1 Linux-PAM NEWS -- history of user-visible changes.
5 * Add vietnamese translation
6 * pam_namepace: Add new functionality
7 * pam_securetty: Honour console= kernel option, add noconsole option
8 * pam_limits: Add %group syntax, drop change_uid option, add set_all option
9 * Lot of small bug fixes
10 * Lot of compiler warnings fixed
11 * Add support for libtirpc
16 * pam_namespace: Clean environment for childs (CVE-2010-3853)
17 * libpam: New interface to drop/regain privilegs
18 * Drop root privilegs in pam_env, pam_mail and pam_xauth before
19 accessing user files (CVE-2010-3430, CVE-2010-3431)
20 * pam_unix: Add minlen option, change default from 6 to 0
21 * Documentation improvements
22 * Lot of small bug fixes
26 * pam_unix: Add minlen= option
27 * pam_group: Add support for UNIX groups beside netgroups
28 * pam_tally: Document that it is deprecated
29 * pam_rootok: Add support for chauthtok and acct_mgmt
35 * pam_access: Revert netgroup match to original behavior, add new
36 syntax for adding the local hostname to netgroup match
37 * libpam: Add new functions pam_get_authtok_noverify() and
38 pam_get_authtok_verify()
39 * Add sepermit.conf.5 manual page
45 * Documentation updates and fixes
50 * pam_succeed_if: Use provided username
51 * pam_mkhomedir: Fix handling of options
55 * Fixed CVE-2009-0579 (minimum days limit on password change is ignored).
56 * Fix libpam internal config/argument parser
57 * Add optional file locking to pam_tally2
59 * pam_access improvements
60 * Changes in the behavior of the password stack. Results of PRELIM_CHECK
61 are not used for the final run.
65 * Supply hostname of the machine to netgroup match call in pam_access
66 * Make pam_namespace to work safe on child directories of parent directories
68 * Redefine LOCAL keyword of pam_access configuration file
69 * Add support for try_first_pass and use_first_pass to pam_cracklib
70 * Print informative messages for rejected login and add silent and
71 no_log_info options to pam_tally
72 * Add support for passing PAM_AUTHTOK to stdin of helpers from pam_exec
73 * New password quality tests in pam_cracklib
74 * New options for pam_lastlog to show last failed login attempt and
75 to disable lastlog update
76 * New pam_pwhistory module to store last used passwords
77 * New pam_tally2 module similar to pam_tally with wordsize independent
79 * Make libpam not log missing module if its type is prepended with '-'
80 * New pam_timestamp module for authentication based on recent successful
82 * Add blowfish support to pam_unix.
83 * Add support for user specific environment file to pam_env.
84 * Add pam_get_authtok to libpam as Linux-PAM extension.
85 * Rename type option of pam_cracklib to authtok_type.
89 * Small bug fix release
94 * Regression fixed in pam_selinux
95 * Problem with big UIDs fixed in pam_loginuid
100 * Regression fixed in pam_set_item()
106 * Translation updates
111 * New substack directive in config file syntax.
112 * New module pam_tty_audit.so for enabling and disabling tty
114 * New PAM items PAM_XDISPLAY and PAM_XAUTHDATA.
115 * Auditing login denials based by origin (pam_access), time (pam_time),
116 and number of sessions (pam_limits) to the Linux audit subsystem.
117 * Support sha256 and sha512 algorithms in pam_unix when they are supported
119 * New pam_sepermit.so module for allowing/rejecting access based on
121 * Improved functionality of pam_namespace.so module (method flags,
122 namespace.d configuration directory, new options).
123 * Finaly removed deprecated pam_rhosts_auth module.
128 * misc_conv no longer blocks SIGINT; applications that don't want
129 user-interruptable prompts should block SIGINT themselves
130 * Merge fixes from Debian
131 * Fix parser for pam_group and pam_time
136 * Fix a regression in audit code introduced with last release
137 * Fix compiling with --disable-nls
142 * Add translations for ar, ca, da, ru, sv and zu.
143 * Update hungarian translation.
144 * Add support for limits.d directory to pam_limits.
145 * Improve pam_namespace module tobe more useful
146 for MLS, fixed crash with bad config files.
147 * Improve pam_selinux module to be more useful
149 * Add minclass option to pam_cracklib
150 * Add new group syntax to pam_access
155 * Security fix for pam_unix.so (CVE-2007-0003).
