summaryrefslogtreecommitdiffstats
path: root/lib/libpam
Commit message (Collapse)AuthorAgeFilesLines
* Create /var/log/lastlog if it doesn't exist.sobomax2002-02-201-1/+1
| | | | Submitted by: des
* This file needs <syslog.h>.des2002-02-091-0/+1
| | | | Sponsored by: DARPA, NAI Labs
* Now that cross-tools ld(1) has been fixed to look for dynamicru2002-02-081-2/+2
| | | | | | | | | | dependencies in the correct place, record the fact that -lssh depends on -lcrypto and -lz. Removed false dependencies on -lz (except ssh(1) and sshd(8)). Removed false dependencies on -lcrypto and -lutil for scp(1). Reviewed by: markm
* Remove NO_WERROR, now that WARNS=n is gone.markm2002-02-065-5/+0
|
* Comment out the WARNS= so as to not trample all over the GCC3 work.markm2002-02-061-1/+1
|
* Three times lucky: <stddef.h>, not <sys/param.h>des2002-02-052-2/+2
|
* Oops, the correct header to include for NULL is <sys/param.h>.des2002-02-052-2/+2
|
* #include <sys/types.h> for NULL (hidden by Linux-PAM header pollution)des2002-02-052-0/+4
| | | | Sponsored by: DARPA, NAI Labs
* #include cleanup.des2002-02-0518-24/+35
| | | | Sponsored by: DARPA, NAI Labs
* Explicitly declare (gcc internal) functions.markm2002-02-041-0/+1
| | | | Submitted by: ru
* ssh_get_authentication_connection() gets its parameters from environmentdes2002-02-041-2/+24
| | | | | | variables, so temporarily switch to the PAM environment before calling it. Submitted by: Takanori Saneto <sanewo@ba2.so-net.ne.jp>
* Protect "make buildworld" against -Werror, as this module does notmarkm2002-02-041-0/+1
| | | | build cleanly.
* Add the other half of the salt-generating code. No functionalmarkm2002-02-041-8/+7
| | | | | difference except that the salt is slightly harder to build dictionaries against, and the code does not use srandom[dev]().
* Turn on fascist warning mode.markm2002-02-031-0/+2
|
* WARNS=n fixes (and some stylistic issues).markm2002-02-036-55/+91
|
* Remove an unnecessary #include that trips up OpenPAM. The header in questiondes2002-02-021-2/+0
| | | | | | | | is an internal Linux-PAM header which shouldn't be used outside Linux-PAM itself, and has absolutely zero effect on pam_ftp. Sponsored by: DARPA, NAI Labs MFC after: 1 week
* Post-repocopy cleanup.des2002-02-012-7/+1
| | | | Sponsored by: DARPA, NAI Labs
* Connect the pam_lastlog(8) and pam_login_access(8) modules to the build.des2002-02-012-0/+4
| | | | Sponsored by: DARPA, NAI Labs
* Still with asbestos longjohns on, completely PAMify login(1) and removedes2002-01-301-19/+20
| | | | | | code made redundant by various PAM modules (primarily pam_unix(8)). Sponsored by: DARPA, NAI Labs
* With asbestos longjohns on, integrate most of the checks normally done bydes2002-01-301-32/+102
| | | | | | login(1) (password & account expiry, hosts.access etc.) into pam_unix(8). Sponsored by: DARPA, NAI Labs
* Move the code from pam_sm_authenticate() to pam_sm_acct_mgmt(). Simplifydes2002-01-302-62/+58
| | | | | | | | it a little and try to make it more resilient to various possible failure conditions. Change the man page accordingly, and take advantage of this opportunity to simplify its language. Sponsored by: DARPA, NAI Labs
* WARNS=4 fixes. Protect with NO_WERROR for the modules that havemarkm2002-01-2421-127/+138
| | | | warnings that are hard to fix or that I've been asked to leave alone.
* PAM modules shouldn't call putenv(); pam_putenv() is sufficient. Thedes2002-01-241-1/+0
| | | | | | | caller is supposed to check the PAM envlist and export the variables it contains; if it doesn't, it's broken. Sponsored by: DARPA, NAI Labs
* Change the order in which pam_sm_open_session() updates the logs. Thisdes2002-01-242-25/+14
| | | | | | | | | | | doesn't really make any difference, except it matches wtmp(5) better. Don't do anything in pam_sm_close_session(); init(8) will take care of utmp and wtmp when the tty is released. Clearing them here would make it possible to create a ghost session by logging in, running 'login -f $USER' and exiting the subshell. Sponsored by: DARPA, NAI Labs (but the bugs are all mine)
* Correctly interpret PAM_RHOST being unset as an indicator of a localdes2002-01-241-3/+2
| | | | | | login. Sponsored by: DARPA, NAI Labs
* Correctly interpret PAM_RHOST being unset as an indicator of a localdes2002-01-241-1/+5
| | | | login.
