summaryrefslogtreecommitdiffstats
path: root/lib/libpam
Commit message (Collapse)AuthorAgeFilesLines
* Experimental pam_chroot module (not connected to the build)des2003-03-303-0/+193
|
* This module is not WARNS-clean, due to brokenness in OpenSSL headers.des2003-03-101-0/+1
|
* Somewhat better wording.des2003-03-101-8/+6
|
* Silence warning caused by OPIE brokenness.des2003-03-101-2/+3
|
* style.Makefile(5) policeobrien2003-03-0928-221/+223
| | | | | | (I've tried to keep to the spirit of the original formatting) Reviewed by: des
* KerberosIV de-orbit burn continues. Remove the KerberosIV PAM module.markm2003-03-087-454/+0
|
* Comment-only assistance to lint to kill warnings.markm2003-03-081-0/+4
|
* mdoc(7) police: Nits.ru2003-03-032-4/+4
|
* mdoc(7) police: markup laundry.ru2003-02-232-2/+2
|
* Add an "allow_local" option which forces historical behaviour.des2003-02-162-2/+20
|
* Assume "localhost" if no remote host was specified. This is safe from ades2003-02-151-3/+4
| | | | POLA point of view since the stock /etc/opieaccess now allows localhost.
* Use pam_get_user(3) instead of pam_get_item(3) where appropriate.des2003-02-102-4/+4
|
* Complete rewrite of pam_ssh(8). The previous version was becoming harddes2003-02-094-557/+307
| | | | | | | | | | | to maintain, and had security issues which would have required a major rewrite to address anyway. This implementation currently starts a separate agent for each session instead of connecting each new session to the agent started by the first one. While this would be a Good Thing (and the old pam_ssh(8) tried to do it), it's hard to get right. I'll revisit this issue when I've had a chance to test some modifications to ssh-agent(1).
* Maybe I was a little too fast? Remove debugging code, and commit thedes2003-02-063-2/+90
| | | | | | Makefile and man page which I'd forgotten to 'cvs add'. Sponsored by: DARPA, NAI Labs
* Replace pam_wheel(8) with pam_group(8) which has a cleaner interface. Thedes2003-02-062-1/+119
| | | | | | | | | | pam_wheel(8) module was written to work in spite of a broken libpam, and has grown organically since its inception, which is reflected in both its functionality and implementation. Rather than clean up pam_wheel(8) and break backward compatibility, I've chosen to reimplement it under a new, more generic name. Sponsored by: DARPA, NAI Labs
* Make sure the message is only printed once.des2003-02-061-3/+5
|
* Don't blame markm for what he didn't do - writing these man pages, fordes2003-02-062-6/+2
| | | | | instance. Also bump the date since I made substantial modifications earlier today.
* Update copyright.des2003-02-061-1/+1
|
* Add support for escape sequences in the arguments (e.g. %u for user name)des2003-02-062-24/+82
| | | | Sponsored by: DARPA, NAI Labs
* Export the PAM environment to the child process instead of the "normal"des2003-02-062-3/+12
| | | | | | environment list, which may be unsafe and / or sensitive. Sponsored by: DARPA, NAI Labs
* Minimal manual page for pam_kerberosIV(8).des2003-02-062-0/+66
| | | | Sponsored by: DARPA, NAI Labs
* In pam_sm_acct_mgmt(), retrieve the cached credentials before trying todes2003-02-031-3/+6
| | | | | | initialize the context. This way, a failure to initialize the context is not fatal unless we actually have work to do - because if we don't, we return PAM_SUCCESS without even trying to initialize the context.
* Whitespace cleanupdes2003-02-031-3/+3
|
* OpenPAMify.des2003-02-021-33/+10
|
* Do not return inappropriate error codes in pam_sm_setcred.nectar2003-01-291-1/+4
|
* About September 2001, I consulted with all the previous authors ofnectar2003-01-101-163/+13
| | | | | | pam_krb5 to consolidate the copyright texts. The semi-official pam_krb5 module has been distributed with this new license text ever since, but I'm just now getting around to updating the text here.
