rpms/pam
7
0
Fork 0
Code Issues Pull Requests Releases Activity
51793e1639
pam/SOURCES/pam-1.3.1-faillock-update.patch

1187 lines
40 KiB
Diff
Raw Normal View History

import pam-1.3.1-8.el8
2020-01-21 15:35:12 +00:00
diff -up Linux-PAM-1.3.1/modules/pam_faillock/faillock.c.faillock-update Linux-PAM-1.3.1/modules/pam_faillock/faillock.c
--- Linux-PAM-1.3.1/modules/pam_faillock/faillock.c.faillock-update 2019-10-16 16:49:27.026893768 +0200
+++ Linux-PAM-1.3.1/modules/pam_faillock/faillock.c 2019-12-16 17:55:27.042001068 +0100
@@ -1,5 +1,6 @@
/*
* Copyright (c) 2010 Tomas Mraz <tmraz@redhat.com>
+ * Copyright (c) 2010, 2016, 2017 Red Hat, Inc.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
@@ -47,6 +48,8 @@
#include "faillock.h"
+#define ignore_return(x) if (1==((int)x)) {;}
+
int
open_tally (const char *dir, const char *user, uid_t uid, int create)
{
@@ -54,7 +57,7 @@ open_tally (const char *dir, const char
int flags = O_RDWR;
int fd;
- if (strstr(user, "../") != NULL)
+ if (dir == NULL || strstr(user, "../") != NULL)
/* just a defensive programming as the user must be a
* valid user on the system anyway
*/
@@ -83,7 +86,7 @@ open_tally (const char *dir, const char
while (flock(fd, LOCK_EX) == -1 && errno == EINTR);
if (fstat(fd, &st) == 0) {
if (st.st_uid != uid) {
- fchown(fd, uid, -1);
+ ignore_return(fchown(fd, uid, -1));
}
}
}
@@ -121,7 +124,7 @@ read_tally(int fd, struct tally_data *ta
if (count >= MAX_RECORDS)
break;
}
- while (chunk == CHUNK_SIZE);
+ while (chunk == CHUNK_SIZE);
tallies->records = data;
tallies->count = count;
diff -up Linux-PAM-1.3.1/modules/pam_faillock/faillock.conf.5.xml.faillock-update Linux-PAM-1.3.1/modules/pam_faillock/faillock.conf.5.xml
--- Linux-PAM-1.3.1/modules/pam_faillock/faillock.conf.5.xml.faillock-update 2019-10-16 17:34:58.073276020 +0200
+++ Linux-PAM-1.3.1/modules/pam_faillock/faillock.conf.5.xml 2019-10-16 16:26:05.000000000 +0200
@@ -0,0 +1,243 @@
+<?xml version="1.0" encoding='UTF-8'?>
+<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.3//EN"
+ "http://www.oasis-open.org/docbook/xml/4.3/docbookx.dtd">
+
+<refentry id="faillock.conf">
+
+ <refmeta>
+ <refentrytitle>faillock.conf</refentrytitle>
+ <manvolnum>5</manvolnum>
+ <refmiscinfo class="sectdesc">Linux-PAM Manual</refmiscinfo>
+ </refmeta>
+
+ <refnamediv id="faillock.conf-name">
+ <refname>faillock.conf</refname>
+ <refpurpose>pam_faillock configuration file</refpurpose>
+ </refnamediv>
+
+ <refsect1 id="faillock.conf-description">
+
+ <title>DESCRIPTION</title>
+ <para>
+ <emphasis remap='B'>faillock.conf</emphasis> provides a way to configure the
+ default settings for locking the user after multiple failed authentication attempts.
+ This file is read by the <emphasis>pam_faillock</emphasis> module and is the
+ preferred method over configuring <emphasis>pam_faillock</emphasis> directly.
+ </para>
+ <para>
+ The file has a very simple <emphasis>name = value</emphasis> format with possible comments
+ starting with <emphasis>#</emphasis> character. The whitespace at the beginning of line, end
+ of line, and around the <emphasis>=</emphasis> sign is ignored.
+ </para>
+ </refsect1>
+
+ <refsect1 id="faillock.conf-options">
+
+ <title>OPTIONS</title>
+ <variablelist>
+ <varlistentry>
+ <term>
+ <option>dir=<replaceable>/path/to/tally-directory</replaceable></option>
+ </term>
+ <listitem>
+ <para>
+ The directory where the user files with the failure records are kept. The
+ default is <filename>/var/run/faillock</filename>.
+ </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <option>audit</option>
+ </term>
+ <listitem>
+ <para>
+ Will log the user name into the system log if the user is not found.
+ </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <option>silent</option>
+ </term>
+ <listitem>
+ <para>
+ Don't print informative messages to the user. Please note that when
+ this option is not used there will be difference in the authentication
+ behavior for users which exist on the system and non-existing users.
+ </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <option>no_log_info</option>
+ </term>
+ <listitem>
+ <para>
+ Don't log informative messages via <citerefentry><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
+ </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <option>local_users_only</option>
+ </term>
+ <listitem>
+ <para>
+ Only track failed user authentications attempts for local users
+ in /etc/passwd and ignore centralized (AD, IdM, LDAP, etc.) users.
