aboutsummaryrefslogtreecommitdiff
path: root/modules/pam_unix/passverify.c
Commit message (Collapse)AuthorAgeFilesLines
* build: rename SCONFIGDIR config.h macro to SCONFIG_DIRDmitry V. Levin2024-08-251-1/+1
| | | | | | | This way it is visibly different from the configure variable SCONFIGDIR, which is helpful, because their values are slightly different: the macro is quoted while the configure variable is not quoted, and this difference may cause problems with other build systems.
* pam_unix: compare password hashes in constant timeChristian Göttsche2024-04-131-2/+2
| | | | | Compare the hashes in constant time as a defense-in-depth mechanism, since performance is not a priority.
* pam_unix: allow empty passwords with non-empty hashesSergei Trofimovich2024-03-291-8/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Before the change pam_unix has different behaviours for a user with empty password for these two `/etc/shadow` entries: nulloktest:$6$Yy4ty2jJ$bsVQWo8qlXC6UHq1/qTC3UR60ZJKmKApJ3Wj7DreAy8FxlVKtlDnplFQ7jMLVlDqordE7e4t49GvTb.aI59TP0:1:::::: nulloktest::1:::::: The entry with a hash was rejected and the entry without was accepted. The rejection happened because 9e74e90147c "pam_unix: avoid determining if user exists" introduced the following rejection check (slightly simplified): ... } else if (p[0] == '\0' && nullok) { if (hash[0] != '\0') { retval = PAM_AUTH_ERR; } We should not reject the user with a hash assuming it's non-empty. The change does that by pushing empty password check into `verify_pwd_hash()`. `NixOS` generates such hashed entries for empty passwords as if they were non-empty using the following perl code: sub hashPassword { my ($password) = @_; my $salt = ""; my @chars = ('.', '/', 0..9, 'A'..'Z', 'a'..'z'); $salt .= $chars[rand 64] for (1..8); return crypt($password, '$6$' . $salt . '$'); } Resolves: https://github.com/linux-pam/linux-pam/issues/758 Fixes: 9e74e90147c "pam_unix: avoid determining if user exists" Signed-off-by: Sergei Trofimovich <slyich@gmail.com>
* modules: zero out crypt_r(3) data before usageChristian Göttsche2024-01-211-4/+2
| | | | The manual page of crypt_r(3) recommends to zero the entire data object.
* pam_unix: do not warn if password aging is disabledTobias Stoeckmann2024-01-191-1/+0
| | | | | | | | | Later checks will print a warning if daysleft is 0. If password aging is disabled, leave daysleft at -1. Resolves: https://github.com/linux-pam/linux-pam/issues/743 Fixes: 9ebc14085a3b ("pam_unix: allow disabled password aging") Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
* pam_unix: do not allow comma as a field separatorTobias Stoeckmann2024-01-161-2/+2
| | | | | | | | | | | The opasswd file shall not use comma as a separator. Enforce colon just like pam_pwhistory does as well. A comma can be part of a user name, although its usage is discouraged. If such a user exists, it could happen that stored passwords of another user are checked. Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
* pam_unix: clean additional possible sensitive buffersChristian Göttsche2024-01-151-1/+2
|
* pam_unix: use more appropriate typesChristian Göttsche2024-01-151-4/+4
|
* pam_unix: set close-on-execChristian Göttsche2024-01-151-8/+8
| | | | | | | | | Since the module operates on sensitive files set the close-on-exec flag, to avoid file descriptor leaks if there is ever any sibling thread. The fopen(3) mode "e" is supported in glibc since version 2.7 (released in 2007), and ignored prior, see: https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=65d834b0add966dbbdb5ed1e916c60b2b2d87f10
* pam_unix: fix regressionsTobias Stoeckmann2024-01-151-1/+1
| | | | | | | | | | | | The returned value stored in pwd from _unix_getpwnam is inserted into pam handler through pam_set_data. Do not manually free the value. Also check getline return value for != -1 instead of == -1. Fixes 8f2ca5919b26843ef774ef0aeb9bf261dec943a0 and 73d009e9ea8edafc18c7fe3650b25dd6bdce88c1. No release affected. Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
* pam_unix: annotate declaration with format attributeChristian Göttsche2024-01-151-1/+0
| | | | | Instead of annotating the function definition with the format attribute annotate the declaration, so the annotation is visible at call sites.