* Style nits.des2002-01-241-2/+2
| | | | Sponsored by: DARPA, NAI Labs
* Document the even_root option.des2002-01-241-1/+7
| | | | Sponsored by: DARPA, NAI Labs
* Don't let root through unless the "even_root" option was specified.des2002-01-241-2/+16
| | | | Sponsored by: DARPA, NAI Labs
* Add a PAM module that records sessions in utmp/wtmp/lastlog.des2002-01-243-0/+369
| | | | Sponsored by: DARPA, NAI Labs
* Fix some pastos. Rather shoddy of me...des2002-01-242-5/+5
| | | | Sponsored by: DARPA, NAI Labs
* Add a PAM module that provides an account management component for checkingdes2002-01-233-0/+285
| | | | | | | | | | | | | either PAM_RHOST or PAM_TTY against /etc/login.access.o This uncovers a problem with PAM_RHOST, in that if we always set it, there is no way to distinguish between a user logging in locally and a user logging in using 'ssh localhost'. This will be fixed by first making sure that all PAM modules can handle PAM_RHOST being unset (which is currently not the case), and then modifying su(1) and login(1) to not set it for local logins. Sponsored by: DARPA, NAI Labs
* Add an AUTHORS section crediting ThinkSec, DARPA and NAI Labs.des2002-01-232-2/+16
| | | | Sponsored by: DARPA, NAI Labs
* Add pam_ssh support to the static PAM library, libpam.a:ru2002-01-232-4/+5
| | | | | | | | | | | - Spam /usr/lib some more by making libssh a standard library. - Tweak ${LIBPAM} and ${MINUSLPAM}. - Garbage collect unused libssh_pic.a. - Add fake -lz dependency to secure/ makefiles needed for dynamic linkage with -lssh. Reviewed by: des, markm Approved by: markm
* Base the comparison on UIDs, not on user names.des2002-01-232-14/+12
| | | | Sponsored by: DARPA, NAI Labs
* Make libssh.so useable (undefined reference to IPv4or6).ru2002-01-231-2/+0
| | | | | Reviewed by: des, markm Approved by: markm
* Link pam_opieaccess, pam_self and pam_ssh into the static library.des2002-01-211-0/+3
| | | | Sponsored by: DARPA, NAI Labs
* On second thought, getpwnam() failure should be treated just as if the userdes2002-01-211-4/+1
| | | | | | | existed, but had no OPIE key, i.e. PAM_IGNORE. Pointed out by: ache Sponsored by: DARPA, NAI Labs
* Return PAM_SERVICE_ERR rather than PAM_USER_UNKNOWN if getpwnam() fails, asdes2002-01-211-1/+1
| | | | | | | PAM_USER_UNKNOWN will break the chain, revealing to an attacker that the user does not exist. Sponsored by: DARPA, NAI Labs
* Further changes to allow enabling pam_opie(8) by default:des2002-01-212-12/+38
| | | | | | | | | | | | | | | - Ignore the {try,use}_first_pass options by clearing PAM_AUTHTOK before challenging the user. These options are meaningless for pam_opie(8) since the user can't possibly know the right response before she sees the challenge. - Introduce the no_fake_prompts option. If this option is set, pam_opie(8) will fail - rather than present a bogus challenge - if the target user does not have an OPIE key. With this option, users who haven't set up OPIE won't have to wonder what that "weird otp-md5 s**t" means :) Reviewed by: ache, markm Sponsored by: DARPA, NAI Labs
* Add a new module, pam_opieaccess(8), which is responsible for checkingdes2002-01-215-0/+300
| | | | | | | | /etc/opieaccess and ~/.opiealways so we can decide what to do after pam_opie(8) fails. Sponsored by: DARPA, NAI Labs Reviewed by: ache, markm
* snprintf bloat -> strlcpyache2002-01-201-2/+3
| | | | | | Add getpwnam return check Approved by: des, markm
* Back out recent changesache2002-01-192-31/+19
|
* If user not exist in OPIE system, return failure immediately insteadache2002-01-191-1/+1
| | | | | of producing fake prompts with random numbers which can be detected by potential intruder in two tries and totally confuse non-OPIE users.
* Back out second right-now-expired password check in pam_sm_chauthtok,ache2002-01-191-2/+1
| | | | old expired password assumed there
* Previous commit was incomplete, use new error code PAM_CRED_ERR toache2002-01-191-2/+1
| | | | indicate die case, different from PAM_SUCCESS and PAM_AUTH_ERR
* Rewrite 'pwok' fallback in the way it can be properly chained with pam_unixache2002-01-191-19/+10
| | | | | | Replace snprintf %s with strlcpy Check for NULL returned from getpwnam()
* Add yet one expired-right-now password check, in pam_sm_chauthtokache2002-01-191-13/+12
| | | | | srandomdev() can't be used in libraries, replace srandomdev()+random() by arc4random()
* Set pwok to 1 for non-OPIE usersache2002-01-191-2/+2
|
* Add missing check for right-now-expired passwordache2002-01-191-0/+2
|
OpenPOWER on IntegriCloud