+ The <citerefentry><refentrytitle>faillock</refentrytitle><manvolnum>8</manvolnum></citerefentry>
+ command will also no longer track user failed
+ authentication attempts. Enabling this option will prevent a
+ double-lockout scenario where a user is locked out locally and
+ in the centralized mechanism.
+ </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <option>deny=<replaceable>n</replaceable></option>
+ </term>
+ <listitem>
+ <para>
+ Deny access if the number of consecutive authentication failures
+ for this user during the recent interval exceeds
+ <replaceable>n</replaceable>. The default is 3.
+ </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <option>fail_interval=<replaceable>n</replaceable></option>
+ </term>
+ <listitem>
+ <para>
+ The length of the interval during which the consecutive
+ authentication failures must happen for the user account
+ lock out is <replaceable>n</replaceable> seconds.
+ The default is 900 (15 minutes).
+ </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <option>unlock_time=<replaceable>n</replaceable></option>
+ </term>
+ <listitem>
+ <para>
+ The access will be reenabled after
+ <replaceable>n</replaceable> seconds after the lock out.
+ The value 0 has the same meaning as value
+ <emphasis>never</emphasis> - the access
+ will not be reenabled without resetting the faillock
+ entries by the <citerefentry><refentrytitle>faillock</refentrytitle><manvolnum>8</manvolnum></citerefentry> command.
+ The default is 600 (10 minutes).
+ </para>
+ <para>
+ Note that the default directory that <emphasis>pam_faillock</emphasis>
+ uses is usually cleared on system boot so the access will be also reenabled
+ after system reboot. If that is undesirable a different tally directory
+ must be set with the <option>dir</option> option.
+ </para>
+ <para>
+ Also note that it is usually undesirable to permanently lock
+ out the users as they can become easily a target of denial of service
+ attack unless the usernames are random and kept secret to potential
+ attackers.
+ </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <option>even_deny_root</option>
+ </term>
+ <listitem>
+ <para>
+ Root account can become locked as well as regular accounts.
+ </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <option>root_unlock_time=<replaceable>n</replaceable></option>
+ </term>
+ <listitem>
+ <para>
+ This option implies <option>even_deny_root</option> option.
+ Allow access after <replaceable>n</replaceable> seconds
+ to root account after the account is locked. In case the
+ option is not specified the value is the same as of the
+ <option>unlock_time</option> option.
+ </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <option>admin_group=<replaceable>name</replaceable></option>
+ </term>
+ <listitem>
+ <para>
+ If a group name is specified with this option, members
+ of the group will be handled by this module the same as
+ the root account (the options <option>even_deny_root</option>
+ and <option>root_unlock_time</option> will apply to them.
+ By default the option is not set.
+ </para>
+ </listitem>
+ </varlistentry>
+ </variablelist>
+ </refsect1>
+
+ <refsect1 id='faillock.conf-examples'>
+ <title>EXAMPLES</title>
+ <para>
+ /etc/security/faillock.conf file example:
+ </para>
+ <programlisting>
+deny=4
+unlock_time=1200
+silent
+ </programlisting>
+ </refsect1>
+
+ <refsect1 id="faillock.conf-files">
+ <title>FILES</title>
+ <variablelist>
+ <varlistentry>
+ <term><filename>/etc/security/faillock.conf</filename></term>
+ <listitem>
+ <para>the config file for custom options</para>
+ </listitem>
+ </varlistentry>
+ </variablelist>
+ </refsect1>
+
+ <refsect1 id='faillock.conf-see_also'>
+ <title>SEE ALSO</title>
+ <para>
+ <citerefentry>
+ <refentrytitle>faillock</refentrytitle><manvolnum>8</manvolnum>
+ </citerefentry>,
+ <citerefentry>
+ <refentrytitle>pam_faillock</refentrytitle><manvolnum>8</manvolnum>
+ </citerefentry>,
+ <citerefentry>
+ <refentrytitle>pam.conf</refentrytitle><manvolnum>5</manvolnum>
+ </citerefentry>,
+ <citerefentry>
+ <refentrytitle>pam.d</refentrytitle><manvolnum>5</manvolnum>
+ </citerefentry>,
+ <citerefentry>
+ <refentrytitle>pam</refentrytitle><manvolnum>8</manvolnum>
+ </citerefentry>
+ </para>
+ </refsect1>
+
+ <refsect1 id='faillock.conf-author'>
+ <title>AUTHOR</title>
+ <para>
+ pam_faillock was written by Tomas Mraz. The support for faillock.conf was written by Brian Ward.
+ </para>
+ </refsect1>
+
+</refentry>
diff -up Linux-PAM-1.3.1/modules/pam_faillock/faillock.conf.faillock-update Linux-PAM-1.3.1/modules/pam_faillock/faillock.conf
--- Linux-PAM-1.3.1/modules/pam_faillock/faillock.conf.faillock-update 2019-10-16 17:34:50.607405060 +0200
+++ Linux-PAM-1.3.1/modules/pam_faillock/faillock.conf 2019-10-16 16:26:05.000000000 +0200
@@ -0,0 +1,62 @@
+# Configuration for locking the user after multiple failed
+# authentication attempts.
+#
+# The directory where the user files with the failure records are kept.
+# The default is /var/run/faillock.
+# dir = /var/run/faillock
+#
+# Will log the user name into the system log if the user is not found.
+# Enabled if option is present.
+# audit
+#
+# Don't print informative messages.