* pam_unix: do not truncate user namesTobias Stoeckmann2024-01-081-5/+1
| | | | | | | | | | | | | | | | This could allow users with very long names to impersonate a user with a 255 characters long name. The check if the argument argv[1] actually matches the user name implies that "user" can unconditionally be set to argv[1]: If they are equal, the strings are obviously equal. If they are not or if null is returned by getuidname, "user" is set to argv[1] anyway. This way, the static buffer can be safely removed because the result of getpwuid() is not stored, which means that subsequent calls to such functions can safely overwrite their internal buffers. Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
* pam_unix/passverify: always run the helper to obtain shadow password file ↵Dmitry V. Levin2024-01-041-10/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | entries Initially, when pam_unix.so verified the password, it used to try to obtain the shadow password file entry for the given user by invoking getspnam(3), and only when that didn't work and the effective uid was nonzero, pam_unix.so used to invoke the helper as a fallback. When SELinux support was introduced by commit 67aab1ff5515054341a438cf9804e9c9b3a88033, the fallback was extended also for the case when SELinux was enabled. Later, commit f220cace205332a3dc34e7b37a85e7627e097e7d extended the fallback conditions for the case when pam_modutil_getspnam() failed with EACCES. Since commit 470823c4aacef5cb3b1180be6ed70846b61a3752, the helper is invoked as a fallback when pam_modutil_getspnam() fails for any reason. The ultimate solution for the case when pam_unix.so does not have permissions to obtain the shadow password file entry is to stop trying to use pam_modutil_getspnam() and to invoke the helper instead. Here are two recent examples. https://github.com/linux-pam/linux-pam/pull/484 describes a system configuration where libnss_systemd is enabled along with libnss_files in the shadow entry of nsswitch.conf, so when libnss_files is unable to obtain the shadow password file entry for the root user, e.g. when SELinux is enabled, NSS falls back to libnss_systemd which returns a synthesized shadow password file entry for the root user, which in turn locks the root user out. https://bugzilla.redhat.com/show_bug.cgi?id=2150155 describes essentially the same problem in a similar system configuration. This commit is the final step in the direction of addressing the issue: for password verification pam_unix.so now invokes the helper instead of making the pam_modutil_getspnam() call. * modules/pam_unix/passverify.c (get_account_info) [!HELPER_COMPILE]: Always return PAM_UNIX_RUN_HELPER instead of trying to obtain the shadow password file entry. Complements: https://github.com/linux-pam/linux-pam/pull/386 Resolves: https://github.com/linux-pam/linux-pam/pull/484 Link: https://github.com/authselect/authselect/commit/1e78f7e048747024a846fd22d68afc6993734e92
* pam_unix: use getlineTobias Stoeckmann2024-01-031-2/+4
| | | | Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
* unix_chkpwd, unix_update: Use exit codes 128+ on signalsSolar Designer2023-12-291-1/+1
|
* pam_unix: sp_min and sp_warn must be at least 1Tobias Stoeckmann2023-12-121-2/+2
| | | | | | | If sp_min or sp_warn are set to 0 or empty (-1), then their respective features are disabled according to shadow(5). Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
* pam_unix: allow disabled password agingTobias Stoeckmann2023-12-121-0/+5
| | | | | | | | | According to shadow(5) manual page, an empty sp_lstchg field implies that password aging is disabled. This indeed is in sync with shadow's isexpired function. Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
* pam_unix: sync expiry checks with shadowTobias Stoeckmann2023-12-121-3/+3
