summaryrefslogtreecommitdiff
path: root/modules
Commit message (Collapse)AuthorAge
* Trim password at PAM_MAX_RESP_SIZE charsFlorian Best2019-06-27
| | | | | | | Issue #118: Protect against Denial of Service attacks. To prevent hashsum generation via crypt of very long passwords the password is now stripped to 512 characters. This is equivalent behavior to unix_chkpwd.
* pam_succeed_if: Request user data only when neededOlaf Mandel2019-05-23
| | | | | | | | | | | | | | | | | Allow for conditions that just check the user field to also work for users not known to the system. Before this caused a PAM_USER_UNKNOWN even if no extra data for an existing user was needed. E.g. auth sufficient pam_succeed_if.so user = NotKnownToSystem modules/pam_succeed_if/pam_succeed_if.c (evaluate): Change the pwd parameter to an input/output parameter. Lazily request pwd with pam_modutil_getpwnam() if needed and return PAM_USER_UNKNOWN on failure. modules/pam_succeed_if/pam_succeed_if.c (pam_sm_authenticate): Don't request the pwd if !use_uid anymore and shift the output from audit to after the evaluate() call. Also make sure not to give the normal failure message if the lazy pwd loading failed.
* pam_tally2: Remove unnecessary fsync()Maciej S. Szmigiero2019-02-26
| | | | | | | | | | | | | | | pam_tally2 does fsync() after writing to a tally file. This causes hard drive cache flushes on every failed SSH login on many (if not most) filesystems. And an internet-exposed machine can have a lot of these failed logins. This operation however doesn't seem to be necessary - the pam_tally2 module does not do any operation which would need explicit post-crash ordering, it just does simple file reads and writes. And doing a fsync() after them doesn't close any race if the system happens to crash between a write being posted and its fsync() completion. Let's remove this operation to get rid of all these extra cache flushes.
* Fixed a grammer mistakevkwitshana2019-02-19
|
* Fix documentation for pam_wheelChristopher Head2019-01-10
| | | | | | | | By default, pam_wheel checks for applicant membership in the wheel group for *all* access requests, regardless of whether the target user is root or non-root. Only if root_only is provided does it limit the membership check to cases when the target user is root. Update the documentation to reflect this.
* pam_lastlog: Improve silent option documentationNir Soffer2019-01-10
| | | | | | | The silent option explicitly silents only the last login message and not bad logins. Add a note to the manual to make this clear. * modules/pam_lastlog/pam_lastlog.8.xml: Clearify "silent showfailed"
* pam_lastlog: Respect PAM_SILENT flagNir Soffer2019-01-10
| | | | | | | | | | | | | | | | pam_lastlog module will not log info about failed login if the session was opened with PAM_SILENT flag. Example use case enabled by this change: sudo --non-interactive program If this command is run by another program expecting specific output from the command run by sudo, the unexpected info about failed logins will break this program. * modules/pam_lastlog/pam_lastlog.c: Respect silent option. (_pam_session_parse): Unset LASTLOG_BTMP if PAM_SILENT is set.
* Fix regressions from the last commits.Tomas Mraz2019-01-04
| | | | | | * configure.ac: Test for logwtmp needs -lutil in LIBS. * modules/Makefile.am: Fix indentation of variable assignments causing creation of incorrect Makefile.
* Replace strndupa with strncpyRosen Penev2019-01-04
| | | | | | glibc only. A static string is better. Signed-off-by: Rosen Penev <rosenp@gmail.com>
* build: ignore pam_lastlog when logwtmp is not available.Yousong Zhou2019-01-04
| | | | | | | * configure.ac: check logwtmp and set COND_BUILD_PAM_LASTLOG * modules/pam_lastlog/Makefile.am: check COND_BUILD_PAM_LASTLOG Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
* build: ignore pam_rhosts if neither ruserok nor ruserok_af is available.Yousong Zhou2019-01-04
| | | | | | | | * configure.ac: check for ruserok and ruserok_af * modules/Makefile.am: ignore pam_rhosts/ if it's disabled * modules/pam_rhosts/pam_rhosts.c: include stdlib.h for malloc and free Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
* pam_motd: Cleanup the code and avoid unnecessary loggingTomas Mraz2018-12-20
| | | | | | | | | | | | | | | | | | | The pam_motd module will not log if the default motd.d directories are missing. Also cleanup some code cleanliness issues and fix compilation warnings. * modules/pam_motd/pam_motd.c: Constification of constant strings. (try_to_display_directory): Removed unused function. (pam_split_string): Replace uint with unsigned int. Fix warnings. (compare_strings): Fix warnings by proper constification. (try_to_display_directories_with_overrides): Cleanups. Switch off the logging if the motd.d directories are missing and they are default ones. (pam_sm_open_session): Cleanup warnings. Pass the information to try_to_display_directories_with_overrides() that non-default motd options are used.