+# Enabled if option is present.
+# silent
+#
+# Don't log informative messages via syslog.
+# Enabled if option is present.
+# no_log_info
+#
+# Only track failed user authentications attempts for local users
+# in /etc/passwd and ignore centralized (AD, IdM, LDAP, etc.) users.
+# The `faillock` command will also no longer track user failed
+# authentication attempts. Enabling this option will prevent a
+# double-lockout scenario where a user is locked out locally and
+# in the centralized mechanism.
+# Enabled if option is present.
+# local_users_only
+#
+# Deny access if the number of consecutive authentication failures
+# for this user during the recent interval exceeds n tries.
+# The default is 3.
+# deny = 3
+#
+# The length of the interval during which the consecutive
+# authentication failures must happen for the user account
+# lock out is <replaceable>n</replaceable> seconds.
+# The default is 900 (15 minutes).
+# fail_interval = 900
+#
+# The access will be reenabled after n seconds after the lock out.
+# The value 0 has the same meaning as value `never` - the access
+# will not be reenabled without resetting the faillock
+# entries by the `faillock` command.
+# The default is 600 (10 minutes).
+# unlock_time = 600
+#
+# Root account can become locked as well as regular accounts.
+# Enabled if option is present.
+# even_deny_root
+#
+# This option implies the `even_deny_root` option.
+# Allow access after n seconds to root account after the
+# account is locked. In case the option is not specified
+# the value is the same as of the `unlock_time` option.
+# root_unlock_time = 900
+#
+# If a group name is specified with this option, members
+# of the group will be handled by this module the same as
+# the root account (the options `even_deny_root>` and
+# `root_unlock_time` will apply to them.
+# By default, the option is not set.
+# admin_group = <admin_group_name>
diff -up Linux-PAM-1.3.1/modules/pam_faillock/faillock.h.faillock-update Linux-PAM-1.3.1/modules/pam_faillock/faillock.h
--- Linux-PAM-1.3.1/modules/pam_faillock/faillock.h.faillock-update 2019-10-16 16:49:27.026893768 +0200
+++ Linux-PAM-1.3.1/modules/pam_faillock/faillock.h 2019-10-16 16:51:40.431628566 +0200
@@ -65,6 +65,7 @@ struct tally_data {
};
#define FAILLOCK_DEFAULT_TALLYDIR "/var/run/faillock"
+#define FAILLOCK_DEFAULT_CONF "/etc/security/faillock.conf"
int open_tally(const char *dir, const char *user, uid_t uid, int create);
int read_tally(int fd, struct tally_data *tallies);
diff -up Linux-PAM-1.3.1/modules/pam_faillock/Makefile.am.faillock-update Linux-PAM-1.3.1/modules/pam_faillock/Makefile.am
--- Linux-PAM-1.3.1/modules/pam_faillock/Makefile.am.faillock-update 2019-10-16 16:49:27.026893768 +0200
+++ Linux-PAM-1.3.1/modules/pam_faillock/Makefile.am 2019-10-16 16:50:15.065078080 +0200
@@ -1,6 +1,6 @@
#
# Copyright (c) 2005, 2006, 2007, 2009 Thorsten Kukuk <kukuk@thkukuk.de>
-# Copyright (c) 2008 Red Hat, Inc.
+# Copyright (c) 2008, 2018 Red Hat, Inc.
# Copyright (c) 2010 Tomas Mraz <tmraz@redhat.com>
#
@@ -9,8 +9,8 @@ MAINTAINERCLEANFILES = $(MANS) README
EXTRA_DIST = README $(MANS) $(XMLS) tst-pam_faillock
-man_MANS = pam_faillock.8 faillock.8
-XMLS = README.xml pam_faillock.8.xml faillock.8.xml
+man_MANS = pam_faillock.8 faillock.8 faillock.conf.5
+XMLS = README.xml pam_faillock.8.xml faillock.8.xml faillock.conf.5.xml
TESTS = tst-pam_faillock
@@ -31,6 +31,8 @@ endif
faillock_LDFLAGS = -Wl,-z,now @PIE_LDFLAGS@
faillock_LDADD = -L$(top_builddir)/libpam -lpam $(LIBAUDIT)
+secureconf_DATA = faillock.conf
+
securelib_LTLIBRARIES = pam_faillock.la
sbin_PROGRAMS = faillock
diff -up Linux-PAM-1.3.1/modules/pam_faillock/pam_faillock.8.xml.faillock-update Linux-PAM-1.3.1/modules/pam_faillock/pam_faillock.8.xml
--- Linux-PAM-1.3.1/modules/pam_faillock/pam_faillock.8.xml.faillock-update 2019-10-16 16:49:27.030893701 +0200
+++ Linux-PAM-1.3.1/modules/pam_faillock/pam_faillock.8.xml 2019-10-16 16:53:39.544606052 +0200
@@ -126,141 +126,13 @@
</para>
</listitem>
</varlistentry>
- <varlistentry>
- <term>
- <option>dir=<replaceable>/path/to/tally-directory</replaceable></option>
- </term>
- <listitem>
- <para>
- The directory where the user files with the failure records are kept. The
- default is <filename>/var/run/faillock</filename>.
- </para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <option>audit</option>
- </term>
- <listitem>
- <para>
- Will log the user name into the system log if the user is not found.
