Relevant BUGIDs: Debian bug #84428

Purpose of commit: new feature

Commit summary:
---------------
2007-08-29  Steve Langasek  <vorlon@debian.org>

        * modules/pam_listfile/pam_listfile.c, modules/pam_listfile/README,
        modules/pam_listfile/pam_listfile.8,
        modules/pam_listfile/pam_listfile.8.xml: add a 'quiet' option to
        avoid logging errors any time a user is refused service by this
        module.

diff --git a/ChangeLog b/ChangeLog
index 91a17c13f070683dc8c3084722efaa8dfe09108c..ddeb50fa7c99a337873f9e8cf4e2ac5d08506623 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,11 @@
+2007-08-29  Steve Langasek  <vorlon@debian.org>
+
+       * modules/pam_listfile/pam_listfile.c, modules/pam_listfile/README,
+       modules/pam_listfile/pam_listfile.8,
+       modules/pam_listfile/pam_listfile.8.xml: add a 'quiet' option to
+       avoid logging errors any time a user is refused service by this
+       module.
+
 2007-08-29  Thorsten Kukuk  <kukuk@thkukuk.de>
 
        * modules/pam_rhosts/pam_rhosts_auth.c: buflen needs to be size_t.

diff --git a/modules/pam_listfile/README b/modules/pam_listfile/README
index f0aaaf7f75dc70083460203ada8e1451fdfd13ad..51bb13d229b36998f3777d53dda2ac3abc15865e 100644 (file)
--- a/modules/pam_listfile/README
+++ b/modules/pam_listfile/README
@@ -58,6 +58,11 @@ apply=[user|@group]
     item=[user|ruser|group] this oes not make sense, but for item=[tty|rhost|
     shell] it have a meaning.
 
+quiet
+
+    Do not treat service refusals or missing list files as errors that need to
+    be logged.
+
 EXAMPLES
 
 Classic 'ftpusers' authentication can be implemented with this entry in /etc/

diff --git a/modules/pam_listfile/pam_listfile.8 b/modules/pam_listfile/pam_listfile.8
index 2ccecd4b8a3495d34910bec5f68c68639ad3319c..0103aa5edb1390d5bfd794e778a31212031763f7 100644 (file)
--- a/modules/pam_listfile/pam_listfile.8
+++ b/modules/pam_listfile/pam_listfile.8
@@ -1,11 +1,11 @@
 .\"     Title: pam_listfile
 .\"    Author: 
-.\" Generator: DocBook XSL Stylesheets v1.70.1 <http://docbook.sf.net/>
-.\"      Date: 06/22/2006
-.\"    Manual: Linux\-PAM Manual
-.\"    Source: Linux\-PAM Manual
+.\" Generator: DocBook XSL Stylesheets v1.72.0 <http://docbook.sf.net/>
+.\"      Date: 08/25/2007
+.\"    Manual: Linux-PAM Manual
+.\"    Source: Linux-PAM Manual
 .\"
-.TH "PAM_LISTFILE" "8" "06/22/2006" "Linux\-PAM Manual" "Linux\-PAM Manual"
+.TH "PAM_LISTFILE" "8" "08/25/2007" "Linux\-PAM Manual" "Linux\-PAM Manual"
 .\" disable hyphenation
 .nh
 .\" disable justification (adjust text to left margin only)
@@ -14,7 +14,7 @@
 pam_listfile \- deny or allow services based on an arbitrary file
 .SH "SYNOPSIS"
 .HP 16
-\fBpam_listfile.so\fR item=[tty|user|rhost|ruser|group|shell] sense=[allow|deny] file=\fI/path/filename\fR onerr=[succeed|fail] [apply=[\fIuser\fR|\fI@group\fR]]
+\fBpam_listfile.so\fR item=[tty|user|rhost|ruser|group|shell] sense=[allow|deny] file=\fI/path/filename\fR onerr=[succeed|fail] [apply=[\fIuser\fR|\fI@group\fR]] [quiet]
 .SH "DESCRIPTION"
 .PP
 pam_listfile is a PAM module which provides a way to deny or allow services based on an arbitrary file.
@@ -64,25 +64,40 @@ Besides this last one, all arguments should be specified; do not count on any de
 No credentials are awarded by this module.
 .SH "OPTIONS"
 .PP
-.TP 3n
+.PP
 \fBitem=[tty|user|rhost|ruser|group|shell]\fR
+.RS 4
 What is listed in the file and should be checked for.
-.TP 3n
+.RE
+.PP
 \fBsense=[allow|deny]\fR
+.RS 4
 Action to take if found in file, if the item is NOT found in the file, then the opposite action is requested.
-.TP 3n
+.RE
+.PP
 \fBfile=\fR\fB\fI/path/filename\fR\fR
+.RS 4
 File containing one item per line. The file needs to be a plain file and not world writeable.
-.TP 3n
+.RE
+.PP
 \fBonerr=[succeed|fail]\fR
+.RS 4
 What to do if something weird happens like being unable to open the file.
-.TP 3n
+.RE
+.PP
 \fBapply=[\fR\fB\fIuser\fR\fR\fB|\fR\fB\fI@group\fR\fR\fB]\fR
+.RS 4
 Restrict the user class for which the restriction apply. Note that with
 \fBitem=[user|ruser|group]\fR
 this oes not make sense, but for
 \fBitem=[tty|rhost|shell]\fR
 it have a meaning.
+.RE
+.PP
+\fBquiet\fR
+.RS 4
+Do not treat service refusals or missing list files as errors that need to be logged.
+.RE
 .SH "MODULE SERVICES PROVIDED"
 .PP
 The services
@@ -94,34 +109,44 @@ and
 are supported.
 .SH "RETURN VALUES"
 .PP
-.TP 3n
+.PP
 PAM_AUTH_ERR
+.RS 4
 Authentication failure.
-.TP 3n
+.RE
+.PP
 PAM_BUF_ERR
+.RS 4
 Memory buffer error.
-.TP 3n
+.RE
+.PP
 PAM_IGNORE
+.RS 4
 The rule does not apply to the
 \fBapply\fR
 option.
-.TP 3n
+.RE
+.PP
 PAM_SERVICE_ERR
+.RS 4
 Error in service module.
-.TP 3n
+.RE
+.PP
 PAM_SUCCESS
+.RS 4
 Success.
+.RE
 .SH "EXAMPLES"
 .PP
 Classic 'ftpusers' authentication can be implemented with this entry in
 \fI/etc/pam.d/ftpd\fR:
 .sp
-.RS 3n
+.RS 4
 .nf
 #
 # deny ftp\-access to users listed in the /etc/ftpusers file
 #
-auth    required       pam_listfile.so \\
+auth    required       pam_listfile.so \e
         onerr=succeed item=user sense=deny file=/etc/ftpusers
       
