Relevant BUGIDs:

Purpose of commit:

Commit summary:
---------------

bugfix: merge with BerliOS

diff --git a/CHANGELOG b/CHANGELOG
index e510a164d03cb00d5ac7a74974b229379a5b1070..40f7a2c924e561fbfdf0d9593958bfb10119314a 100644 (file)
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -86,6 +86,11 @@ BerliOS Bugs are marked with (BerliOS #XXXX).
   contains only one character (Bug 1027903 - kukuk)
 * libpam/pam_start.c: All service names should be files below /etc/pam.d
   and nothing else. Forbid paths. (Bug 1027912 - kukuk)
+* pam_cracklib: Fix error in distance algorithm in the 0.9 pam_cracklib
+  module (Bug 1010142 - toady)
+* pam_userdb: applied patch from Paul Walmsley <paul@booyaka.com>
+  it now indicates whether encrypted or plaintext passwords are stored
+  in the database needed for pam_userdb. (Bug XXXXXX - toady)
 
 
 0.77: Mon Sep 23 10:25:42 PDT 2002

diff --git a/libpamc/test/modules/pam_secret.c b/libpamc/test/modules/pam_secret.c
index 7efa8c238e4f7871092089513038a24a5e20765c..830f1a78ea867a6b922fbfe6fa4fa983aa8a162b 100644 (file)
--- a/libpamc/test/modules/pam_secret.c
+++ b/libpamc/test/modules/pam_secret.c
@@ -206,6 +206,7 @@ char *identify_secret(char *identity, const char *user)
     pwd = getpwnam(user);
     if ((pwd == NULL) || (pwd->pw_dir == NULL)) {
        D(("user [%s] is not known", user));
+       return NULL;
     }
 
     length_id = strlen(pwd->pw_dir) + sizeof(SECRET_FILE_FORMAT);

diff --git a/modules/pam_access/pam_access.c b/modules/pam_access/pam_access.c
index 4005c93b9919c86071b7c5951944d969d47c0193..854b150694b6705a89863c9d885eb0dbcb7c56c1 100644 (file)
--- a/modules/pam_access/pam_access.c
+++ b/modules/pam_access/pam_access.c
@@ -41,6 +41,7 @@
 #include <errno.h>
 #include <ctype.h>
 #include <sys/utsname.h>
+#include <rpcsvc/ypclnt.h>
 
 #ifndef BROKEN_NETWORK_MATCH
 # include <netdb.h>
@@ -262,16 +263,11 @@ static char * myhostname(void)
 
 static int netgroup_match(char *group, char *machine, char *user)
 {
-#ifdef NIS
-    static char *mydomain = 0;
+    static char *mydomain = NULL;
 
     if (mydomain == 0)
        yp_get_default_domain(&mydomain);
     return (innetgr(group, machine, user, mydomain));
-#else
-    _log_err("NIS netgroup support not configured");
-    return (NO);
-#endif
 }
 
 /* user_match - match a username against one token */

diff --git a/modules/pam_cracklib/pam_cracklib.c b/modules/pam_cracklib/pam_cracklib.c
index bc98d2f65754e9905beb906a14951a60da8dd05d..ff2c61f995965ef9367858b413945f405f54dbf0 100644 (file)
--- a/modules/pam_cracklib/pam_cracklib.c
+++ b/modules/pam_cracklib/pam_cracklib.c
@@ -258,12 +258,12 @@ static int distdifferent(const char *old, const char *new, int i, int j)
 {
     char c, d;
 
-    if ((i == 0) || (strlen(old) <= i)) {
+    if ((i == 0) || (strlen(old) < i)) {
        c = 0;
     } else {
        c = old[i - 1];
     }
-    if ((j == 0) || (strlen(new) <= i)) {
+    if ((j == 0) || (strlen(new) < j)) {
        d = 0;
     } else {
        d = new[j - 1];

diff --git a/modules/pam_userdb/Makefile b/modules/pam_userdb/Makefile
index b53ac43601d4bb88311a5665cadb9c748db4e8e0..bbecaae105083c5ecc878b22406ff5a6f0a344c3 100644 (file)
--- a/modules/pam_userdb/Makefile
+++ b/modules/pam_userdb/Makefile
@@ -24,6 +24,10 @@ else
 endif
 endif
 