- </para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <option>silent</option>
- </term>
- <listitem>
- <para>
- Don't print informative messages. This option is implicite
- in the <emphasis>authfail</emphasis> and <emphasis>authsucc</emphasis>
- functions.
- </para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <option>no_log_info</option>
- </term>
- <listitem>
- <para>
- Don't log informative messages via <citerefentry><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
- </para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <option>deny=<replaceable>n</replaceable></option>
- </term>
- <listitem>
- <para>
- Deny access if the number of consecutive authentication failures
- for this user during the recent interval exceeds
- <replaceable>n</replaceable>. The default is 3.
- </para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <option>fail_interval=<replaceable>n</replaceable></option>
- </term>
- <listitem>
- <para>
- The length of the interval during which the consecutive
- authentication failures must happen for the user account
- lock out is <replaceable>n</replaceable> seconds.
- The default is 900 (15 minutes).
- </para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <option>unlock_time=<replaceable>n</replaceable></option>
- </term>
- <listitem>
- <para>
- The access will be reenabled after
- <replaceable>n</replaceable> seconds after the lock out.
- The value 0 has the same meaning as value
- <emphasis>never</emphasis> - the access
- will not be reenabled without resetting the faillock
- entries by the <citerefentry><refentrytitle>faillock</refentrytitle><manvolnum>8</manvolnum></citerefentry> command.
- The default is 600 (10 minutes).
- </para>
- <para>
- Note that the default directory that <emphasis>pam_faillock</emphasis>
- uses is usually cleared on system boot so the access will be also reenabled
- after system reboot. If that is undesirable a different tally directory
- must be set with the <option>dir</option> option.
- </para>
- <para>
- Also note that it is usually undesirable to permanently lock
- out the users as they can become easily a target of denial of service
- attack unless the usernames are random and kept secret to potential
- attackers.
- </para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <option>even_deny_root</option>
- </term>
- <listitem>
- <para>
- Root account can become locked as well as regular accounts.
- </para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <option>root_unlock_time=<replaceable>n</replaceable></option>
- </term>
- <listitem>
- <para>
- This option implies <option>even_deny_root</option> option.
- Allow access after <replaceable>n</replaceable> seconds
- to root account after the account is locked. In case the
- option is not specified the value is the same as of the
- <option>unlock_time</option> option.
- </para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <option>admin_group=<replaceable>name</replaceable></option>
- </term>
- <listitem>
- <para>
- If a group name is specified with this option, members
- of the group will be handled by this module the same as
- the root account (the options <option>even_deny_root></option>
- and <option>root_unlock_time</option> will apply to them.
- By default the option is not set.
- </para>
- </listitem>
- </varlistentry>
</variablelist>
+ <para>
+ The options for configuring the module behavior are described in the
+ <citerefentry><refentrytitle>faillock.conf</refentrytitle><manvolnum>5</manvolnum>
+ </citerefentry> manual page. The options specified on the module command
+ line override the values from the configuration file.
+ </para>
</refsect1>
<refsect1 id="pam_faillock-types">
@@ -306,19 +178,23 @@
<refsect1 id='pam_faillock-notes'>
<title>NOTES</title>
<para>
- <emphasis>pam_faillock</emphasis> setup in the PAM stack is different
+ Configuring options on the module command line is not recommend. The
+ <emphasis>/etc/security/faillock.conf</emphasis> should be used instead.
+ </para>
+ <para>
+ The setup of <emphasis>pam_faillock</emphasis> in the PAM stack is different
from the <emphasis>pam_tally2</emphasis> module setup.
</para>
<para>
- The individual files with the failure records are created as owned by
+ Individual files with the failure records are created as owned by
the user. This allows <emphasis remap='B'>pam_faillock.so</emphasis> module
to work correctly when it is called from a screensaver.
</para>
<para>
Note that using the module in <option>preauth</option> without the
- <option>silent</option> option or with <emphasis>requisite</emphasis>
- control field leaks an information about existence or
- non-existence of an user account in the system because
+ <option>silent</option> option specified in <filename>/etc/security/faillock.conf</filename>
+ or with <emphasis>requisite</emphasis> control field leaks an information about
+ existence or non-existence of an user account in the system because
the failures are not recorded for the unknown users. The message
about the user account being locked is never displayed for nonexisting
user accounts allowing the adversary to infer that a particular account
@@ -341,15 +217,26 @@
be added to tell the user that his login is blocked by the module and also to abort
the authentication without even asking for password in such case.
</para>
+ <para>
+ /etc/security/faillock.conf file example:
+ </para>
+ <programlisting>
+deny=4
+unlock_time=1200
+silent
+ </programlisting>
+ <para>
+ /etc/pam.d/config file example:
+ </para>
<programlisting>
auth required pam_securetty.so
auth required pam_env.so
auth required pam_nologin.so
-# optionally call: auth requisite pam_faillock.so preauth deny=4 even_deny_root unlock_time=1200
+# optionally call: auth requisite pam_faillock.so preauth
# to display the message about account being locked
auth [success=1 default=bad] pam_unix.so
-auth [default=die] pam_faillock.so authfail deny=4 even_deny_root unlock_time=1200
-auth sufficient pam_faillock.so authsucc deny=4 even_deny_root unlock_time=1200
+auth [default=die] pam_faillock.so authfail
+auth sufficient pam_faillock.so authsucc
auth required pam_deny.so
account required pam_unix.so
password required pam_unix.so shadow
@@ -361,17 +248,18 @@ session required pam_selinux.so o
<para>
In the second example the module is called both in the <emphasis>auth</emphasis>
and <emphasis>account</emphasis> phases and the module gives the authenticating
- user message when the account is locked
+ user message when the account is locked if <option>silent</option> option is not
+ specified in the <filename>faillock.conf</filename>.
