summaryrefslogtreecommitdiffstats
path: root/lib/libpam
Commit message (Collapse)AuthorAgeFilesLines
* Remove an unnecessary #include that trips up OpenPAM. The header in questiondes2002-02-021-2/+0
| | | | | | | | is an internal Linux-PAM header which shouldn't be used outside Linux-PAM itself, and has absolutely zero effect on pam_ftp. Sponsored by: DARPA, NAI Labs MFC after: 1 week
* Post-repocopy cleanup.des2002-02-012-7/+1
| | | | Sponsored by: DARPA, NAI Labs
* Connect the pam_lastlog(8) and pam_login_access(8) modules to the build.des2002-02-012-0/+4
| | | | Sponsored by: DARPA, NAI Labs
* Still with asbestos longjohns on, completely PAMify login(1) and removedes2002-01-301-19/+20
| | | | | | code made redundant by various PAM modules (primarily pam_unix(8)). Sponsored by: DARPA, NAI Labs
* With asbestos longjohns on, integrate most of the checks normally done bydes2002-01-301-32/+102
| | | | | | login(1) (password & account expiry, hosts.access etc.) into pam_unix(8). Sponsored by: DARPA, NAI Labs
* Move the code from pam_sm_authenticate() to pam_sm_acct_mgmt(). Simplifydes2002-01-302-62/+58
| | | | | | | | it a little and try to make it more resilient to various possible failure conditions. Change the man page accordingly, and take advantage of this opportunity to simplify its language. Sponsored by: DARPA, NAI Labs
* WARNS=4 fixes. Protect with NO_WERROR for the modules that havemarkm2002-01-2421-127/+138
| | | | warnings that are hard to fix or that I've been asked to leave alone.
* PAM modules shouldn't call putenv(); pam_putenv() is sufficient. Thedes2002-01-241-1/+0
| | | | | | | caller is supposed to check the PAM envlist and export the variables it contains; if it doesn't, it's broken. Sponsored by: DARPA, NAI Labs
* Change the order in which pam_sm_open_session() updates the logs. Thisdes2002-01-242-25/+14
| | | | | | | | | | | doesn't really make any difference, except it matches wtmp(5) better. Don't do anything in pam_sm_close_session(); init(8) will take care of utmp and wtmp when the tty is released. Clearing them here would make it possible to create a ghost session by logging in, running 'login -f $USER' and exiting the subshell. Sponsored by: DARPA, NAI Labs (but the bugs are all mine)
* Correctly interpret PAM_RHOST being unset as an indicator of a localdes2002-01-241-3/+2
| | | | | | login. Sponsored by: DARPA, NAI Labs
* Correctly interpret PAM_RHOST being unset as an indicator of a localdes2002-01-241-1/+5
| | | | login.
* Style nits.des2002-01-241-2/+2
| | | | Sponsored by: DARPA, NAI Labs
* Document the even_root option.des2002-01-241-1/+7
| | | | Sponsored by: DARPA, NAI Labs
* Don't let root through unless the "even_root" option was specified.des2002-01-241-2/+16
| | | | Sponsored by: DARPA, NAI Labs
* Add a PAM module that records sessions in utmp/wtmp/lastlog.des2002-01-243-0/+369
| | | | Sponsored by: DARPA, NAI Labs
* Fix some pastos. Rather shoddy of me...des2002-01-242-5/+5
| | | | Sponsored by: DARPA, NAI Labs
* Add a PAM module that provides an account management component for checkingdes2002-01-233-0/+285
| | | | | | | | | | | | | either PAM_RHOST or PAM_TTY against /etc/login.access.o This uncovers a problem with PAM_RHOST, in that if we always set it, there is no way to distinguish between a user logging in locally and a user logging in using 'ssh localhost'. This will be fixed by first making sure that all PAM modules can handle PAM_RHOST being unset (which is currently not the case), and then modifying su(1) and login(1) to not set it for local logins. Sponsored by: DARPA, NAI Labs
* Add an AUTHORS section crediting ThinkSec, DARPA and NAI Labs.des2002-01-232-2/+16
| | | | Sponsored by: DARPA, NAI Labs
* Add pam_ssh support to the static PAM library, libpam.a:ru2002-01-232-4/+5
| | | | | | | | | | | - Spam /usr/lib some more by making libssh a standard library. - Tweak ${LIBPAM} and ${MINUSLPAM}. - Garbage collect unused libssh_pic.a. - Add fake -lz dependency to secure/ makefiles needed for dynamic linkage with -lssh. Reviewed by: des, markm Approved by: markm
* Base the comparison on UIDs, not on user names.des2002-01-232-14/+12
| | | | Sponsored by: DARPA, NAI Labs
* Make libssh.so useable (undefined reference to IPv4or6).ru2002-01-231-2/+0
| | | | | Reviewed by: des, markm Approved by: markm
* Link pam_opieaccess, pam_self and pam_ssh into the static library.des2002-01-211-0/+3
| | | | Sponsored by: DARPA, NAI Labs
* On second thought, getpwnam() failure should be treated just as if the userdes2002-01-211-4/+1