+ifeq ($(HAVE_LIBCRYPT),yes)
+  MODULE_SIMPLE_EXTRALIBS += -lcrypt
+endif
+
 ifeq ($(WHICH_DB),none)
 
 include ../dont_makefile

diff --git a/modules/pam_userdb/README b/modules/pam_userdb/README
index 09d65edda7312f64c63327a62a5afdfb7069cf89..9fa6519dd86c71d396ade1db8fe54bd3d387c6e0 100644 (file)
--- a/modules/pam_userdb/README
+++ b/modules/pam_userdb/README
@@ -10,8 +10,16 @@ RECOGNIZED ARGUMENTS:
                        is no default; the module will return PAM_IGNORE if
                        no database is provided.
                        
+       crypt=[mode]    indicates whether encrypted or plaintext passwords
+                       are stored in the database.  If [mode] is "crypt", 
+                       passwords should be stored in the database in 
+                       crypt(3) form.  If [mode] is "none" or any other 
+                       value, passwords should be stored in the database in
+                       plaintext.
+
        icase           make the password verification to be case insensitive
                        (ie when working with registration numbers and such)
+                       only works with plaintext password storage.
 
        dump            dump all the entries in the database to the log (eek,
                        don't do this by default!)

diff --git a/modules/pam_userdb/pam_userdb.c b/modules/pam_userdb/pam_userdb.c
index 519ee8988468fefa80dfe48d73e07c34af3d4a16..30f1e578d2e3e739f5b1596298da32c7c0101774 100644 (file)
--- a/modules/pam_userdb/pam_userdb.c
+++ b/modules/pam_userdb/pam_userdb.c
@@ -57,6 +57,7 @@ static void _pam_log(int err, const char *format, ...)
 }
 
 char * database         = NULL;
+char * cryptmode = NULL;
 static int ctrl         = 0;
 
 static int _pam_parse(int argc, const char **argv)
@@ -77,6 +78,11 @@ static int _pam_parse(int argc, const char **argv)
              if (database == NULL)
                  _pam_log(LOG_ERR, "pam_parse: could not parse argument \"%s\"",
                           *argv);
+         } else if (!strncasecmp(*argv,"crypt=", 6)) {
+             cryptmode = strdup((*argv) + 6);
+             if (cryptmode == NULL)
+                 _pam_log(LOG_ERR, "pam_parse: could not parse argument \"%s\"",
+                          *argv);
          } else {
                _pam_log(LOG_ERR, "pam_parse: unknown option; %s", *argv);
           }
@@ -139,6 +145,40 @@ static int user_lookup(const char *user, const char *pass)
     if (data.dptr != NULL) {
        int compare = 0;
        
+       if (strncasecmp(cryptmode, "crypt", 5) == 0) {
+
+         /* crypt(3) password storage */
+
+         char *cryptpw;
+         char salt[2];
+
+         if (data.dsize != 13) {
+           compare = -2;
+         } else if (ctrl & PAM_ICASE_ARG) {
+           compare = -2;
+         } else {
+           salt[0] = *data.dptr;
+           salt[1] = *(data.dptr + 1);
+
+           cryptpw = crypt (pass, salt);
+
+           if (cryptpw) {
+             compare = strncasecmp (data.dptr, cryptpw, data.dsize);
+           } else {
+             compare = -2;
+             if (ctrl & PAM_DEBUG_ARG) {    
+               _pam_log(LOG_INFO, "crypt() returned NULL");
+             }
+           };
+
+         };
+
+       } else {
+         
+         /* Unknown password encryption method -
+          * default to plaintext password storage
+          */
+
        if (strlen(pass) != data.dsize) {
            compare = 1;
        } else if (ctrl & PAM_ICASE_ARG) {
@@ -146,6 +186,15 @@ static int user_lookup(const char *user, const char *pass)
        } else {
            compare = strncmp(data.dptr, pass, data.dsize);
        }
+
+         if (strncasecmp(cryptmode, "none", 4) && ctrl & PAM_DEBUG_ARG) {    
+           _pam_log(LOG_INFO, "invalid value for crypt parameter: %s",
+                    cryptmode);
+           _pam_log(LOG_INFO, "defaulting to plaintext password mode");
+         }
+
+       }
+
        dbm_close(dbm);
        if (compare == 0)
            return 0; /* match */