</para>
<programlisting>
auth required pam_securetty.so
auth required pam_env.so
auth required pam_nologin.so
-auth required pam_faillock.so preauth silent deny=4 even_deny_root unlock_time=1200
+auth required pam_faillock.so preauth
# optionally use requisite above if you do not want to prompt for the password
-# on locked accounts, possibly with removing the silent option as well
+# on locked accounts
auth sufficient pam_unix.so
-auth [default=die] pam_faillock.so authfail deny=4 even_deny_root unlock_time=1200
+auth [default=die] pam_faillock.so authfail
auth required pam_deny.so
account required pam_faillock.so
# if you drop the above call to pam_faillock.so the lock will be done also
@@ -394,6 +282,12 @@ session required pam_selinux.so o
<para>the files logging the authentication failures for users</para>
</listitem>
</varlistentry>
+ <varlistentry>
+ <term><filename>/etc/security/faillock.conf</filename></term>
+ <listitem>
+ <para>the config file for pam_faillock options</para>
+ </listitem>
+ </varlistentry>
</variablelist>
</refsect1>
@@ -404,6 +298,9 @@ session required pam_selinux.so o
<refentrytitle>faillock</refentrytitle><manvolnum>8</manvolnum>
</citerefentry>,
<citerefentry>
+ <refentrytitle>faillock.conf</refentrytitle><manvolnum>5</manvolnum>
+ </citerefentry>,
+ <citerefentry>
<refentrytitle>pam.conf</refentrytitle><manvolnum>5</manvolnum>
</citerefentry>,
<citerefentry>
diff -up Linux-PAM-1.3.1/modules/pam_faillock/pam_faillock.c.faillock-update Linux-PAM-1.3.1/modules/pam_faillock/pam_faillock.c
--- Linux-PAM-1.3.1/modules/pam_faillock/pam_faillock.c.faillock-update 2019-10-16 16:49:27.030893701 +0200
+++ Linux-PAM-1.3.1/modules/pam_faillock/pam_faillock.c 2019-12-16 17:55:11.403270018 +0100
@@ -1,5 +1,6 @@
/*
- * Copyright (c) 2010, 2017 Tomas Mraz <tmraz@redhat.com>
+ * Copyright (c) 2010, 2017, 2019 Tomas Mraz <tmraz@redhat.com>
+ * Copyright (c) 2010, 2017, 2019 Red Hat, Inc.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
@@ -43,6 +44,7 @@
#include <time.h>
#include <pwd.h>
#include <syslog.h>
+#include <ctype.h>
#ifdef HAVE_LIBAUDIT
#include <libaudit.h>
@@ -66,8 +68,14 @@
#define FAILLOCK_FLAG_SILENT 0x4
#define FAILLOCK_FLAG_NO_LOG_INFO 0x8
#define FAILLOCK_FLAG_UNLOCKED 0x10
+#define FAILLOCK_FLAG_LOCAL_ONLY 0x20
#define MAX_TIME_INTERVAL 604800 /* 7 days */
+#define FAILLOCK_CONF_MAX_LINELEN 1023
+#define FAILLOCK_ERROR_CONF_OPEN -3
+#define FAILLOCK_ERROR_CONF_MALFORMED -4
+
+#define PATH_PASSWD "/etc/passwd"
struct options {
unsigned int action;
@@ -76,117 +84,295 @@ struct options {
unsigned int fail_interval;
unsigned int unlock_time;
unsigned int root_unlock_time;
- const char *dir;
+ char *dir;
+ const char *conf;
const char *user;
- const char *admin_group;
+ char *admin_group;
int failures;
uint64_t latest_time;
uid_t uid;
int is_admin;
uint64_t now;
+ int fatal_error;
};
+int read_config_file(
+ pam_handle_t *pamh,
+ struct options *opts,
+ const char *cfgfile
+);
+
+void set_conf_opt(
+ pam_handle_t *pamh,
+ struct options *opts,
+ const char *name,
+ const char *value
+);
+
static void
args_parse(pam_handle_t *pamh, int argc, const char **argv,
int flags, struct options *opts)
{
int i;
+ int rv;
memset(opts, 0, sizeof(*opts));
- opts->dir = FAILLOCK_DEFAULT_TALLYDIR;
+ opts->dir = strdup(FAILLOCK_DEFAULT_TALLYDIR);
+ opts->conf = FAILLOCK_DEFAULT_CONF;
opts->deny = 3;
opts->fail_interval = 900;
opts->unlock_time = 600;
opts->root_unlock_time = MAX_TIME_INTERVAL+1;
- for (i = 0; i < argc; ++i) {
+ if ((rv=read_config_file(pamh, opts, opts->conf)) != PAM_SUCCESS) {
+ pam_syslog(pamh, LOG_DEBUG,
+ "Configuration file missing");
