[29114] in Kerberos
Re: pam_krb5 3.9 bug in account management ?
daemon@ATHENA.MIT.EDU (Russ Allbery)
Sat Jan 19 15:20:44 2008
To: kerberos@mit.edu
In-Reply-To: <8ADE506EF8C64F5186AEBF7FD9F1E7C7@VAIOLaptop> (Markus Moeller's
message of "Sat\, 19 Jan 2008 15\:49\:51 -0000")
From: Russ Allbery <rra@stanford.edu>
Date: Sat, 19 Jan 2008 12:19:48 -0800
Message-ID: <8763xpd0uz.fsf@windlord.stanford.edu>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
Resending this to the list.
"Markus Moeller" <huaraz@moeller.plus.com> writes:
> I think in api-account.c in line 60 the PAM_SUCCESS should be changed to
> PAM_IGNORE, otherwise if you stack pam modules like:
>
> other account sufficient pam_krb5
> other account required pam_unix
>
> and check for a local non Kerberos user the account management by pam_unix
> (password expiry, etc..) will be ignored.
I would agree with you except PAM_IGNORE is not a permissible return code
for a PAM module according to the Linux PAM standard, which is as close to
a standard as we have.
Normally, you don't need to do the above. Other things don't work if the
user doesn't have a basic existence in the nsswitch setup for the system,
at which point pam_unix's account module will succeed.
--
Russ Allbery (rra@stanford.edu) <http://www.eyrie.org/~eagle/>
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