| | | | | | | | | | | The shadow library uses "greater than or equal to" checks instead of current "greater than" checks in pam_unix. The account expiry check is already "greater than or equal to" so this adjustment can even be argued without making references to other projects. Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
* pam_unix: simplify save_old_passwordTobias Stoeckmann2023-12-121-13/+7
| | | | | | | | The combination of snprintf and fputs is not needed. It is possible to call fprintf directly. The previously ignored return value of snprintf is covered this way as well. Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
* pam_unix: fix possible shadow signed overflowsTobias Stoeckmann2023-12-111-20/+41
| | | | | | | | | | | | | | | | | | It is possible to trigger signed integer overflows in check_shadow_expiry if /etc/shadow contains very large values. Since these values have to be set by a system administrator, it would already count as a configuration error. Yet, avoid overflows which would consider accounts which are supposed to be valid for a veeery long time as already invalid. Also, it would be undefined behavior for almost all C standards. Also consider every negative value as invalid, not just -1. The shadow project has different ways of handling these values, but this approach is in sync with its lib/isexpired.c implementation. Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
* pam_unix: check str to integer conversionsTobias Stoeckmann2023-12-111-2/+8
| | | | | | Print an error in syslog if an integer could not be converted. Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
* pam_unix: avoid integer truncation in debug outputBenny Baumann2023-11-141-1/+1
| | | | | | | | When printing the current day and when the password was last changed, a truncation of the value could happen due to incorrect data types used in the format string. Signed-off-by: Benny Baumann <BenBE@geshi.org>
* pam_unix: avoid printing NULL valuesBenny Baumann2023-11-141-1/+1
| | | | | | | The value of pp can potentially be NULL. This handles this case when printing debug output. Signed-off-by: Benny Baumann <BenBE@geshi.org>
* modules: make use of secure memory erasureChristian Göttsche2023-02-281-8/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | Use empty initialization of structs to minimize the memset() usage, to reduce the amount of calls which are not sensitive. Non trivial changes: - pam_env: * erase environment variables where possible - pam_exec: * erase responce on error * erase auth token - pam_pwhistory: * erase buffers containing old passwords - pam_selinux: skip overwriting data structure consisting of only pointers to insensitive data, which also gets free'd afterwards (so it currently does not protect against double-free or use-after-free on the member pointers) - pam_unix: erase cipher data in more places - pam_userdb: erase password hashes
* modules: use SCONFIGDIR macroDmitry V. Levin2022-01-231-1/+1
| | | | | | | | | | | | | | | | | Use SCONFIGDIR macro instead of open-coding "/etc/security", the latter is not correct when configured using --enable-sconfigdir with an argument different from /etc/security. * modules/pam_faillock/faillock.h (FAILLOCK_DEFAULT_CONF): Use SCONFIGDIR. * modules/pam_namespace/pam_namespace.h (SECURECONF_DIR): Remove. (PAM_NAMESPACE_CONFIG, NAMESPACE_INIT_SCRIPT, NAMESPACE_D_DIR, NAMESPACE_D_GLOB): Use SCONFIGDIR. * modules/pam_namespace/Makefile.am (AM_CFLAGS): Remove -DSECURECONF_DIR. * modules/pam_pwhistory/opasswd.c (OLD_PASSWORDS_FILE): Use SCONFIGDIR. * modules/pam_unix/passverify.h: Likewise. * modules/pam_unix/passverify.c (OPW_TMPFILE): Use SCONFIGDIR.
* Fix a typo found using codespell toolDmitry V. Levin2021-09-031-3/+3
| | | | | | | * modules/pam_pwhistory/pam_pwhistory.c: Replace "crypted password" with "hashed password" in comment. * modules/pam_unix/passverify.c (create_password_hash): Rename "crypted" local variable to "hashed".