+ }
- if (strncmp(argv[i], "dir=", 4) == 0) {
- if (argv[i][4] != '/') {
- pam_syslog(pamh, LOG_ERR,
- "Tally directory is not absolute path (%s); keeping default", argv[i]);
- } else {
- opts->dir = argv[i]+4;
- }
- }
- else if (strncmp(argv[i], "deny=", 5) == 0) {
- if (sscanf(argv[i]+5, "%hu", &opts->deny) != 1) {
- pam_syslog(pamh, LOG_ERR,
- "Bad number supplied for deny argument");
- }
- }
- else if (strncmp(argv[i], "fail_interval=", 14) == 0) {
- unsigned int temp;
- if (sscanf(argv[i]+14, "%u", &temp) != 1 ||
- temp > MAX_TIME_INTERVAL) {
- pam_syslog(pamh, LOG_ERR,
- "Bad number supplied for fail_interval argument");
- } else {
- opts->fail_interval = temp;
- }
+ for (i = 0; i < argc; ++i) {
+ if (strcmp(argv[i], "preauth") == 0) {
+ opts->action = FAILLOCK_ACTION_PREAUTH;
+ }
+ else if (strcmp(argv[i], "authfail") == 0) {
+ opts->action = FAILLOCK_ACTION_AUTHFAIL;
+ }
+ else if (strcmp(argv[i], "authsucc") == 0) {
+ opts->action = FAILLOCK_ACTION_AUTHSUCC;
}
- else if (strncmp(argv[i], "unlock_time=", 12) == 0) {
- unsigned int temp;
+ else {
+ char buf[FAILLOCK_CONF_MAX_LINELEN + 1];
+ char *val;
- if (strcmp(argv[i]+12, "never") == 0) {
- opts->unlock_time = 0;
- }
- else if (sscanf(argv[i]+12, "%u", &temp) != 1 ||
- temp > MAX_TIME_INTERVAL) {
- pam_syslog(pamh, LOG_ERR,
- "Bad number supplied for unlock_time argument");
+ strncpy(buf, argv[i], sizeof(buf) - 1);
+ buf[sizeof(buf) - 1] = '\0';
+
+ val = strchr(buf, '=');
+ if (val != NULL) {
+ *val = '\0';
+ ++val;
}
else {
- opts->unlock_time = temp;
+ val = buf + sizeof(buf) - 1;
}
+ set_conf_opt(pamh, opts, buf, val);
}
- else if (strncmp(argv[i], "root_unlock_time=", 17) == 0) {
- unsigned int temp;
+ }
- if (strcmp(argv[i]+17, "never") == 0) {
- opts->root_unlock_time = 0;
- }
- else if (sscanf(argv[i]+17, "%u", &temp) != 1 ||
- temp > MAX_TIME_INTERVAL) {
- pam_syslog(pamh, LOG_ERR,
- "Bad number supplied for root_unlock_time argument");
+ if (opts->root_unlock_time == MAX_TIME_INTERVAL+1)
+ opts->root_unlock_time = opts->unlock_time;
+ if (flags & PAM_SILENT)
+ opts->flags |= FAILLOCK_FLAG_SILENT;
+
+ if (opts->dir == NULL) {
+ pam_syslog(pamh, LOG_CRIT, "Error allocating memory: %m");
+ opts->fatal_error = 1;
+ }
+}
+
+/* parse a single configuration file */
+int
+read_config_file(pam_handle_t *pamh, struct options *opts, const char *cfgfile)
+{
+ FILE *f;
+ char linebuf[FAILLOCK_CONF_MAX_LINELEN+1];
+
+ f = fopen(cfgfile, "r");
+ if (f == NULL) {
+ /* ignore non-existent default config file */
+ if (errno == ENOENT && strcmp(cfgfile, FAILLOCK_DEFAULT_CONF) == 0)
+ return 0;
+ return FAILLOCK_ERROR_CONF_OPEN;
+ }
+
+ while (fgets(linebuf, sizeof(linebuf), f) != NULL) {
+ size_t len;
+ char *ptr;
+ char *name;
+ int eq;
+
+ len = strlen(linebuf);
+ /* len cannot be 0 unless there is a bug in fgets */
+ if (len && linebuf[len - 1] != '\n' && !feof(f)) {
+ (void) fclose(f);
+ return FAILLOCK_ERROR_CONF_MALFORMED;
+ }
+
+ if ((ptr=strchr(linebuf, '#')) != NULL) {
+ *ptr = '\0';
+ } else {
+ ptr = linebuf + len;
+ }
+
+ /* drop terminating whitespace including the \n */
+ while (ptr > linebuf) {
+ if (!isspace(*(ptr-1))) {
+ *ptr = '\0';
+ break;
+ }
+ --ptr;
+ }
+
+ /* skip initial whitespace */
+ for (ptr = linebuf; isspace(*ptr); ptr++);
+ if (*ptr == '\0')
+ continue;
+
+ /* grab the key name */
+ eq = 0;
+ name = ptr;
+ while (*ptr != '\0') {
+ if (isspace(*ptr) || *ptr == '=') {
+ eq = *ptr == '=';
+ *ptr = '\0';
+ ++ptr;
+ break;
+ }
+ ++ptr;
+ }
+
+ /* grab the key value */
+ while (*ptr != '\0') {
+ if (*ptr != '=' || eq) {
+ if (!isspace(*ptr)) {
+ break;
+ }
} else {
- opts->root_unlock_time = temp;