| | | | | | | existed, but had no OPIE key, i.e. PAM_IGNORE. Pointed out by: ache Sponsored by: DARPA, NAI Labs
* Return PAM_SERVICE_ERR rather than PAM_USER_UNKNOWN if getpwnam() fails, asdes2002-01-211-1/+1
| | | | | | | PAM_USER_UNKNOWN will break the chain, revealing to an attacker that the user does not exist. Sponsored by: DARPA, NAI Labs
* Further changes to allow enabling pam_opie(8) by default:des2002-01-212-12/+38
| | | | | | | | | | | | | | | - Ignore the {try,use}_first_pass options by clearing PAM_AUTHTOK before challenging the user. These options are meaningless for pam_opie(8) since the user can't possibly know the right response before she sees the challenge. - Introduce the no_fake_prompts option. If this option is set, pam_opie(8) will fail - rather than present a bogus challenge - if the target user does not have an OPIE key. With this option, users who haven't set up OPIE won't have to wonder what that "weird otp-md5 s**t" means :) Reviewed by: ache, markm Sponsored by: DARPA, NAI Labs
* Add a new module, pam_opieaccess(8), which is responsible for checkingdes2002-01-215-0/+300
| | | | | | | | /etc/opieaccess and ~/.opiealways so we can decide what to do after pam_opie(8) fails. Sponsored by: DARPA, NAI Labs Reviewed by: ache, markm
* snprintf bloat -> strlcpyache2002-01-201-2/+3
| | | | | | Add getpwnam return check Approved by: des, markm
* Back out recent changesache2002-01-192-31/+19
|
* If user not exist in OPIE system, return failure immediately insteadache2002-01-191-1/+1
| | | | | of producing fake prompts with random numbers which can be detected by potential intruder in two tries and totally confuse non-OPIE users.
* Back out second right-now-expired password check in pam_sm_chauthtok,ache2002-01-191-2/+1
| | | | old expired password assumed there
* Previous commit was incomplete, use new error code PAM_CRED_ERR toache2002-01-191-2/+1
| | | | indicate die case, different from PAM_SUCCESS and PAM_AUTH_ERR
* Rewrite 'pwok' fallback in the way it can be properly chained with pam_unixache2002-01-191-19/+10
| | | | | | Replace snprintf %s with strlcpy Check for NULL returned from getpwnam()
* Add yet one expired-right-now password check, in pam_sm_chauthtokache2002-01-191-13/+12
| | | | | srandomdev() can't be used in libraries, replace srandomdev()+random() by arc4random()
* Set pwok to 1 for non-OPIE usersache2002-01-191-2/+2
|
* Add missing check for right-now-expired passwordache2002-01-191-0/+2
|
* Implement 'pwok', i.e. conditional fallback to unix passwordache2002-01-191-5/+27
| | | | as supposed by opieaccessfile() and opiealways()
* Fixed a missing "const".bde2001-12-281-1/+1
|
* mdoc(7) police: bump document date.ru2001-12-141-1/+1
|
* Style improvements recommended by Bruce as a follow up to somedwmalone2001-12-101-5/+6
| | | | | | | | of the recent WARNS commits. The idea is: 1) FreeBSD id tags should follow vendor tags. 2) Vendor tags should not be compiled (though copyrights probably should). 3) There should be no blank line between including cdefs and __FBSDIF.
* Back out previous commit.des2001-12-091-2/+1
| | | | Requested by: ru
* mdoc(7) police: sort xrefs.ru2001-12-081-5/+5
|
* Get pam_mod_misc.h from .CURDIR rather than .OBJDIR or /usr/include.des2001-12-071-1/+2
| | | | Sponsored by: DARPA, NAI Labs
* Now that _pam_init_handlers() works as intended, it seems clear that wedes2001-12-071-1/+1
| | | | | | | do not actually want to define PAM_READ_BOTH_CONFS, so back out previous commit. Sponsored by: DARPA, NAI Labs
* We need pam_client.h from libpamc. This unbreaks worlddes2001-12-061-0/+6
| | | | | Pointed out by: jhay Pointy hat to: des
* Define PAM_READ_BOTH_CONFS. We can now have both /etc/pam.d anddes2001-12-051-1/+1
| | | | | | /etc/pam.conf. Sponsored by: DARPA, NAI Labs
* Install the correct version of pam_misc.h.des2001-12-051-1/+1
| | | | Sponsored by: DARPA, NAI Labs
* Add dummy functions for all module types. These dummies return PAM_IGNOREdes2001-12-059-6/+542
| | | | | | | rather than PAM_SUCCESS, so you'll get a failure if you list dummies but no real modules for a particular module chain. Sponsored by: DARPA, NAI Labs
* Connect the man page to the build.des2001-12-051-0/+1
| | | | Sponsored by: DARPA, NAI Labs
* Add a pam_self authentication module that succeeds if and only if the localdes2001-12-054-0/+257
| | | | | | and remote user names are the same. Sponsored by: DARPA, NAI Labs
* Use __FBSDID(). Also do a bit of cosmetic #if and header-ordermarkm2001-12-021-1/+4
| | | | cleaning-up.
OpenPOWER on IntegriCloud