* pam_unix: workaround the problem caused by libnss_systemdDmitry V. Levin2021-08-191-2/+1
| | | | | | | | | | | | | | | | | | | The getspnam(3) manual page says that errno shall be set to EACCES when the caller does not have permission to access the shadow password file. Unfortunately, this contract is broken when libnss_systemd is used in the nss stack. Workaround this problem by falling back to the helper invocation when pam_modutil_getspnam returns NULL regardless of errno. As pam_unix already behaves this way when selinux is enabled, it should be OK for the case when selinux is not enabled, too. * modules/pam_unix/passverify.c (get_account_info): When pam_modutil_getspnam returns NULL, unconditionally fall back to the helper invocation. Complements: f220cace2053 ("Permit unix_chkpwd & pam_unix.so to run without being setuid-root") Resolves: https://github.com/linux-pam/linux-pam/issues/379
* Permit unix_chkpwd & pam_unix.so to run without being setuid-root.Andrew G. Morgan2021-06-291-4/+8
| | | | | | | | | | | | | | | | | | | | | Remove the hard-coding of the idea that the only way pam_unix.so can read the shadow file is if it can, in some way, run setuid-root. Linux capabilities only require cap_dac_override to read the /etc/shadow file. This change achieves two things: it opens a path for a linux-pam application to run without being setuid-root; further, it allows unix_chkpwd to run non-setuid-root if it is installed: sudo setcap cap_dac_override=ep unix_chkpwd If we wanted to link against libcap, we could install this binary with cap_dac_override=p, and use cap_set_proc() to raise the effective bit at runtime. However, some distributions already link unix_chkpwd against libcap-ng for some, likely spurious, reason so "ep" is fine for now. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
* Remove support for legacy xcryptBjörn Esser2021-06-141-19/+5
| | | | | | | | | | | | | | | | Since many distributions are shipping a version of libxcrypt >= 4.0.0 as a replacement for glibc's libcrypt now, older versions of xcrypt, which could be installed in parallel, are not relevant anymore. * configure.ac (AC_CHECK_HEADERS): Remove xcrypt.h. (AC_SEARCH_LIBS): Remove xcrypt. (AC_CHECK_FUNCS): Remove crypt_gensalt_r. (AC_DEFINE): Remove HAVE_LIBXCRYPT. * modules/pam_pwhistory/opasswd.c [HAVE_LIBXCRYPT]: Remove. * modules/pam_unix/bigcrypt.c [HAVE_LIBXCRYPT]: Likewise. * modules/pam_userdb/pam_userdb.c [HAVE_LIBXCRYPT]: Likewise. * modules/pam_unix/passverify.c [HAVE_LIBXCRYPT]: Likewise. (create_password_hash) [HAVE_LIBXCRYPT]: Likewise.
* pam_unix: do not use crypt_checksalt when checking for password expirationDmitry V. Levin2021-06-101-6/+0
| | | | | | | | | | | | | | According to Zack Weinberg, the intended meaning of CRYPT_SALT_METHOD_LEGACY is "passwd(1) should not use this hashing method", it is not supposed to mean "force a password change on next login for any user with an existing stored hash using this method". This reverts commit 4da9febc39b955892a30686e8396785b96bb8ba5. * modules/pam_unix/passverify.c (check_shadow_expiry) [CRYPT_CHECKSALT_AVAILABLE]: Remove. Closes: https://github.com/linux-pam/linux-pam/issues/367
* Add missing format function attributes and enable -Wmissing-format-attributeChristian Göttsche2020-10-251-0/+1
| | | | | | | | | | | | | | | | | Exported functions already have these attributes, add them to other functions. This enables compilers to find format specifier mismatches, like: foo_print("Hello %d", "world") * m4/warn_lang_flags.m4 (gl_WARN_ADD): Add -Wmissing-format-attribute. * conf/pam_conv1/Makefile.am (AM_CFLAGS): Add -I$(top_srcdir)/libpam/include. * conf/pam_conv1/pam_conv_y.y: Include <security/_pam_types.h>. (yyerror): Add printf format attribute. * modules/pam_pwhistory/opasswd.c (helper_log_err): Likewise. * modules/pam_rootok/pam_rootok.c (log_callback): Likewise. * modules/pam_tally/pam_tally.c (tally_log): Likewise. * modules/pam_tally2/pam_tally2.c (tally_log): Likewise. * modules/pam_unix/passverify.c (helper_log_err): Likewise.
