From 2c388144eb7c68aa31c20c00f6c054c219bf72a2 Mon Sep 17 00:00:00 2001 From: Thorsten Kukuk Date: Fri, 10 Feb 2006 18:33:54 +0000 Subject: Relevant BUGIDs: Purpose of commit: Commit summary: --------------- Remove pam_pwdb and all references to it. 2006-02-10 Thorsten Kukuk * configure.in: Remove pam_pwdb support. * modules/Makefile.am: remove pam_pwdb. * modules/pam_pwdb: Remove complete directory. * libpam/Makefile.am: Remove LIBPWDB references. * libpam/pam_static_modules.h: Remove pam_pwdb references. * doc/modules/pam_pwdb.sgml: Removed. * po/POTFILES.in: Remove modules/pam_pwdb/*.c entries. * doc/pam_source.sgml: Remove references to libpwdb. * doc/modules/pam_limits.sgml: Remove wrong reference to libpwdb. * doc/modules/pam_group.sgml: Likewise. * doc/modules/pam_cracklib.sgml: Replace pam_pwdb with pam_unix. * doc/modules/pam_userdb.sgml: Likewise. * modules/pam_cracklib/pam_cracklib.8.xml: Replace pam_pwdb with pam_unix. * modules/pam_mkhomedir/pam_mkhomedir.c: Likewise. * modules/pam_group/pam_group.c: Remove dead code for libpwdb. --- doc/modules/pam_cracklib.sgml | 12 +- doc/modules/pam_group.sgml | 3 +- doc/modules/pam_limits.sgml | 2 +- doc/modules/pam_pwdb.sgml | 257 ------------------------------------------ doc/modules/pam_userdb.sgml | 8 +- doc/pam_source.sgml | 14 --- 6 files changed, 12 insertions(+), 284 deletions(-) delete mode 100644 doc/modules/pam_pwdb.sgml (limited to 'doc') diff --git a/doc/modules/pam_cracklib.sgml b/doc/modules/pam_cracklib.sgml index 008e49f6..2cbfca45 100644 --- a/doc/modules/pam_cracklib.sgml +++ b/doc/modules/pam_cracklib.sgml @@ -231,18 +231,18 @@ for a new password but use the one provided by the previously stacked

For an example of the use of this module, we show how it may be -stacked with the password component of # # These lines stack two password type modules. In this example the # user is given 3 opportunities to enter a strong password. The -# "use_authtok" argument ensures that the pam_pwdb module does not +# "use_authtok" argument ensures that the pam_unix module does not # prompt for a password, but instead uses the one provided by # pam_cracklib. # passwd password required pam_cracklib.so retry=3 -passwd password required pam_pwdb.so use_authtok +passwd password required pam_unix.so use_authtok @@ -260,7 +260,7 @@ case that you want to use md5 password encryption: # password required pam_cracklib.so \ difok=3 minlen=15 dcredit= 2 ocredit=2 -password required pam_pwdb.so use_authtok nullok md5 +password required pam_unix.so use_authtok nullok md5 @@ -276,7 +276,7 @@ And here is another example in case you don't want to use credits: # password required pam_cracklib.so \ dcredit=-1 ucredit=-1 ocredit=-1 lcredit=0 minlen=8 -password required pam_pwdb.so use_authtok nullok md5 +password required pam_unix.so use_authtok nullok md5 @@ -293,7 +293,7 @@ length of 8: # password required pam_cracklib.so \ dcredit=0 ucredit=0 ocredit=0 lcredit=0 minlen=8 -password required pam_pwdb.so use_authtok nullok md5 +password required pam_unix.so use_authtok nullok md5 diff --git a/doc/modules/pam_group.sgml b/doc/modules/pam_group.sgml index 0d8550d4..c40477c8 100644 --- a/doc/modules/pam_group.sgml +++ b/doc/modules/pam_group.sgml @@ -31,8 +31,7 @@ Sensitive to Clean code base: System dependencies: -Requires an /etc/security/group.conf file. Can be compiled -with or without /etc/security/group.conf file. Network aware: Only through correctly set System dependencies: requires an /etc/security/limits.conf file and kernel support -for resource limits. Also uses the library, Network aware: diff --git a/doc/modules/pam_pwdb.sgml b/doc/modules/pam_pwdb.sgml deleted file mode 100644 index 51f4f86d..00000000 --- a/doc/modules/pam_pwdb.sgml +++ /dev/null @@ -1,257 +0,0 @@ - - -The Password-Database module - -Synopsis - -