* english(4) police.schweikh2002-12-273-3/+3
|
* mdoc(7) police: removed gratuitous .Pp call.ru2002-12-231-1/+0
|
* Merge in most non-style differences from Andrew Korty's pam_ssh 1.7.des2002-12-163-51/+70
|
* mdoc(7) police: .Dt is ALL UPPERCASE.ru2002-12-121-1/+1
| | | | Approved by: re
* mdoc(7) police: formatting nits.ru2002-11-292-3/+6
| | | | Approved by: re
* Whitespace nits.des2002-11-281-2/+2
| | | | Approved by: re (bmah)
* Add a PAM_MODULE_ENTRY to this module so it'll actually do something.des2002-11-281-0/+2
| | | | Approved by: re (bmah)
* utmp.ut_time and lastlog.ll_time are explicitly int32_t rather thanpeter2002-11-151-4/+6
| | | | | | | | | | | | time_t. Deal with the possibility that time_t != int32_t. This boils down to this sort of thing: - time(&ut.ut_time); + ut.ut_time = time(NULL); and similar for ctime(3) etc. I've kept it minimal for the stuff that may need to be portable (or 3rd party code), but used Matt's time32 stuff for cases where that isn't as much of a concern. Approved by: re (jhb)
* Make dynamic PAM modules depend on dynamic PAM library.ru2002-11-141-4/+7
| | | | Requested by: des, markm
* The pam_krb5 module stored a reference to a krb5_ccache structure asnectar2002-11-131-20/+42
| | | | | | | | | | | | | | | | | PAM module state (created in pam_sm_authenticate and referenced later in pam_sm_setcred and pam_sm_acct_mgmt). However, the krb5_ccache structure shares some data members with the krb5_context structure that was used in its creation. Since a new krb5_context is created and destroyed at each PAM entry point, this inevitably caused the krb5_ccache structure to reference free'd memory. Now instead of storing a pointer to the krb5_ccache structure, we store the name of the cache (e.g. `MEMORY:0x123CACHE') in pam_sm_authenticate, and resolve the name in the other entry points. This bug was uncovered by phkmalloc's free'd memory scrubbing. Approved by: re (jhb)
* Use `krb5_get_err_text' instead of `error_message' so that instead ofnectar2002-11-131-24/+47
| | | | | | | | | | | | | | | | | e.g. Unknown error: -1765328378 we get Client not found in Kerberos database Another way to accomplish this would have been to leave `error_message' alone, but to explicitly load the Kerberos com_err error tables. However, I don't really like the idea of a PAM module dorking with global tables. Approved by: re (jhb)
* Allow the admin to specify a different NAS identifier than the hostname.des2002-10-282-11/+20
| | | | Submitted by: Boris Kovalenko <boris@ntmk.ru>
* Introduce 'exempt_if_empty' option to pam_wheel(8), which bypasses therwatson2002-10-182-2/+18
| | | | | | | | | | group membership requirement if the group has no explicit members listed in /etc/group. By default, this group is the wheel group; setting this flag restores the default BSD behavior from 4.x. Reviewed by: markm Requested by: various Sponsored by: DARPA, Network Associates Laboratories
* Build kerberized versions of the PAM library, and install themru2002-10-111-0/+8
| | | | | | | into corresponding distributions during "make release". (This also cleans the "slib" distribution up from the .o files.) PR: misc/43825 (inspired by)
* Zap now-unused SHLIB_MINORpeter2002-09-281-1/+0
|
* Initiate deorbit burn for the i386-only a.out related support. Moves arepeter2002-09-171-4/+0
| | | | | | | | | | | | | | | under way to move the remnants of the a.out toolchain to ports. As the comment in src/Makefile said, this stuff is deprecated and one should not expect this to remain beyond 4.0-REL. It has already lasted WAY beyond that. Notable exceptions: gcc - I have not touched the a.out generation stuff there. ldd/ldconfig - still have some code to interface with a.out rtld. old as/ld/etc - I have not removed these yet, pending their move to ports. some includes - necessary for ldd/ldconfig for now. Tested on: i386 (extensively), alpha
* Since pam_get_authtok(3) doesn't know about our options structure, settingdes2002-07-301-10/+11
| | | | | | | | the PAM_ECHO_PASS option on-the-fly is a NOP (though it wasn't with the old pam_get_pass(3) code). Instead, call pam_prompt(3) directly. This actually simplifies the code a bit. MFC after: 3 days
* Install more man pages - I thought I'd committed this ages ago...des2002-07-231-0/+5
|
* Tidy up.ru2002-06-061-10/+3
|
* Missed one in previous commit.des2002-05-301-2/+4
| | | | Pointed out by: nectar
* mdoc(7) police: kill whitespace at EOL.ru2002-05-301-1/+1
|
* mdoc(7) police: polish markup.ru2002-05-301-34/+68
|
* mdoc(7) police: tidy up the markup.ru2002-05-301-6/+15
|
* Add pam_ksu(8), a module to do Kerberos 5 authentication andnectar2002-05-284-0/+412
| | | | | | $HOME/.k5login authorization for su(1). Reviewed by: des (earlier version)
OpenPOWER on IntegriCloud