* pam_unix: skip context translationChristian Göttsche2020-08-051-39/+39
| | | | | | | These retrieved contexts are just passed to libselinux functions and not printed or otherwise made available to the outside, so a context translation to human readable MCS/MLS labels is not needed. (see man:setrans.conf(5))
* pam_unix: replace deprecated security_context_tChristian Göttsche2020-08-051-6/+6
| | | | | libselinux 3.1 deprecated the typedef security_context_t. Use the underlaying type.
* Move read_passwords function from pam_unix to pam_inline.hikerexxe2020-07-151-43/+0
| | | | | | | | | | | | | | [ldv: rewrote commit message] * modules/pam_unix/passverify.h (read_passwords): Remove prototype. * modules/pam_unix/passverify.c (read_passwords): Move ... * libpam/include/pam_inline.h: ... here, rename to pam_read_passwords, add static inline qualifiers. Include <unistd.h> and <errno.h>. * modules/pam_unix/unix_chkpwd.c: Include "pam_inline.h". (main): Replace read_passwords with pam_read_passwords. * modules/pam_unix/unix_update.c: Include "pam_inline.h". (set_password): Replace read_passwords with pam_read_passwords.
* pam_unix: use PAM_MAX_RESP_SIZE instead of its alias MAXPASSDmitry V. Levin2020-07-151-2/+2
| | | | | | | | | | * modules/pam_unix/passverify.h (MAXPASS): Remove. * modules/pam_unix/passverify.c (read_passwords): Replace MAXPASS with PAM_MAX_RESP_SIZE. * modules/pam_unix/pam_unix_passwd.c (_pam_unix_approve_pass): Likewise. * modules/pam_unix/support.c (_unix_verify_password): Likewise. * modules/pam_unix/unix_chkpwd.c (main): Likewise. * modules/pam_unix/unix_update.c (set_password): Likewise.
* pam_unix: avoid determining if user existsikerexxe2020-06-171-0/+6
| | | | | | | | | Taking a look at the time for the password prompt to appear it was possible to determine if a user existed in a system. Solved it by matching the runtime until the password prompt was shown by always checking the password hash for an existing and a non-existing user. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1629598
* modules/pam_unix: use pam_str_skip_prefix and pam_str_skip_prefix_lenDmitry V. Levin2020-03-191-1/+2
| | | | | | | | | | | | | * modules/pam_unix/passverify.c: Include "pam_inline.h". (verify_pwd_hash): Use pam_str_skip_prefix instead of ugly strncmp invocations. * modules/pam_unix/support.c: Include "pam_inline.h". (_set_ctrl): Use pam_str_skip_prefix_len instead of hardcoding string lengths. * modules/pam_unix/md5_crypt.c: Include "pam_inline.h". (crypt_md5): Use pam_str_skip_prefix_len. squash! modules/pam_unix: use pam_str_skip_prefix and pam_str_skip_prefix_len
* modules/pam_unix: fix gcc compilation warningsDmitry V. Levin2020-03-191-14/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | When setreuid() fails, there is no way to proceed any further: either the process credentials are unchanged but inappropriate, or they are in an inconsistent state and nothing good could be made out of it. This fixes the following compilation warnings: modules/pam_unix/passverify.c:209:5: warning: ignoring return value of 'setreuid', declared with attribute warn_unused_result [-Wunused-result] modules/pam_unix/passverify.c:211:5: warning: ignoring return value of 'setreuid', declared with attribute warn_unused_result [-Wunused-result] modules/pam_unix/passverify.c:213:6: warning: ignoring return value of 'setreuid', declared with attribute warn_unused_result [-Wunused-result] modules/pam_unix/passverify.c:214:6: warning: ignoring return value of 'setreuid', declared with attribute warn_unused_result [-Wunused-result] modules/pam_unix/passverify.c:222:5: warning: ignoring return value of 'setreuid', declared