* pam_lastlog: Limit lastlog file use by LASTLOG_UID_MAX option in login.defs.Tomas Mraz2018-12-20
| | | | | | | | * modules/pam_lastlog/pam_lastlog.8.xml: Add the documentation of the LASTLOG_UID_MAX option. * modules/pam_lastlog/pam_lastlog.c: New function get_lastlog_uid_max(). (last_login_date): Check the uid against the get_lastlog_uid_max(). (pam_authenticate): Likewise.
* Move the duplicated search_key function to pam_modutil.Tomas Mraz2018-12-11
| | | | | | | | | | | * libpam/pam_modutil_searchkey.c: New source file with pam_modutil_search_key(). * libpam/Makefile.am: Add the pam_modutil_searchkey.c. * libpam/include/security/pam_modutil.h: Add the pam_modutil_search_key() prototype. * libpam/libpam.map: Add the pam_modutil_search_key() into a new version. * modules/pam_faildelay/pam_faildelay.c: Drop search_key() and use pam_modutil_search_key(). * modules/pam_umask/pam_umask.c: Likewise. * modules/pam_unix/support.c: Likewise.
* pam_unix: Use pam_syslog instead of helper_log_err.Tomas Mraz2018-11-27
| | | | | | | | * modules/pam_unix/passverify.c (verify_pwd_hash): Add pamh argument via PAMH_ARG_DECL. Call pam_syslog() instead of helper_log_err(). * modules/pam_unix/passverify.h: Adjust the declaration of verify_pwd_hash(). * modules/pam_unix/support.c (_unix_verify_password): Add the pamh argument to verify_pwd_hash() call.
* pam_unix: Report unusable hashes found by checksalt to syslog.Björn Esser2018-11-27
| | | | | | | | | | | | | | | | | | | libxcrypt can be build-time configured to support (or not support) various hashing methods. Future versions will also have support for runtime configuration by the system's vendor and/or administrator. For that reason adminstrator should be notified by pam if users cannot log into their account anymore because of such a change in the system's configuration of libxcrypt. Also check for malformed hashes, like descrypt hashes starting with "$2...", which might have been generated by unsafe base64 encoding functions as used in glibc <= 2.16. Such hashes are likely to be rejected by many recent implementations of libcrypt. * modules/pam_unix/passverify.c (verify_pwd_hash): Report unusable hashes found by checksalt to syslog.
* Revert "pam_unix: Add crypt_default method, if supported."Tomas Mraz2018-11-27
| | | | This reverts commit ad435b386b22b456724dc5c5b8d9f2d1beffc558.
* pam_unix: Add crypt_default method, if supported.Björn Esser2018-11-27
| | | | | | | | | | | | libxcrypt since v4.4.0 supports a default method for its gensalt function on most system configurations. As the default method is to be considered the strongest available hash method, it should be preferred over all other hash methods supported by pam. * modules/pam_unix/pam_unix.8.xml: Documentation for crypt_default. * modules/pam_unix/passverify.c: Add crypt_default method. * modules/pam_unix/support.h: Likewise.
* Revert part of the commit 4da9febcTomas Mraz2018-11-26
| | | | | | | | | pam_unix: Do not return a hard failure on invalid or disabled salt as in some cases the failure actually is not interesting and can broke things such as password-less sudo. * modules/pam_unix/passverify.c (check_shadow_expiry): Revert checking of disabled or invalid salt.
* pam_unix: Add support for (gost-)yescrypt hashing methods.Björn Esser2018-11-23
| | | | | | | | | | | | | | | libxcrypt (v4.2 and later) has added support for the yescrypt hashing method; gost-yescrypt has been added in v4.3. * modules/pam_unix/pam_unix.8.xml: Documentation for (gost-)yescrypt. * modules/pam_unix/pam_unix_acct.c: Use 64 bit type for control flags. * modules/pam_unix/pam_unix_auth.c: Likewise. * modules/pam_unix/pam_unix_passwd.c: Likewise. * modules/pam_unix/pam_unix_sess.c: Likewise. * modules/pam_unix/passverify.c: Add support for (gost-)yescrypt. * modules/pam_unix/passverify.h: Use 64 bit type for control flags. * modules/pam_unix/support.c: Set sane rounds for (gost-)yescrypt. * modules/pam_unix/support.h: Add support for (gost-)yescrypt.