 .fi
@@ -137,12 +162,12 @@ To allow login access only for certain users, you can use a
 \fI/etc/pam.d/login\fR
 entry like this:
 .sp
-.RS 3n
+.RS 4
 .nf
 #
 # permit login to users listed in /etc/loginusers
 #
-auth    required       pam_listfile.so \\
+auth    required       pam_listfile.so \e
         onerr=fail item=user sense=allow file=/etc/loginusers
       
 .fi

diff --git a/modules/pam_listfile/pam_listfile.8.xml b/modules/pam_listfile/pam_listfile.8.xml
index 0e90414a6ca9918faa4e88228b9b2041fd8a2b5a..2aab49629fb5bdbee89df614296876526b8d1960 100644 (file)
--- a/modules/pam_listfile/pam_listfile.8.xml
+++ b/modules/pam_listfile/pam_listfile.8.xml
@@ -33,6 +33,9 @@
       <arg choice="opt">
         apply=[<replaceable>user</replaceable>|<replaceable>@group</replaceable>]
       </arg>
+      <arg choice="opt">
+        quiet
+      </arg>
     </cmdsynopsis>
   </refsynopsisdiv>
 
@@ -155,6 +158,18 @@
             </para>
           </listitem>
         </varlistentry>
+
+        <varlistentry>
+          <term>
+            <option>quiet</option>
+          </term>
+          <listitem>
+            <para>
+              Do not treat service refusals or missing list files as
+              errors that need to be logged.
+            </para>
+          </listitem>
+        </varlistentry>
       </variablelist>
 
     </para>

diff --git a/modules/pam_listfile/pam_listfile.c b/modules/pam_listfile/pam_listfile.c
index 1545fe033bafaf628fd6db6b0e1b468eb7147164..f276e5b827cd501ef7a484908cfbde96f821b81f 100644 (file)
--- a/modules/pam_listfile/pam_listfile.c
+++ b/modules/pam_listfile/pam_listfile.c
@@ -68,7 +68,7 @@ PAM_EXTERN int
 pam_sm_authenticate (pam_handle_t *pamh, int flags UNUSED,
                     int argc, const char **argv)
 {
-    int retval, i, citem=0, extitem=0, onerr=PAM_SERVICE_ERR, sense=2;
+    int retval, i, citem=0, extitem=0, onerr=PAM_SERVICE_ERR, sense=2, quiet=0;
     const void *void_citemp;
     const char *citemp;
     char *ifname=NULL;
@@ -155,6 +155,8 @@ pam_sm_authenticate (pam_handle_t *pamh, int flags UNUSED,
                    apply_type=APPLY_TYPE_USER;
                    strncpy(apply_val,myval,sizeof(apply_val)-1);
                }
+           } else if (!strcmp(mybuf,"quiet")) {
+               quiet = 1;
            } else {
                free(ifname);
                pam_syslog(pamh,LOG_ERR, "Unknown option: %s",mybuf);
@@ -399,8 +401,9 @@ pam_sm_authenticate (pam_handle_t *pamh, int flags UNUSED,
 #endif
        (void) pam_get_item(pamh, PAM_SERVICE, &service);
        (void) pam_get_user(pamh, &user_name, NULL);
-       pam_syslog (pamh, LOG_ALERT, "Refused user %s for service %s",
-                   user_name, (const char *)service);
+       if (!quiet)
+           pam_syslog (pamh, LOG_ALERT, "Refused user %s for service %s",
+                       user_name, (const char *)service);
        return PAM_AUTH_ERR;
     }
 }