with attribute warn_unused_result [-Wunused-result] modules/pam_unix/passverify.c:224:5: warning: ignoring return value of 'setreuid', declared with attribute warn_unused_result [-Wunused-result] modules/pam_unix/passverify.c:225:5: warning: ignoring return value of 'setreuid', declared with attribute warn_unused_result [-Wunused-result] modules/pam_unix/passverify.c:226:5: warning: ignoring return value of 'setreuid', declared with attribute warn_unused_result [-Wunused-result] modules/pam_unix/passverify.c:209:5: warning: ignoring return value of 'setreuid', declared with attribute warn_unused_result [-Wunused-result] modules/pam_unix/passverify.c:211:5: warning: ignoring return value of 'setreuid', declared with attribute warn_unused_result [-Wunused-result] modules/pam_unix/passverify.c:213:6: warning: ignoring return value of 'setreuid', declared with attribute warn_unused_result [-Wunused-result] modules/pam_unix/passverify.c:214:6: warning: ignoring return value of 'setreuid', declared with attribute warn_unused_result [-Wunused-result] modules/pam_unix/passverify.c:222:5: warning: ignoring return value of 'setreuid', declared with attribute warn_unused_result [-Wunused-result] modules/pam_unix/passverify.c:224:5: warning: ignoring return value of 'setreuid', declared with attribute warn_unused_result [-Wunused-result] modules/pam_unix/passverify.c:225:5: warning: ignoring return value of 'setreuid', declared with attribute warn_unused_result [-Wunused-result] modules/pam_unix/passverify.c:226:5: warning: ignoring return value of 'setreuid', declared with attribute warn_unused_result [-Wunused-result] * modules/pam_unix/passverify.c (get_account_info) [HELPER_COMPILE]: Always check setreuid return code and return PAM_CRED_INSUFFICIENT if setreuid failed.
* Fix remaining -Wcast-qual compilation warningsDmitry V. Levin2020-01-201-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Introduce a new internal header file with definitions of DIAG_PUSH_IGNORE_CAST_QUAL and DIAG_POP_IGNORE_CAST_QUAL macros, use them to temporary silence -Wcast-qual compilation warnings in various modules. * libpam/include/pam_cc_compat.h: New file. * libpam/Makefile.am (noinst_HEADERS): Add include/pam_cc_compat.h. * modules/pam_mkhomedir/pam_mkhomedir.c: Include "pam_cc_compat.h". (create_homedir): Wrap execve invocation in DIAG_PUSH_IGNORE_CAST_QUAL and DIAG_POP_IGNORE_CAST_QUAL. * modules/pam_namespace/pam_namespace.c: Include "pam_cc_compat.h". (pam_sm_close_session): Wrap the cast that discards ‘const’ qualifier in DIAG_PUSH_IGNORE_CAST_QUAL and DIAG_POP_IGNORE_CAST_QUAL. * modules/pam_tty_audit/pam_tty_audit.c: Include "pam_cc_compat.h". (nl_send): Wrap the cast that discards ‘const’ qualifier in DIAG_PUSH_IGNORE_CAST_QUAL and DIAG_POP_IGNORE_CAST_QUAL. * modules/pam_unix/pam_unix_acct.c: Include "pam_cc_compat.h". (_unix_run_verify_binary): Wrap execve invocation in DIAG_PUSH_IGNORE_CAST_QUAL and DIAG_POP_IGNORE_CAST_QUAL. * modules/pam_unix/pam_unix_passwd.c: Include "pam_cc_compat.h". (_unix_run_update_binary): Wrap execve invocation in DIAG_PUSH_IGNORE_CAST_QUAL and DIAG_POP_IGNORE_CAST_QUAL. * modules/pam_unix/passverify.c: Include "pam_cc_compat.h". (unix_update_shadow): Wrap the cast that discards ‘const’ qualifier in DIAG_PUSH_IGNORE_CAST_QUAL and DIAG_POP_IGNORE_CAST_QUAL. * modules/pam_unix/support.c: Include "pam_cc_compat.h". (_unix_run_helper_binary): Wrap execve invocation in DIAG_PUSH_IGNORE_CAST_QUAL and DIAG_POP_IGNORE_CAST_QUAL. * modules/pam_xauth/pam_xauth.c: Include "pam_cc_compat.h". (run_coprocess): Wrap execv invocation in DIAG_PUSH_IGNORE_CAST_QUAL and DIAG_POP_IGNORE_CAST_QUAL.