* pam_unix: Fix closing curly brace. (#77)Björn Esser2018-11-22
| | | | | | | | This has been overlooked during review of commit dce80b3f11b3. * modules/pam_unix/support.c (_set_ctrl): Fix closing curly brace. Closes: https://github.com/linux-pam/linux-pam/issues/77
* pam_unix: Add support for crypt_checksalt, if libcrypt supports it.Björn Esser2018-11-22
| | | | | | | | | | | | | | | libxcrypt v4.3 has added the crypt_checksalt function to whether the prefix at the begining of a given hash string refers to a supported hashing method. Future revisions of this function will add support to check whether the hashing method, the prefix refers to, was disabled or considered deprecated by the system's factory presets or system administrator. Furthermore it will be able to detect whether the parameters, which are used by the corresponding hashing method, being encoded in the hash string are not considered to be strong enough anymore. *modules/pam_unix/passverify.c: Add support for crypt_checksalt.
* pam_unix: Prefer a gensalt function, that supports auto entropy.Björn Esser2018-11-22
| | | | | | * modules/pam_unix/pam_unix_passwd.c: Initialize rounds parameter to 0. * modules/pam_unix/passverify.c: Prefer gensalt with auto entropy. * modules/pam_unix/support.c: Fix sanitizing of rounds parameter.
* pam_motd: Fix segmentation fault when no motd_dir specified (#76)Robert Fairley2018-11-21
| | | | | | | | | | | | This fixes a regression introduced by #69, where motd_path was set to NULL and passed into strdup() if the motd_dir argument was not specified in the configuration file. This caused a segmentation fault. * modules/pam_motd/pam_motd.c: fix checks for NULL in arguments * xtests/Makefile.am: add test scripts and config file * xtests/tst-pam_motd.sh: add running tst-pam_motd4.sh * xtests/tst-pam_motd4.pamd: create * xtests/tst-pam_motd4.sh: create
* pam_motd: Support multiple motd paths specified, with filename overrides (#69)Robert Fairley2018-11-19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Adds specifying multiple paths to motd files and motd.d directories to be displayed. A colon-separated list of paths is specified as arguments motd and motd_dir to the pam_motd module. This gives packages several options to install motd files to. By default, the paths are, with highest priority first: /etc/motd /run/motd /usr/lib/motd /etc/motd.d/ /run/motd.d/ /usr/lib/motd.d/ Which is equivalent to the following arguments: motd=/etc/motd:/run/motd:/usr/lib/motd motd_dir=/etc/motd.d:/run/motd.d:/usr/lib/motd.d Files with the same filename in a lower-priority directory, as specified by the order in the colon-separated list, are overridden, meaning PAM will not display them. This allows a package to contain motd files under /usr/lib instead of the host configuration in /etc. A service may also write a dynamically generated motd in /run/motd.d/ and have PAM display it without needing a symlink from /etc/motd.d/ installed. Closes #68 * modules/pam_motd/pam_motd.8.xml: update documentation * modules/pam_motd/pam_motd.c: add specifying multiple motd paths * xtests/.gitignore: add generated test script * xtests/Makefile.am: add test source, scripts and config files * xtests/tst-pam_motd.c: create * xtests/tst-pam_motd.sh: create * xtests/tst-pam_motd1.pamd: create * xtests/tst-pam_motd1.sh: create * xtests/tst-pam_motd2.pamd: create * xtests/tst-pam_motd2.sh: create * xtests/tst-pam_motd3.pamd: create * xtests/tst-pam_motd3.sh: create
* pam_unix: Use bcrypt b-variant for computing new hashes.Björn Esser2018-11-16
| | | | | | | | | | | | | | | Bcrypt hashes used the "$2a$" prefix since 1997. However, in 2011 an implementation bug was discovered in bcrypt affecting the handling of characters in passphrases with the 8th bit set. Besides fixing the bug, OpenBSD 5.5 introduced the "$2b$" prefix for a behavior that exactly matches crypt_blowfish's "$2y$", and the crypt_blowfish implementation supports it as well since v1.1. That said new computed bcrypt hashes should use the "$2b$" prefix. * modules/pam_unix/passverify.c: Use bcrypt b-variant.
