[23055] in Source-Commits
/svn/athena r22718 - trunk/debathena/config/pam-config/debian
daemon@ATHENA.MIT.EDU (tabbott@MIT.EDU)
Tue Jan 29 22:39:07 2008
Date: Tue, 29 Jan 2008 22:38:30 -0500 (EST)
From: tabbott@MIT.EDU
Message-Id: <200801300338.WAA29620@drugstore.mit.edu>
To: source-commits@MIT.EDU
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Author: tabbott
Date: 2008-01-29 22:38:30 -0500 (Tue, 29 Jan 2008)
New Revision: 22718
Removed:
trunk/debathena/config/pam-config/debian/access.conf.debathena
Modified:
trunk/debathena/config/pam-config/debian/access.conf.append
trunk/debathena/config/pam-config/debian/changelog
trunk/debathena/config/pam-config/debian/control
trunk/debathena/config/pam-config/debian/control.in
trunk/debathena/config/pam-config/debian/rules
Log:
Modified: trunk/debathena/config/pam-config/debian/access.conf.append
===================================================================
--- trunk/debathena/config/pam-config/debian/access.conf.append 2008-01-30 03:35:51 UTC (rev 22717)
+++ trunk/debathena/config/pam-config/debian/access.conf.append 2008-01-30 03:38:30 UTC (rev 22718)
@@ -10,6 +10,8 @@
# Note that you can use Moira NFS groups here
# See http://debathena.mit.edu/access-controls for details
-#DEFAULT forbid remote access
--:ALL:ALL EXCEPT LOCAL
+# DEFAULT only allow access for users who have local accounts on the
+# machine (i.e. are in /etc/passwd).
++:nss-local-users:ALL
+-:ALL:ALL
#DEBATHENA END
Deleted: trunk/debathena/config/pam-config/debian/access.conf.debathena
Modified: trunk/debathena/config/pam-config/debian/changelog
===================================================================
--- trunk/debathena/config/pam-config/debian/changelog 2008-01-30 03:35:51 UTC (rev 22717)
+++ trunk/debathena/config/pam-config/debian/changelog 2008-01-30 03:38:30 UTC (rev 22718)
@@ -1,3 +1,20 @@
+debathena-pam-config (1.3debathena4) unstable; urgency=low
+
+ * Only set XAUTHORITY in /etc/pam.d/ssh due to gdm problems.
+ * Correctly clean auto-generated debian/access.conf.debathena
+
+ -- Tim Abbott <tabbott@mit.edu> Thu, 24 Jan 2008 22:31:23 -0500
+
+debathena-pam-config (1.3debathena3) unstable; urgency=low
+
+ * Replace pam_xauthority.so with more general pam_mktemp.so
+ * Use pam_mktemp.so to create/set ATHENA_SESSION_TMPDIR
+ * Use nss_nonlocal 1.3 to give better /etc/security/access.conf
+ default for private workstations: access is allowed if and only if
+ the user has a local account on the system
+
+ -- Tim Abbott <tabbott@mit.edu> Tue, 22 Jan 2008 22:02:50 -0500
+
debathena-pam-config (1.3debathena2) unstable; urgency=low
* Add /etc/security/access.conf default to no remote access.
Modified: trunk/debathena/config/pam-config/debian/control
===================================================================
--- trunk/debathena/config/pam-config/debian/control 2008-01-30 03:35:51 UTC (rev 22717)
+++ trunk/debathena/config/pam-config/debian/control 2008-01-30 03:38:30 UTC (rev 22718)
@@ -7,7 +7,7 @@
Package: debathena-pam-config
Architecture: all
-Depends: debathena-kerberos-config, libpam-runtime, libpam-krb5, libpam-krb524, libpam-athena-locker, ${misc:Depends}, libpam-debathena-home-type, debathena-dotfiles
+Depends: debathena-kerberos-config, libpam-runtime, libpam-krb5, libpam-krb524, libpam-athena-locker, ${misc:Depends}, libpam-debathena-home-type, debathena-dotfiles, debathena-nsswitch-config (>= 1.3~), libpam-mktemp
Description: PAM configuration for Debian-Athena
This package configures PAM to use the Athena Kerberos realm to
manage authentication, get AFS tokens on login, etc.
