From 2820ff6a5f9f43faa8cc823cd954966ca3f5c8cc Mon Sep 17 00:00:00 2001 From: Thorsten Kukuk Date: Tue, 16 Jun 2009 08:32:40 +0000 Subject: Relevant BUGIDs: Purpose of commit: bugfix Commit summary: --------------- 2009-06-16 Thorsten Kukuk * doc/sag/Linux-PAM_SAG.xml: Fix typos. * doc/adg/Linux-PAM_ADG.xml: Likewise. * doc/mwg/Linux-PAM_MWG.xml: Likewise. --- ChangeLog | 6 ++++++ doc/adg/Linux-PAM_ADG.xml | 19 ++++++++++--------- doc/mwg/Linux-PAM_MWG.xml | 6 +++--- doc/sag/Linux-PAM_SAG.xml | 12 ++++++------ 4 files changed, 25 insertions(+), 18 deletions(-) diff --git a/ChangeLog b/ChangeLog index ffc41bf7..67ee2ebf 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,9 @@ +2009-06-16 Thorsten Kukuk + + * doc/sag/Linux-PAM_SAG.xml: Fix typos. + * doc/adg/Linux-PAM_ADG.xml: Likewise. + * doc/mwg/Linux-PAM_MWG.xml: Likewise. + 2009-06-08 Rajesh Ranjan * po/hi.po: Updated translations. diff --git a/doc/adg/Linux-PAM_ADG.xml b/doc/adg/Linux-PAM_ADG.xml index 8f5ec115..ad7966df 100644 --- a/doc/adg/Linux-PAM_ADG.xml +++ b/doc/adg/Linux-PAM_ADG.xml @@ -23,7 +23,7 @@ about the Linux-PAM library. It describes how an application might use the Linux-PAM library to authenticate - users. In addition it contains a description of the funtions + users. In addition it contains a description of the functions to be found in libpam_misc library, that can be used in general applications. Finally, it contains some comments on PAM related security issues for the application developer. @@ -380,7 +380,7 @@ cc -o application .... -lpam -lpam_misc -
+
The identity of the user The Linux-PAM modules will need @@ -395,9 +395,9 @@ cc -o application .... -lpam -lpam_misc issue of security. One convention that is actively used by some modules is that the identity of the user requesting a service should be the current UID - (userid) of the running process; the identity of the + (user ID) of the running process; the identity of the privilege granting user is the EUID - (effective userid) of the running process; the identity of + (effective user ID) of the running process; the identity of the user, under whose name the service will be executed, is given by the contents of the PAM_USER @@ -459,7 +459,7 @@ cc -o application .... -lpam -lpam_misc This is also true of conversation prompts. The application should not accept prompts of arbitrary length with out checking for resource allocation failure and dealing with such extreme conditions gracefully - and in a mannor that preserves the PAM API. Such tolerance may be + and in a manner that preserves the PAM API. Such tolerance may be especially important when attempting to track a malicious adversary.
@@ -470,7 +470,7 @@ cc -o application .... -lpam -lpam_misc To aid the work of the application developer a library of miscellaneous functions is provided. It is called - libpam_miscy, and contains a text based + libpam_misc, and contains a text based conversation function, and routines for enhancing the standard PAM-environment variable support. @@ -520,8 +520,9 @@ cc -o application .... -lpam -lpam_misc being be attached to it. The point being that the "standard" pop-authentication protocol(s) [which will be needed to satisfy inflexible/legacy clients] would be supported by inserting an - appropriate pam_qpopper module(s). However, having rewritten popd - once in this way any new protocols can be implemented in-situ. + appropriate pam_qpopper module(s). However, having rewritten + popd once in this way any new protocols can be + implemented in-situ. One simple test of a ported application would be to insert the @@ -558,7 +559,7 @@ cc -o application .... -lpam -lpam_misc him/herself in a variety of ways. Updating the user's authentication token thus corresponds to refreshing the object they use to - authenticate themself with the system. The word password is + authenticate them self with the system. The word password is avoided to keep open the possibility that the authentication involves a retinal scan or other non-textual mode of challenge/response. diff --git a/doc/mwg/Linux-PAM_MWG.xml b/doc/mwg/Linux-PAM_MWG.xml index 5a09a7cf..0c6c9201 100644 --- a/doc/mwg/Linux-PAM_MWG.xml +++ b/doc/mwg/Linux-PAM_MWG.xml @@ -71,7 +71,7 @@
-
+
Synopsis #include <security/pam_modules.h> @@ -97,7 +97,7 @@ gcc -shared -o pam_module.so pam_module.o -lpam First, we cover what the module should expect from the Linux-PAM library and a Linux-PAM aware application. - Essesntially this is the libpam.* library. + Essentially this is the libpam.* library. @@ -169,7 +169,7 @@ gcc -shared -o pam_module.so pam_module.o -lpam token of some lesser user. In other cases it may not be appropriate: when joe maliciously wants to reset alice's password; or when anyone - other than the user themself wishes to reset their + other than the user them self wishes to reset their KERBEROS authentication token. A policy for this action should be defined by any reasonable authentication scheme, the module writer should consider diff --git a/doc/sag/Linux-PAM_SAG.xml b/doc/sag/Linux-PAM_SAG.xml index b83355ef..a3fc1ee8 100644 --- a/doc/sag/Linux-PAM_SAG.xml +++ b/doc/sag/Linux-PAM_SAG.xml @@ -27,7 +27,7 @@ - + Introduction Linux-PAM (Pluggable Authentication @@ -85,7 +85,7 @@ here for locating these files are those of the relevant RFC (RFC-86.0, see bibliography"). If you are using a distribution of Linux (or some other operating system) that - supports PAM but chooses to distribute these files in a diferent way + supports PAM but chooses to distribute these files in a different way you should be careful when copying examples directly from the text. @@ -210,7 +210,7 @@ If a program is going to use PAM, then it has to have PAM functions explicitly coded into the program. If you have access to the source code you can add the appropriate PAM - functions. If you do not have accessto the source code, and + functions. If you do not have access to the source code, and the binary does not have the PAM functions included, then it is not possible to use PAM. @@ -227,7 +227,7 @@ href="../man/pam.conf-syntax.xml" xpointer='xpointer(//section[@id = "pam.conf-syntax"]/*)' />
-
+
Directory based configuration Security issues -
+
If something goes wrong Linux-PAM has the potential @@ -341,7 +341,7 @@ session required pam_unix.so choose to have no security or absolute security (no access permitted). In general, Linux-PAM errs towards the latter. Any number of configuration errors - can dissable access to your system partially, or completely. + can disable access to your system partially, or completely. The most dramatic problem that is likely to be encountered when -- cgit v1.2.3