[23098] in Source-Commits
/svn/athena r22761 - trunk/debathena/config/pam-config/debian
daemon@ATHENA.MIT.EDU (andersk@MIT.EDU)
Mon Feb 18 03:18:25 2008
Date: Mon, 18 Feb 2008 03:17:51 -0500 (EST)
From: andersk@MIT.EDU
Message-Id: <200802180817.DAA03025@drugstore.mit.edu>
To: source-commits@MIT.EDU
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Author: andersk
Date: 2008-02-18 03:17:51 -0500 (Mon, 18 Feb 2008)
New Revision: 22761
Modified:
trunk/debathena/config/pam-config/debian/access.conf.append
trunk/debathena/config/pam-config/debian/control
trunk/debathena/config/pam-config/debian/control.in
trunk/debathena/config/pam-config/debian/rules
Log:
Explicitly allow root and (on Ubuntu) admin in addition to
nss-local-users.
Modified: trunk/debathena/config/pam-config/debian/access.conf.append
===================================================================
--- trunk/debathena/config/pam-config/debian/access.conf.append 2008-02-18 08:16:15 UTC (rev 22760)
+++ trunk/debathena/config/pam-config/debian/access.conf.append 2008-02-18 08:17:51 UTC (rev 22761)
@@ -1,5 +1,6 @@
#DEBATHENA BEGIN
+
#DEBATHENA EXAMPLES
## Only root and tabbott can log in.
#-:ALL EXCEPT root tabbott:ALL
@@ -7,13 +8,13 @@
#-:ALL EXCEPT andersk tabbott:ALL EXCEPT LOCAL
## Only root and users in group gsipb can log in.
#-:ALL EXCEPT root gsipb:ALL
-# Note that you can use Moira NFS groups here
-# See http://debathena.mit.edu/access-controls for details
+# Note that you can use Moira NFS groups here.
+# See <http://debathena.mit.edu/access-controls> for details.
-# DEFAULT only allow remote access for users who have local accounts
+# DEFAULT: Only allow remote access for users who have local accounts
# on the machine (i.e. are in /etc/passwd). Allow all other users to
# login only locally.
-+:nss-local-users:ALL
--:ALL:ALL EXCEPT LOCAL
+-:ALL EXCEPT root admin nss-local-users:ALL EXCEPT LOCAL
+
#DEBATHENA END
Modified: trunk/debathena/config/pam-config/debian/control
===================================================================
--- trunk/debathena/config/pam-config/debian/control 2008-02-18 08:16:15 UTC (rev 22760)
+++ trunk/debathena/config/pam-config/debian/control 2008-02-18 08:17:51 UTC (rev 22761)
@@ -2,7 +2,7 @@
Section: debathena-config/net
Priority: extra
Maintainer: Debian-Athena Project <debathena@mit.edu>
-Build-Depends: cdbs (>= 0.4.23-1.1), debhelper (>= 4.2.0), debathena-config-build-common (>= 3.5~), debathena-config-build-common, libpam-runtime, gdm, debathena-ssh-server
+Build-Depends: cdbs (>= 0.4.23-1.1), debhelper (>= 4.2.0), debathena-config-build-common (>= 3.5~), debathena-config-build-common, libpam-runtime, gdm, debathena-ssh-server, lsb-release
Standards-Version: 3.7.2
Package: debathena-pam-config
Modified: trunk/debathena/config/pam-config/debian/control.in
===================================================================
--- trunk/debathena/config/pam-config/debian/control.in 2008-02-18 08:16:15 UTC (rev 22760)
+++ trunk/debathena/config/pam-config/debian/control.in 2008-02-18 08:17:51 UTC (rev 22761)
@@ -2,7 +2,7 @@
Section: debathena-config/net
Priority: extra
Maintainer: Debian-Athena Project <debathena@mit.edu>
-Build-Depends: @cdbs@, libpam-runtime, gdm, debathena-ssh-server
+Build-Depends: @cdbs@, libpam-runtime, gdm, debathena-ssh-server, lsb-release
Standards-Version: 3.7.2
Package: debathena-pam-config
Modified: trunk/debathena/config/pam-config/debian/rules
===================================================================
--- trunk/debathena/config/pam-config/debian/rules 2008-02-18 08:16:15 UTC (rev 22760)
+++ trunk/debathena/config/pam-config/debian/rules 2008-02-18 08:17:51 UTC (rev 22761)
@@ -33,13 +33,22 @@
perl -0pe 's/^(\@include common-account)/account\trequired\tpam_access.so\n$$1/m or die' $< > $@
debian/ssh.debathena: $(call debathena_check_conffiles,/etc/pam.d/ssh)
- perl -0pe '(s/^\#[\t ]+(account[ \t]+required[ \t]+pam_access.so)/$$1/m or s/^(?=\@include[ \t]+common-account)/account required pam_access.so\n/m) and s/^(\@include[ \t]+common-session)/$$1\nsession\toptional\tpam_mktemp.so var=XAUTHORITY prefix=\/var\/run\/athena-sessions\/xauth/m or die' $< > $@
+ perl -0pe '(s/^\#[\t ]+(account[ \t]+required[ \t]+pam_access.so)/$$1/m or s/^(?=\@include[ \t]+common-account)/account required pam_access.so\n/m) and s/^(\@include[ \t]+common-session)/$$1\nsession optional pam_mktemp.so var=XAUTHORITY prefix=\/var\/run\/athena-sessions\/xauth/m or die' $< > $@
debian/login.debathena: $(call debathena_check_conffiles,/etc/pam.d/login)
perl -0pe 's/^\#[\t ]+(account[ \t]+required[ \t]+pam_access.so)/$$1/m or die' $< > $@
+LSB_ID = $(shell lsb_release --short --id)
debian/access.conf.debathena: $(call debathena_check_conffiles,/etc/security/access.conf)
+ifeq ($(LSB_ID), Debian)
+ (cat $<; sed 's/root admin /root /' debian/access.conf.append) > $@
+else
+ ifeq ($(LSB_ID), Ubuntu)
cat $< debian/access.conf.append > $@
+ else
+ $(error Unrecognized distribution ID $(LSB_ID).)
+ endif
+endif
clean::
rm -f $(patsubst %,debian/common-%.debathena,$(pam_types)) debian/gdm.debathena debian/login.debathena debian/ssh.debathena debian/access.conf.debathena