* pam_tally, pam_tally2: fix grammar and spelling (#54)Dmitry V. Levin2018-06-22
| | | | | | | | | | * modules/pam_tally/pam_tally.c (tally_check): Replace "Account is temporary locked" with "The account is temporarily locked" in translated messages. * modules/pam_tally2/pam_tally2.c (tally_check): Likewise. * po/Linux-PAM.pot: Update pam_tally and pam_tally2 messages. Closes: https://github.com/linux-pam/linux-pam/issues/54
* Fix grammar of messages printed via pam_promptDmitry V. Levin2018-06-19
| | | | | | | | | | | | | | | | | | | | | | | | | Turn into proper sentences those messages that are printed without further modifications using pam_prompt in contexts where proper sentences are expected. * libpam/pam_get_authtok.c (pam_get_authtok_internal): Fix grammar of the message passed to pam_error. * modules/pam_limits/pam_limits.c (pam_sm_open_session): Likewise. * modules/pam_cracklib/pam_cracklib.c (_pam_unix_approve_pass): Fix grammar of error messages passed to pam_error. * modules/pam_mail/pam_mail.c (report_mail): Fix grammar of a message passed to pam_info. * modules/pam_timestamp/pam_timestamp.c (verbose_success): Likewise. * modules/pam_selinux/pam_selinux.c (config_context, send_text): Fix grammar of messages passed to pam_prompt. * modules/pam_tally/pam_tally.c (tally_check): Fix grammar of messages passed to pam_info. * modules/pam_tally2/pam_tally2.c (tally_check): Likewise. * modules/pam_unix/pam_unix_acct.c (pam_sm_acct_mgmt): Fix grammar of messages passed to _make_remark. * modules/pam_unix/pam_unix_passwd.c (_pam_unix_approve_pass, pam_sm_chauthtok): Likewise. * po/Linux-PAM.pot: Regenerate.
* pam_stress: do not mark messages for translationDmitry V. Levin2018-06-19
| | | | | | | | | | pam_stress is not a regular module that needs to be translated. Besides that, its messages are not easy to understand and even harder to translate properly. * modules/pam_stress/pam_stress.c (pam_sm_chauthtok): Do not mark messages for translation. * po/Linux-PAM.pot: Remove pam_stress messages.
* pam_unix: remove obsolete _UNIX_AUTHTOK, _UNIX_OLD_AUTHTOK, and ↵Dmitry V. Levin2018-05-31
| | | | | | | | | | | | | | _UNIX_NEW_AUTHTOK macros The last use of these macros was removed by commit Linux-PAM-1.3.0~5 so their definitions should go as well. * modules/pam_unix/pam_unix_auth.c (_UNIX_AUTHTOK): Remove. * modules/pam_unix/pam_unix_passwd.c (_UNIX_OLD_AUTHTOK, _UNIX_NEW_AUTHTOK): Likewise. Complements: 7e09188c5dc4 ("pam_unix: Use pam_get_authtok() instead of direct pam_prompt() calls.")
* pam_unix: remove obsolete _unix_read_password prototypeDmitry V. Levin2018-05-31
| | | | | | | | | | The function was removed by commit Linux-PAM-1.3.0~5 so the function prototype should go as well. * modules/pam_unix/support.h (_unix_read_password): Remove. Complements: 7e09188c5dc4 ("pam_unix: Use pam_get_authtok() instead of direct pam_prompt() calls.")
* pam_motd: add support for a motd.d directory (#48)Allison Karlitskaya2018-05-16
| | | | | | | | | | | | | | | Add a new feature to pam_motd to allow packages to install their own message files in a "motd.d" directory, to be displayed after the primary motd. Add an option motd_d= to specify the location of this directory. Modify the defaults, in the case where no options are given, to display both /etc/motd and /etc/motd.d. Fixes #47 * modules/pam_motd/pam_motd.c: add support for motd.d * modules/pam_motd/pam_motd.8.xml: update the manpage
* pam_umask: Fix documentation to align with order of loading umaskTomas Mraz2018-05-02
| | | | | * modules/pam_umask/pam_umask.8.xml: Document the real order of loading umask.
* pam_tally2 --reset: avoid creating a missing tallylog fileDmitry V. Levin2017-11-10
| | | | | | | | | | | | | | | | There is no need for pam_tally2 in --reset=0 mode to create a missing tallylog file because its absence has the same meaning as its existence with the appropriate entry reset. This was not a big deal until useradd(8) from shadow suite release 4.5 started to invoke /sbin/pam_tally2 --reset routinely regardless of PAM configuration. The positive effect of this change is noticeable when using tools like cpio(1) that cannot archive huge sparse files efficiently. * modules/pam_tally2/pam_tally2.c [MAIN] (main) <cline_user>: Stat cline_filename when cline_reset == 0, exit early if the file is missing.