+ eq = 1;
}
+ ++ptr;
}
- else if (strncmp(argv[i], "admin_group=", 12) == 0) {
- opts->admin_group = argv[i] + 12;
+
+ /* set the key:value pair on opts */
+ set_conf_opt(pamh, opts, name, ptr);
+ }
+
+ (void)fclose(f);
+ return PAM_SUCCESS;
+}
+
+void set_conf_opt(pam_handle_t *pamh, struct options *opts, const char *name, const char *value)
+{
+ if (strcmp(name, "dir") == 0) {
+ if (value[0] != '/') {
+ pam_syslog(pamh, LOG_ERR,
+ "Tally directory is not absolute path (%s); keeping default", value);
+ } else {
+ free(opts->dir);
+ opts->dir = strdup(value);
}
- else if (strcmp(argv[i], "preauth") == 0) {
- opts->action = FAILLOCK_ACTION_PREAUTH;
+ }
+ else if (strcmp(name, "deny") == 0) {
+ if (sscanf(value, "%hu", &opts->deny) != 1) {
+ pam_syslog(pamh, LOG_ERR,
+ "Bad number supplied for deny argument");
+ }
+ }
+ else if (strcmp(name, "fail_interval") == 0) {
+ unsigned int temp;
+ if (sscanf(value, "%u", &temp) != 1 ||
+ temp > MAX_TIME_INTERVAL) {
+ pam_syslog(pamh, LOG_ERR,
+ "Bad number supplied for fail_interval argument");
+ } else {
+ opts->fail_interval = temp;
}
- else if (strcmp(argv[i], "authfail") == 0) {
- opts->action = FAILLOCK_ACTION_AUTHFAIL;
+ }
+ else if (strcmp(name, "unlock_time") == 0) {
+ unsigned int temp;
+
+ if (strcmp(value, "never") == 0) {
+ opts->unlock_time = 0;
}
- else if (strcmp(argv[i], "authsucc") == 0) {
- opts->action = FAILLOCK_ACTION_AUTHSUCC;
+ else if (sscanf(value, "%u", &temp) != 1 ||
+ temp > MAX_TIME_INTERVAL) {
+ pam_syslog(pamh, LOG_ERR,
+ "Bad number supplied for unlock_time argument");
}
- else if (strcmp(argv[i], "even_deny_root") == 0) {
- opts->flags |= FAILLOCK_FLAG_DENY_ROOT;
+ else {
+ opts->unlock_time = temp;
}
- else if (strcmp(argv[i], "audit") == 0) {
- opts->flags |= FAILLOCK_FLAG_AUDIT;
+ }
+ else if (strcmp(name, "root_unlock_time") == 0) {
+ unsigned int temp;
+
+ if (strcmp(value, "never") == 0) {
+ opts->root_unlock_time = 0;
}
- else if (strcmp(argv[i], "silent") == 0) {
- opts->flags |= FAILLOCK_FLAG_SILENT;
+ else if (sscanf(value, "%u", &temp) != 1 ||
+ temp > MAX_TIME_INTERVAL) {
+ pam_syslog(pamh, LOG_ERR,
+ "Bad number supplied for root_unlock_time argument");
+ } else {
+ opts->root_unlock_time = temp;
}
- else if (strcmp(argv[i], "no_log_info") == 0) {
- opts->flags |= FAILLOCK_FLAG_NO_LOG_INFO;
+ }
+ else if (strcmp(name, "admin_group") == 0) {
+ free(opts->admin_group);
+ opts->admin_group = strdup(value);
+ if (opts->admin_group == NULL) {
+ opts->fatal_error = 1;
+ pam_syslog(pamh, LOG_CRIT, "Error allocating memory: %m");
}
- else {
- pam_syslog(pamh, LOG_ERR, "Unknown option: %s", argv[i]);
+ }
+ else if (strcmp(name, "even_deny_root") == 0) {
+ opts->flags |= FAILLOCK_FLAG_DENY_ROOT;
+ }
+ else if (strcmp(name, "audit") == 0) {
+ opts->flags |= FAILLOCK_FLAG_AUDIT;
+ }
+ else if (strcmp(name, "silent") == 0) {
+ opts->flags |= FAILLOCK_FLAG_SILENT;
+ }
+ else if (strcmp(name, "no_log_info") == 0) {
+ opts->flags |= FAILLOCK_FLAG_NO_LOG_INFO;
+ }
+ else if (strcmp(name, "local_users_only") == 0) {
+ opts->flags |= FAILLOCK_FLAG_LOCAL_ONLY;
+ }
+ else {
+ pam_syslog(pamh, LOG_ERR, "Unknown option: %s", name);
+ }
+}
+
+static int check_local_user (pam_handle_t *pamh, const char *user)
+{
+ struct passwd pw, *pwp;
+ char buf[4096];
+ int found = 0;
+ FILE *fp;
+ int errn;
+
+ fp = fopen(PATH_PASSWD, "r");
+ if (fp == NULL) {
+ pam_syslog(pamh, LOG_ERR, "unable to open %s: %m",
+ PATH_PASSWD);
+ return -1;
+ }
+
+ for (;;) {
+ errn = fgetpwent_r(fp, &pw, buf, sizeof (buf), &pwp);
+ if (errn == ERANGE) {
+ pam_syslog(pamh, LOG_WARNING, "%s contains very long lines; corrupted?",