Modified: trunk/debathena/config/pam-config/debian/control.in
===================================================================
--- trunk/debathena/config/pam-config/debian/control.in 2008-01-30 03:35:51 UTC (rev 22717)
+++ trunk/debathena/config/pam-config/debian/control.in 2008-01-30 03:38:30 UTC (rev 22718)
@@ -7,7 +7,7 @@
Package: debathena-pam-config
Architecture: all
-Depends: debathena-kerberos-config, libpam-runtime, libpam-krb5, libpam-krb524, libpam-athena-locker, ${misc:Depends}, libpam-debathena-home-type, debathena-dotfiles
+Depends: debathena-kerberos-config, libpam-runtime, libpam-krb5, libpam-krb524, libpam-athena-locker, ${misc:Depends}, libpam-debathena-home-type, debathena-dotfiles, debathena-nsswitch-config (>= 1.3~), libpam-mktemp
Description: PAM configuration for Debian-Athena
This package configures PAM to use the Athena Kerberos realm to
manage authentication, get AFS tokens on login, etc.
Modified: trunk/debathena/config/pam-config/debian/rules
===================================================================
--- trunk/debathena/config/pam-config/debian/rules 2008-01-30 03:35:51 UTC (rev 22717)
+++ trunk/debathena/config/pam-config/debian/rules 2008-01-30 03:38:30 UTC (rev 22718)
@@ -24,16 +24,17 @@
perl -0pe 's/^(auth[ \t]+)required( ? ?)([ \t]+)(pam_unix\.so([ \t]+.*)?)\n/$$1sufficient$$3$$4\n$$1required$$2$$3pam_krb5.so use_first_pass\n/m or die' $< > $@
debian/common-session.debathena: /usr/share/pam/common-session
- perl -0pe 's/^(session[ \t]+)required([ \t]+)(pam_unix\.so([ \t]+.*)?)\n/$$1required$$2$$3\n$$1optional$$2pam_krb5.so\n$$1optional$$2pam_krb524.so\n$$1optional$$2pam_athena_locker.so\n$$1optional$$2pam_debathena_home_type.so\n$$1optional$$2pam_xauthority.so dir=\/var\/run\/athena-sessions\/\n/m or die' $< > $@
+ perl -0pe 's/^(session[ \t]+)required([ \t]+)(pam_unix\.so([ \t]+.*)?)\n/$$1required$$2$$3\n$$1optional$$2pam_krb5.so\n$$1optional$$2pam_krb524.so\n$$1optional$$2pam_athena_locker.so\n$$1optional$$2pam_debathena_home_type.so\n$$1optional$$2pam_mktemp.so var=ATHENA_SESSION_TMPDIR prefix=\/var\/run\/athena-sessions\/session dir\n/m or die' $< > $@
debian/common-password.debathena: /usr/share/pam/common-password
perl -0pe 's/^(password[ \t]+)required( ? ?)([ \t]+)(pam_unix\.so([ \t]+.*)?)\n/$$1sufficient$$3$$4\n$$1required$$2$$3pam_krb5.so use_first_pass\n/m or die' $< > $@
debian/gdm.debathena: $(call debathena_check_conffiles,/etc/pam.d/gdm)
perl -0pe 's/^(\@include common-account)/account\trequired\tpam_access.so\n$$1/m or die' $< > $@
+#and \ s/^(\@include common-session)/session\trequired\tpam_env.so readenv=0 conffile=\/etc\/security\/gdm-xauth-hack.conf\n$$1/m
debian/ssh.debathena: $(call debathena_check_conffiles,/etc/pam.d/ssh)
- perl -0pe 's/^\#[\t ]+(account[ \t]+required[ \t]+pam_access.so)/$$1/m or s/^(?=\@include[ \t]+common-account)/account required pam_access.so\n/m or die' $< > $@
+ perl -0pe '(s/^\#[\t ]+(account[ \t]+required[ \t]+pam_access.so)/$$1/m or s/^(?=\@include[ \t]+common-account)/account required pam_access.so\n/m) and s/^(\@include[ \t]+common-session)/$$1\nsession\toptional\tpam_mktemp.so var=XAUTHORITY prefix=\/var\/run\/athena-sessions\/xauth/m or die' $< > $@
debian/login.debathena: $(call debathena_check_conffiles,/etc/pam.d/login)
perl -0pe 's/^\#[\t ]+(account[ \t]+required[ \t]+pam_access.so)/$$1/m or die' $< > $@
@@ -42,4 +43,4 @@
cat $< debian/access.conf.append > $@
clean::
- rm -f $(patsubst %,debian/common-%.debathena,$(pam_types)) debian/gdm.debathena debian/login.debathena debian/ssh.debathena
+ rm -f $(patsubst %,debian/common-%.debathena,$(pam_types)) debian/gdm.debathena debian/login.debathena debian/ssh.debathena debian/access.conf.debathena
