Enable OPIE by default, using the no_fake_prompts option to hide it from

users who don't wish to use it.  If the admin is worried about leaking
information about which users exist and which have OPIE enabled, the
no_fake_prompts option can simply be removed.

Also insert the appropriate pam_opieaccess lines after pam_opie to break
the chain in case the user is logging in from an untrusted host, or has a
.opiealways file.  The entire opieaccess / opiealways concept is slightly
unpammish, but admins familiar with OPIE will expect it to work.

Reviewed by:	ache, markm
Sponsored by:	DARPA, NAI Labs

9 files changed, 40 insertions, 23 deletions

diff --git a/etc/pam.d/csshd b/etc/pam.d/csshd
index 863160e..3501424 100644
--- a/etc/pam.d/csshd
+++ b/etc/pam.d/csshd
@@ -5,4 +5,5 @@
 #
 
 # auth
-auth		required	pam_opie.so	no_warn
+auth		sufficient	pam_opie.so	no_warn no_fake_prompts
+auth		requisite	pam_opieaccess.so	no_warn
diff --git a/etc/pam.d/ftp b/etc/pam.d/ftp
index 3a083ef..cdd30f1 100644
--- a/etc/pam.d/ftp
+++ b/etc/pam.d/ftp
@@ -8,7 +8,8 @@
 auth		required	pam_nologin.so	no_warn
 #auth		sufficient	pam_kerberosIV.so	no_warn
 #auth		sufficient	pam_krb5.so	no_warn
-#auth		required	pam_opie.so	no_warn
+auth		sufficient	pam_opie.so	no_warn no_fake_prompts
+auth		requisite	pam_opieaccess.so	no_warn
 #auth		required	pam_ssh.so	no_warn try_first_pass
 auth		required	pam_unix.so	no_warn try_first_pass
 
diff --git a/etc/pam.d/ftpd b/etc/pam.d/ftpd
index 471b67b..46838ee 100644
--- a/etc/pam.d/ftpd
+++ b/etc/pam.d/ftpd
@@ -9,10 +9,9 @@ auth		required	pam_nologin.so	no_warn
 #auth		sufficient	pam_kerberosIV.so	no_warn
 #auth		sufficient	pam_krb5.so	no_warn
 #auth           sufficient      pam_ssh.so      no_warn try_first_pass
-# Uncomment either pam_opie or pam_unix, but not both of them.
-# pam_unix can't be simple chained with pam_opie, ftpd provides proper fallback
-auth		required	pam_opie.so	no_warn
-#auth		required	pam_unix.so	no_warn try_first_pass
+auth		sufficient	pam_opie.so	no_warn no_fake_prompts
+auth		requisite	pam_opieaccess.so	no_warn
+auth		required	pam_unix.so	no_warn try_first_pass
 
 # account
 #account	required	pam_kerberosIV.so
diff --git a/etc/pam.d/imap b/etc/pam.d/imap
index cfacfb8..eaf53d2 100644
--- a/etc/pam.d/imap
+++ b/etc/pam.d/imap
@@ -6,6 +6,7 @@
 
 # auth
 #auth		required	pam_nologin.so	no_warn
-#auth		required	pam_opie.so	no_warn
+#auth		sufficient	pam_opie.so	no_warn no_fake_prompts
+#auth		requisite	pam_opieaccess.so	no_warn
 #auth		required	pam_ssh.so	no_warn try_first_pass
 #auth		required	pam_unix.so	no_warn try_first_pass
diff --git a/etc/pam.d/kde b/etc/pam.d/kde
index 0956488..4d23ae8 100644
--- a/etc/pam.d/kde
+++ b/etc/pam.d/kde
@@ -6,7 +6,8 @@
 
 # auth
 auth		required	pam_nologin.so	no_warn
-#auth		sufficient	pam_opie.so	no_warn
+auth		sufficient	pam_opie.so	no_warn no_fake_prompts
+auth		requisite	pam_opieaccess.so	no_warn
 #auth		sufficient	pam_kerberosIV.so	no_warn try_first_pass
 #auth		sufficient	pam_krb5.so	no_warn try_first_pass
 #auth		required	pam_ssh.so	no_warn try_first_pass
diff --git a/etc/pam.d/login b/etc/pam.d/login
index ab7046b..0e2cfa7 100644
--- a/etc/pam.d/login
+++ b/etc/pam.d/login
@@ -6,7 +6,8 @@
 
