strncmp usageDmitry V. Levin2016-06-14
| | | | | | | | | | | | Before this fix, a typo in check_login_time resulted to ruser and struct utmp.ut_user being compared by the first character only, which in turn could lead to a too low timestamp value being assigned to oldest_login, effectively causing bypass of check_login_time. * modules/pam_timestamp/pam_timestamp.c (check_login_time): Fix typo in strncmp usage. Patch-by: Anton V. Boyarshinov <boyarsh@altlinux.org>
* Correct the examples in pam_fail_delay(3) man page.Tomas Mraz2016-05-30
| | | | doc/man/pam_fail_delay.3.xml: Correct the examples.
* Remove spaces in examples for access.conf.Tomas Mraz2016-05-11
| | | | | | | | The spaces are ignored only with the default listsep. To remove confusion if non-default listsep is used they are removed from the examples. * modules/pam_access/access.conf: Remove all spaces around ':' in examples. * modules/pam_access/access.conf.5.xml: Likewise.
* build: avoid non-portable == with "test" (ticket #60)Mike Frysinger2016-05-05
| | | | | | | POSIX says test only accepts =. Some shells (including bash) accept ==, but we should still stick to = for portability. * configure.ac: Replace == with = in "test" invocations.
* Release version 1.3.0Thorsten Kukuk2016-04-28
| | | | | | * NEWS: add changes for 1.3.0. * configure.ac: bump version number. * libpam/Makefile.am: bump revision of libpam.so version.
* Updated translations from Zanata.Tomas Mraz2016-04-28
| | | | * po/*.po: Updated translations from Zanata.
* pam_wheel: Correct the documentation of the root_only option.Tomas Mraz2016-04-19
| | | | | * modules/pam_wheel/pam_wheel.8.xml: Correct the documentation of the root_only option.
* pam_unix: Document that MD5 password hash is used to store old passwords.Tomas Mraz2016-04-19
| | | | | modules/pam_unix/pam_unix.8.xml: Document that the MD5 password hash is used to store the old passwords when remember option is set.
* Project registered at Zanata (fedora.zanata.org) for translations.Tomas Mraz2016-04-14
| | | | | | | * zanata.xml: Configuration file for zanata client. * po/LINGUAS: Update languages as supported by Zanata. * po/Linux-PAM.pot: Updated from sources. * po/*.po: Updated from sources.
* pam_unix: Use pam_get_authtok() instead of direct pam_prompt() calls.Tomas Mraz2016-04-06
| | | | | | | | | | | | | | | | We have to drop support for not_set_pass option which is not much useful anyway. Instead we get proper support for authtok_type option. * modules/pam_unix/pam_unix.8.xml: Removed not_set_pass option, added authtok_ty pe option. * modules/pam_unix/pam_unix_auth.c (pam_sm_authenticate): Replace _unix_read_pas sword() call with equivalent pam_get_authtok() call. * modules/pam_unix/pam_unix_passwd.c (pam_sm_chauthtok): Likewise and also drop support for not_set_pass. * modules/pam_unix/support.c (_unix_read_password): Remove. * modules/pam_unix/support.h: Remove UNIX_NOT_SET_PASS add UNIX_AUTHTOK_TYPE.
* pam_get_authtok(): Add authtok_type support to current password prompt.Tomas Mraz2016-04-06
| | | | | | * libpam/pam_get_authtok.c (pam_get_authtok_internal): When changing password, use different prompt for current password allowing for authtok_type to be displayed to the user.
* pam_unix: Make password expiration messages more user-friendly.Tomas Mraz2016-04-04
| | | | | * modules/pam_unix/pam_unix_acct.c (pam_sm_acct_mgmt): Make password expiration messages more user-friendly.
* innetgr may not be there so make sure that when innetgr is not presentThorsten Kukuk2016-04-04
| | | | | | | | | | | then we inform about it and not use it. [ticket#46] * modules/pam_group/pam_group.c: ditto * modules/pam_succeed_if/pam_succeed_if.c: ditto * modules/pam_time/pam_time.c: ditto Signed-off-by: Khem Raj <raj.khem at gmail.com> Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
* build: fix build when crypt() is not part of crypt_libs [ticket#46]Thorsten Kukuk2016-04-04
| | | | | | * configure.ac: Don't set empty -l option in crypt check Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
* build: use $host_cpu for lib64 directory handling [ticket#46]Thorsten Kukuk2016-04-04
| | | | | | * configure.ac: use $host_cpu for lib64 directory handling. Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
* Fix whitespace issuesDmitry V. Levin2016-04-01
| | | | | | | | | | | | | | | | Remove blank lines at EOF introduced by commit a684595c0bbd88df71285f43fb27630e3829121e, making the project free of warnings reported by git diff --check 4b825dc642cb6eb9a060e54bf8d69288fbee4904 HEAD * libpam/pam_dynamic.c: Remove blank line at EOF. * modules/pam_echo/pam_echo.c: Likewise. * modules/pam_keyinit/pam_keyinit.c: Likewise. * modules/pam_mkhomedir/pam_mkhomedir.c: Likewise. * modules/pam_pwhistory/pam_pwhistory.c: Likewise. * modules/pam_rhosts/pam_rhosts.c: Likewise. * modules/pam_sepermit/pam_sepermit.c: Likewise. * modules/pam_stress/pam_stress.c: Likewise.
* Use TI-RPC functions if we compile and link against libtirpc.Thorsten Kukuk2016-04-01
| | | | | | | | The old SunRPC functions don't work with IPv6. * configure.ac: Set and restore CPPFLAGS * modules/pam_unix/pam_unix_passwd.c: Replace getrpcport with rpcb_getaddr if available.
* PAM_EXTERN isn't needed anymore, but don't remove it to not break lot ofThorsten Kukuk2016-03-29
| | | | | | external code using it. * libpam/include/security/pam_modules.h: Readd PAM_EXTERN for compatibility
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-02 08:52:16 +0000