160 * Add manual page for pam_unix.so.
161 * Add pam_faildelay module to set pam_fail_delay() value.
162 * Fix possible seg.fault in libpam/pam_set_data().
163 * Cleanup of configure options.
164 * Update hungarian translation, fix german translation.
169 * pam_loginuid: New PAM module.
170 * pam_access, pam_succeed_if: Support passwd and session services.
175 * pam_lastlog: Don't refuse login if lastlog file got lost.
176 * pam_cracklib: Fix a user triggerable crash.
177 * documentation: Regenerate with fixed docbook stylesheet.
182 * Fix bootstrapping problems.
183 * Bug fixes: pam_keyinit, pam_umask
188 * pam_namespace: Code cleanup, add init script to tar archive.
189 * pam_succeed_if: Add support for service match.
190 * Add xtests (to run after installation).
191 * Documentation: Convert sgml guides to XML, unify documentation
192 for PAM functions and modules.
197 * pam_tally: Fix support for large UIDs
198 * Fixed all problems found by Coverity
199 * Add support for Intel C Compiler
200 * Add manual page for pam_mkhomedir, pam_umask, pam_filter,
201 pam_issue, pam_ftp, pam_group, pam_lastlog, pam_listfile,
202 pam_localuser, pam_mail, pam_motd, pam_nologin, pam_permit,
203 pam_rootok, pam_securetty, pam_shells, pam_userdb, pam_warn,
204 pam_time, pam_limits, pam_debug, pam_tally
205 * The libpam memory debug code was removed
206 * pam_keyinit: New module to initialise kernel session keyring.
207 * pam_namespace: New module to configure private namespace for a session.
208 * pam_rhosts: New module which replaces pam_rhosts_auth, now IPv6 capable.
209 * pam_rhosts_auth: This module is now deprecated.
215 * Fix building of static variants of libpam, libpamc and libpam_misc
216 * pam_listfile: Add support for password and session management
217 * pam_exec: New PAM module to execute arbitary commands
218 * Fix building of a static libpam including all PAM modules
219 * New/updated translations for: nl, pt, pl, fi, km, tr, uk, fr
220 * pam_access: Add network(address) / netmask and IPv6 support
221 * Add manual pages for pam_cracklib, pam_deny and pam_access
222 * pam_pwdb: This deprecated module was removed
223 * Manual pages: Major rewrite/cleanup
228 * Fix NULL pointer checks in libpam.so
229 * pam_succeed_if, pam_group, pam_time: Support netgroup matching
230 * New translations for: nb, hu, fi, de, es, fr, it, ja, pt_BR, zh_CN, zh_TW
231 * Audit PAM calls if Linux Audit is available
232 * Compile upperLOWER and unix_chkpwd as PIE binaries
237 * Fix install of PS, PDF, TXT and HTML files
238 * pam_mail: Update README
240 * pam_modutil_getlogin: Fix parsing of PAM_TTY variable
245 * Fix parsing of full path tty name in various modules
246 * pam_xauth: Look for xauth executable in multiple places
247 * pam_unix: Disable user check in unix_chkpwd only if real uid
248 is 0 (CVE-2005-2977). Log failed password check attempt.
249 * pam_env: Support /etc/environment again, but don't treat it as
250 error if it is missing.
251 * pam_userdb: Fix memory leak.
256 * Use autoconf/automake/libtool
257 * Add gettext support
258 * Add translations for cs, de, es, fr, hu, it, ja, nb, pa, pt_BR,
260 * libpam: Remove pam_authenticate_secondary stub
261 * libpam: Add pam_prompt,pam_vprompt,pam_error,pam_verror,pam_info
262 and pam_vinfo functions for use by modules as extension
263 * libpam: Add pam_syslog function for unified syslog messages from
265 * libpam: Moved functions from pammodutil to libpam
266 * pam_umask: New module for setting umask from GECOS field, /etc/login.defs
267 or /etc/default/login
268 * pam_echo: New PAM module for message output
269 * pam_userdb: Fix regression (crash when crypt param not specified)
270 * pam_limits: Fix regression from RLIMIT_NICE support (wrong limit
271 values for other limits are applied)
272 * pam_access: Support for NULL tty - matches ALL and NONE keywords
273 * pam_lastlog: Enable log to wtmp by default. Add "nowtmp" option
274 * pam_radius: This module was removed