rpms/krb5
6
0
Fork 0
Code Issues Pull Requests Releases Activity

- in login, allow PAM to interact with the user when they've been strongly

Browse Source 
authenticated
- in login, signal PAM when we're changing an expired password that it's an
    expired password, so that when cracklib flags a password as being weak
    it's treated as an error even if we're running as root
This commit is contained in:
Nalin Dahyabhai 2008-02-25 18:33:34 +00:00
parent ea9df965b8
commit a7d42c7b03
2 changed files with 10 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
krb5-1.6.1-pam.patch
View File

@ -240,7 +240,7 @@ When enabled, ftpd, krshd, and login.krb5 gain dependence on libpam.
+#ifdef USE_PAM +#ifdef USE_PAM
+ if (login_use_pam) { + if (login_use_pam) {
+ if (appl_pam_acct_mgmt(LOGIN_PAM_SERVICE, 0, username, "", + if (appl_pam_acct_mgmt(LOGIN_PAM_SERVICE, 1, username, "",
+ ttyname(STDIN_FILENO)) != 0) { + ttyname(STDIN_FILENO)) != 0) {
+ printf("Login incorrect\n"); + printf("Login incorrect\n");
+ sleepexit(1); + sleepexit(1);
@ -652,9 +652,9 @@ When enabled, ftpd, krshd, and login.krb5 gain dependence on libpam.
+ int ret = 0; + int ret = 0;
+ if (appl_pam_started) { + if (appl_pam_started) {
+#ifdef DEBUG +#ifdef DEBUG
+ printf("Changing PAM authentication token.\n"); + printf("Changing PAM expired authentication token.\n");
+#endif +#endif
+ ret = pam_chauthtok(appl_pamh, 0); + ret = pam_chauthtok(appl_pamh, PAM_CHANGE_EXPIRED_AUTHTOK);
+ } + }
+ return ret; + return ret;
+} +}

7
krb5.spec
View File

@ -226,6 +226,13 @@ to obtain initial credentials from a KDC using a private key and a
certificate. certificate.
%changelog %changelog
* Mon Feb 25 2008 Nalin Dahyabhai <nalin@redhat.com>
- in login, allow PAM to interact with the user when they've been strongly
authenticated
- in login, signal PAM when we're changing an expired password that it's an
expired password, so that when cracklib flags a password as being weak it's
treated as an error even if we're running as root
* Mon Feb 18 2008 Nalin Dahyabhai <nalin@redhat.com> 1.6.3-7 * Mon Feb 18 2008 Nalin Dahyabhai <nalin@redhat.com> 1.6.3-7
- drop netdb patch - drop netdb patch
- kdb_ldap: add patch to treat 'nsAccountLock: true' as an indication that - kdb_ldap: add patch to treat 'nsAccountLock: true' as an indication that