+ PATH_PASSWD);
+ /* we can continue here as next call will read further */
+ continue;
+ }
+ if (errn != 0)
+ break;
+ if (strcmp(pwp->pw_name, user) == 0) {
+ found = 1;
+ break;
}
}
- if (opts->root_unlock_time == MAX_TIME_INTERVAL+1)
- opts->root_unlock_time = opts->unlock_time;
- if (flags & PAM_SILENT)
- opts->flags |= FAILLOCK_FLAG_SILENT;
+ fclose (fp);
+
+ if (errn != 0 && errn != ENOENT) {
+ pam_syslog(pamh, LOG_ERR, "unable to enumerate local accounts: %m");
+ return -1;
+ } else {
+ return found;
+ }
}
static int get_pam_user(pam_handle_t *pamh, struct options *opts)
@@ -393,7 +579,7 @@ write_tally(pam_handle_t *pamh, struct o
strncpy(tallies->records[oldest].source, source, sizeof(tallies->records[oldest].source));
/* source does not have to be null terminated */
-
+
tallies->records[oldest].time = opts->now;
++failures;
@@ -468,6 +654,13 @@ tally_cleanup(struct tally_data *tallies
free(tallies->records);
}
+static void
+opts_cleanup(struct options *opts)
+{
+ free(opts->dir);
+ free(opts->admin_group);
+}
+
/*---------------------------------------------------------------------*/
PAM_EXTERN int
@@ -481,39 +674,49 @@ pam_sm_authenticate(pam_handle_t *pamh,
memset(&tallies, 0, sizeof(tallies));
args_parse(pamh, argc, argv, flags, &opts);
+ if (opts.fatal_error) {
+ rv = PAM_BUF_ERR;
+ goto err;
+ }
pam_fail_delay(pamh, 2000000); /* 2 sec delay for on failure */
if ((rv=get_pam_user(pamh, &opts)) != PAM_SUCCESS) {
- return rv;
+ goto err;
}
- switch (opts.action) {
- case FAILLOCK_ACTION_PREAUTH:
- rv = check_tally(pamh, &opts, &tallies, &fd);
- if (rv == PAM_AUTH_ERR && !(opts.flags & FAILLOCK_FLAG_SILENT)) {
- faillock_message(pamh, &opts);
- }
- break;
-
- case FAILLOCK_ACTION_AUTHSUCC:
- rv = check_tally(pamh, &opts, &tallies, &fd);
- if (rv == PAM_SUCCESS) {
- reset_tally(pamh, &opts, &fd);
- }
- break;
-
- case FAILLOCK_ACTION_AUTHFAIL:
- rv = check_tally(pamh, &opts, &tallies, &fd);
- if (rv == PAM_SUCCESS) {
- rv = PAM_IGNORE; /* this return value should be ignored */
- write_tally(pamh, &opts, &tallies, &fd);
- }
- break;
+ if (!(opts.flags & FAILLOCK_FLAG_LOCAL_ONLY) ||
+ check_local_user (pamh, opts.user) != 0) {
+ switch (opts.action) {
+ case FAILLOCK_ACTION_PREAUTH:
+ rv = check_tally(pamh, &opts, &tallies, &fd);
+ if (rv == PAM_AUTH_ERR && !(opts.flags & FAILLOCK_FLAG_SILENT)) {
+ faillock_message(pamh, &opts);
+ }
+ break;
+
+ case FAILLOCK_ACTION_AUTHSUCC:
+ rv = check_tally(pamh, &opts, &tallies, &fd);
+ if (rv == PAM_SUCCESS) {
+ reset_tally(pamh, &opts, &fd);
+ }
+ break;
+
+ case FAILLOCK_ACTION_AUTHFAIL:
+ rv = check_tally(pamh, &opts, &tallies, &fd);
+ if (rv == PAM_SUCCESS) {
+ rv = PAM_IGNORE; /* this return value should be ignored */
+ write_tally(pamh, &opts, &tallies, &fd);
+ }
+ break;
+ }
}
tally_cleanup(&tallies, fd);
+err:
+ opts_cleanup(&opts);
+
return rv;
}
@@ -540,18 +743,29 @@ pam_sm_acct_mgmt(pam_handle_t *pamh, int
args_parse(pamh, argc, argv, flags, &opts);
+ if (opts.fatal_error) {
+ rv = PAM_BUF_ERR;
+ goto err;
+ }
+
opts.action = FAILLOCK_ACTION_AUTHSUCC;
if ((rv=get_pam_user(pamh, &opts)) != PAM_SUCCESS) {
- return rv;
+ goto err;
}
- check_tally(pamh, &opts, &tallies, &fd); /* for auditing */
- reset_tally(pamh, &opts, &fd);
+ if (!(opts.flags & FAILLOCK_FLAG_LOCAL_ONLY) ||
+ check_local_user (pamh, opts.user) != 0) {
+ check_tally(pamh, &opts, &tallies, &fd); /* for auditing */
+ reset_tally(pamh, &opts, &fd);
+ }
tally_cleanup(&tallies, fd);
- return PAM_SUCCESS;
+err:
+ opts_cleanup(&opts);
+
+ return rv;
}
/*-----------------------------------------------------------------------*/
Reference in New Issue Copy Permalink