* pam_mkhomedir: Allow creating parent of homedir under /Tomas Mraz2017-11-10
| | | | | * modules/pam_mkhomedir/mkhomedir_helper.c (make_parent_dirs): Do not skip creating the directory if we are under /.
* pam_tty_audit: Fix regression introduced by adding the uid range support.Tomas Mraz2017-10-09
| | | | | | | * modules/pam_tty_audit/pam_tty_audit.c (parse_uid_range): Fix constification and remove unneeded code carried from pam_limits. (pam_sm_open_session): When multiple enable/disable options are present do not stop after first match.
* pam_access: Add note about spaces around ':' in access.conf(5)Tomas Mraz2017-09-06
| | | | * modules/pam_access/access.conf.5.xml: Add note about spaces around ':'
* pam_unix: Check return value of malloc used for setcred data (#24)Peter Urbanec2017-07-12
| | | | | | | | Check the return value of malloc and if it failed print debug info, send a syslog message and return an error code. The test in AUTH_RETURN for ret_data not being NULL becomes redundant. Signed-off-by: Peter Urbanec <git.user@urbanec.net>
* pam_cracklib: Drop unused prompt macros.Tomas Mraz2017-07-10
| | | | * modules/pam_cracklib/pam_cracklib.c: Drop the unused macros.
* pam_tty_audit: Support matching users by uid range.Tomas Mraz2017-06-28
| | | | | | | * modules/pam_tty_audit/pam_tty_audit.c (parse_uid_range): New function to parse the uid range. (pam_sm_open_session): Call parse_uid_range() and behave according to its result. * modules/pam_tty_audit/pam_tty_audit.8.xml: Document the uid range matching.
* pam_access: support parsing files in /etc/security/access.d/*.confTomas Mraz2017-05-31
| | | | | | | | | * modules/pam_access/pam_access.c (login_access): Return NOMATCH if there was no match in the parsed file. (pam_sm_authenticate): Add glob() call to go through the ACCESS_CONF_GLOB subdirectory and call login_access() on the individual files matched. * modules/pam_access/pam_access.8.xml: Document the addition. * modules/pam_access/Makefile.am: Add ACCESS_CONF_GLOB definition.
* pam_localuser: Correct the example in documentation.Tomas Mraz2017-04-11
| | | | | * modules/pam_localuser/pam_localuser.8.xml: The example configuration does something different.
* pam_localuser: Correct documentation of return value.Tomas Mraz2017-04-11
| | | | | * modules/pam_localuser/pam_localuser.8.xml: The module returns PAM_PERM_DENIED when the user is not listed.
* Make maxclassrepeat=1 behavior consistent with docs (#9)Saul Johnson2017-03-10
| | | * modules/pam_cracklib/pam_cracklib.c (simple): Apply the maxclassrepeat when greater than 0.
* Properly test for strtol() failure to find any digits.Josef Moellers2017-02-09
| | | | | * modules/pam_access/pam_access.c (network_netmask_match): Test for endptr set to beginning and not NULL.
* pam_exec: fix a potential null pointer dereferenceDaniel Abrecht2017-01-19
| | | | | | | | | | Fix a null pointer dereference when pam_prompt returns PAM_SUCCESS but the response is set to NULL. * modules/pam_exec/pam_exec.c (call_exec): Do not invoke strndupa with a null pointer. Closes: https://github.com/linux-pam/linux-pam/pull/2
* Add missing comma in the limits.conf.5 manpage.Antonio Ospite2016-12-07
| | | | * modules/pam_limits/limits.conf.5.xml: add a missing comma
* pam_access: First check for the (group) match.Tomas Mraz2016-11-01
| | | | | | | The (group) match is performed first to allow for groups containing '@'. * modules/pam_access/pam_access.c (user_match): First check for the (group) match.
* pam_ftp: Properly use the first name from the supplied listTomas Mraz2016-10-17
| | | | | | * modules/pam_ftp/pam_ftp.c (lookup): Return first user from the list of anonymous users if user name matches. (pam_sm_authenticate): Free the returned value allocated in lookup().
* pam_issue: Fix no prompting in parse escape codes mode.Bartos-Elekes Zsolt2016-09-12
| | | | * modules/pam_issue/pam_issue.c (read_issue_quoted): Fix misplaced strcat().
generated by cgit v1.2.3 (git 2.25.1) at 2024-05-25 09:21:56 +0000