- - -Module Name: -pam_pwdb - -Author: -Cristian Gafton <gafton@redhat.com> -and Andrew G. Morgan <morgan@kernel.org> - -Maintainer: -Red Hat. - -Management groups provided: -account; authentication; password; session - -Cryptographically sensitive: - -Security rating: - -Clean code base: - -System dependencies: -Requires properly configured Network aware: - - - -Overview of module - -

-This module is a pluggable replacement for the libpwdb. - -Account component - -

- - -Recognized arguments: -Description: - -The Examples/suggested usage: - -In its accounting mode, this module can be inserted as follows: - - -# -# Ensure users account and password are still active -# -login account required pam_pwdb.so - - - - - -Authentication component - -

- - -Recognized arguments: -Description: - -The -The default action of this module is to not permit the user access to -a service if their -When given the argument -The argument, nodelay, can be used to discourage the -authentication component from requesting a delay should the -authentication as a whole fail. The default action is for the module -to request a delay-on-failure of the order of one second. - -

-Remaining arguments, supported by the other functions of this module, -are silently ignored. Other arguments are logged as errors through - -A helper binary, pwdb_chkpwd, is provided to check the user's -password when it is stored in a read protected database. This binary -is very simple and will only check the password of the user invoking -it. It is called transparently on behalf of the user by the -authenticating component of this module. In this way it is possible -for applications like xlock to work without being -setuid-root. The module, by default, will temporarily turn off - -The likeauth argument makes the module return the same value -when called as a credential setting module and an authentication -module. This will help libpam take a sane path through the auth -component of your configuration file. - -Examples/suggested usage: - -The correct functionality of this module is dictated by having an -appropriate /etc/pwdb.conf file, the user -databases specified there dictate the source of the authenticated -user's record. - - - -Password component - -

- - -Recognized arguments: -Description: - -This part of the -In the case of conventional unix databases (which store the password -encrypted) the -The -The argument -The -The Examples/suggested usage: - -An example of the stacking of this module with respect to the -pluggable password checking module, - -Session component - -

- - -Recognized arguments: - -Description: - -No arguments are recognized by this module component. Its action is -simply to log the username and the service-type to -Examples/suggested usage: - -The use of the session modules is straightforward: - - -# -# pwdb - unix like session opening and closing -# -login session required pam_pwdb.so - - - - - - diff --git a/doc/modules/pam_userdb.sgml b/doc/modules/pam_userdb.sgml index facf223e..566e68de 100644 --- a/doc/modules/pam_userdb.sgml +++ b/doc/modules/pam_userdb.sgml @@ -61,7 +61,7 @@ fields corresponding to the username keys are the passwords, in unencrypted form so caution must be exercised over the access rights to the DB database itself.. The module will read the password from the user using the conversation mechanism. If -you are using this module on top of another authentication module (like @@ -112,10 +112,10 @@ provided in the /etc/dbtest.db file: #%PAM-1.0 auth required pam_listfile.so item=user sense=deny file=/etc/ftpusers onerr=succeed auth sufficient pam_userdb.so icase db=/etc/dbtest -auth required pam_pwdb.so shadow nullok try_first_pass +auth required pam_unix.so shadow nullok try_first_pass auth required pam_shells.so -account required pam_pwdb.so -session required pam_pwdb.so +account required pam_unix.so +session required pam_unix.so diff --git a/doc/pam_source.sgml b/doc/pam_source.sgml index 8e641032..bc091ed6 100644 --- a/doc/pam_source.sgml +++ b/doc/pam_source.sgml @@ -967,20 +967,6 @@ From here you can go back and get a real configuration going, hopefully after you've tested it first on a machine you don't care about screwing up. :/ -Some pointers (to make everything "right" with Red Hat...): - - Install the newest pam, pamconfig, and pwdb from the - redhat current directory, and do it all on the same - command line with rpm... - - rpm -Uvh [maybe --force too] pam-* pamconfig-* pwdb-* - - Then make sure you install (or reinstall) the newest - version of libc, util-linux, wuftp, and NetKit. For - kicks you might try installing the newest versions of - the affected x apps, like xlock, but I haven't gotten - those to work at all yet. - Avoid having a weak `other' configuration -- cgit v1.2.3