 # auth
 auth		required	pam_nologin.so	no_warn
-#auth		sufficient	pam_opie.so	no_warn
+auth		sufficient	pam_opie.so	no_warn no_fake_prompts
+auth		requisite	pam_opieaccess.so	no_warn
 #auth		sufficient	pam_kerberosIV.so	no_warn try_first_pass
 #auth		sufficient	pam_krb5.so	no_warn try_first_pass
 #auth		required	pam_ssh.so	no_warn try_first_pass
@@ -24,7 +25,6 @@ account		required	pam_unix.so
 session		required	pam_unix.so
 
 # password
-#password	sufficient	pam_opie.so	no_warn
 #password	sufficient	pam_kerberosIV.so	no_warn try_first_pass
 #password	sufficient	pam_krb5.so	no_warn try_first_pass
 password	required	pam_unix.so	no_warn try_first_pass
diff --git a/etc/pam.d/other b/etc/pam.d/other
index f4f758c..8ef6774 100644
--- a/etc/pam.d/other
+++ b/etc/pam.d/other
@@ -6,7 +6,8 @@
 
 # auth
 auth		required	pam_nologin.so	no_warn
-#auth		required	pam_opie.so	no_warn
+auth		sufficient	pam_opie.so	no_warn no_fake_prompts
+auth		requisite	pam_opieaccess.so	no_warn
 auth		required	pam_unix.so	no_warn try_first_pass
 
 # account
diff --git a/etc/pam.d/pop3 b/etc/pam.d/pop3
index 0cc10fb..3657f12 100644
--- a/etc/pam.d/pop3
+++ b/etc/pam.d/pop3
@@ -6,6 +6,7 @@
 
 # auth
 #auth		required	pam_nologin.so	no_warn
-#auth		required	pam_opie.so	no_warn
+#auth		sufficient	pam_opie.so	no_warn no_fake_prompts
+#auth		requisite	pam_opieaccess.so	no_warn
 #auth		required	pam_ssh.so	no_warn try_first_pass
 #auth		required	pam_unix.so	no_warn try_first_pass
diff --git a/etc/pam.d/su b/etc/pam.d/su
index 8e3a9bc..81aa1b1 100644
--- a/etc/pam.d/su
+++ b/etc/pam.d/su
@@ -9,33 +9,45 @@ auth		sufficient	pam_rootok.so	no_warn
 auth		requisite	pam_wheel.so	no_warn auth_as_self noroot_ok
 #auth		sufficient	pam_kerberosIV.so	no_warn
 #auth		sufficient	pam_krb5.so	no_warn try_first_pass auth_as_self
-#auth		required	pam_opie.so	no_warn
+auth		sufficient	pam_opie.so	no_warn no_fake_prompts
+auth		requisite	pam_opieaccess.so	no_warn
 #auth		required	pam_ssh.so	no_warn try_first_pass
 auth		required	pam_unix.so	no_warn try_first_pass nullok
-#auth		sufficient	pam_rootok.so	no_warn
-##auth		sufficient	pam_kerberosIV.so	no_warn
-##auth		sufficient	pam_krb5.so	no_warn
-#auth		required	pam_opie.so	no_warn auth_as_self
-#auth		required	pam_unix.so	no_warn try_first_pass auth_as_self
 
 # account
 #account	required	pam_kerberosIV.so
 #account	required	pam_krb5.so
 account		required	pam_unix.so
-##account	required	pam_kerberosIV.so
-##account	required	pam_krb5.so
-#account	required	pam_unix.so
 
 # session
 #session	required	pam_kerberosIV.so
 #session	required	pam_krb5.so
 #session	required	pam_ssh.so
 session		required	pam_unix.so
+
+# password
+password	required	pam_permit.so
+
+
+# If you want a "WHEELSU"-type su(1), then comment out the
+# above, and uncomment the entries below.
+## auth
+#auth		sufficient	pam_rootok.so	no_warn
+##auth		sufficient	pam_kerberosIV.so	no_warn
+##auth		sufficient	pam_krb5.so	no_warn
+#auth		required	pam_opie.so	no_warn auth_as_self no_fake_prompts
+#auth		required	pam_unix.so	no_warn try_first_pass auth_as_self
+
+## account
+##account	required	pam_kerberosIV.so
+##account	required	pam_krb5.so
+#account	required	pam_unix.so
+
+## session
 ##session	required	pam_kerberosIV.so
 ##session	required	pam_krb5.so
 ##session	required	pam_ssh.so
 #session	required	pam_unix.so
 
-# password
-password	required	pam_permit.so
+## password
 #password	required	pam_permit.so