* pam_unix: Return NULL instead of calling crypt_md5_wrapper().Björn Esser2020-01-171-4/+3
| | | | | | | | | | | | | | | | | If the call to the crypt(3) function failed for some reason during hashing a new login passphrase, the wrapper function for computing a hash with the md5crypt method was called internally by the pam_unix module in previous versions of linux-pam. With CVE-2012-3287 in mind, the md5crypt method is not considered to be a safe nor recommended hashing method for a new login passphrase since at least 2012. Thus pam_unix should error out in case of a failure in crypt(3) instead of silently computing a hashed passphrase using a potentially unsafe method. * modules/pam_unix/pam_unix.8.xml: Update documentation. * modules/pam_unix/passverify.c (create_password_hash): Return NULL on error instead of silently invoke crypt_md5_wrapper().
* Changed variable salt to hashHulto2020-01-151-7/+7
| | | helper_verify_password's variable salt is not just the salt but the whole hash. Renamed for clarity and conformity with the rest of the code.
* pam_unix: Fix the spelling of Jan Rękorajski's name.Tomas Mraz2019-10-101-1/+1
|
* pam_unix: Use pam_syslog instead of helper_log_err.Tomas Mraz2018-11-271-11/+13
| | | | | | | | * modules/pam_unix/passverify.c (verify_pwd_hash): Add pamh argument via PAMH_ARG_DECL. Call pam_syslog() instead of helper_log_err(). * modules/pam_unix/passverify.h: Adjust the declaration of verify_pwd_hash(). * modules/pam_unix/support.c (_unix_verify_password): Add the pamh argument to verify_pwd_hash() call.
* pam_unix: Report unusable hashes found by checksalt to syslog.Björn Esser2018-11-271-0/+36
| | | | | | | | | | | | | | | | | | | libxcrypt can be build-time configured to support (or not support) various hashing methods. Future versions will also have support for runtime configuration by the system's vendor and/or administrator. For that reason adminstrator should be notified by pam if users cannot log into their account anymore because of such a change in the system's configuration of libxcrypt. Also check for malformed hashes, like descrypt hashes starting with "$2...", which might have been generated by unsafe base64 encoding functions as used in glibc <= 2.16. Such hashes are likely to be rejected by many recent implementations of libcrypt. * modules/pam_unix/passverify.c (verify_pwd_hash): Report unusable hashes found by checksalt to syslog.
* Revert "pam_unix: Add crypt_default method, if supported."Tomas Mraz2018-11-271-9/+0
| | | | This reverts commit ad435b386b22b456724dc5c5b8d9f2d1beffc558.
* pam_unix: Add crypt_default method, if supported.Björn Esser2018-11-271-0/+9
| | | | | | | | | | | | libxcrypt since v4.4.0 supports a default method for its gensalt function on most system configurations. As the default method is to be considered the strongest available hash method, it should be preferred over all other hash methods supported by pam. * modules/pam_unix/pam_unix.8.xml: Documentation for crypt_default. * modules/pam_unix/passverify.c: Add crypt_default method. * modules/pam_unix/support.h: Likewise.
* Revert part of the commit 4da9febcTomas Mraz2018-11-261-9/+0
| | | | | | | | | pam_unix: Do not return a hard failure on invalid or disabled salt as in some cases the failure actually is not interesting and can broke things such as password-less sudo. * modules/pam_unix/passverify.c (check_shadow_expiry): Revert checking of disabled or invalid salt.
* pam_unix: Add support for (gost-)yescrypt hashing methods.Björn Esser2018-11-231-1/+7
| | | | | | | | | | | | | | | libxcrypt (v4.2 and later) has added support for the yescrypt hashing method; gost-yescrypt has been added in v4.3. * modules/pam_unix/pam_unix.8.xml: Documentation for (gost-)yescrypt. * modules/pam_unix/pam_unix_acct.c: Use 64 bit type for control flags. * modules/pam_unix/pam_unix_auth.c: Likewise. * modules/pam_unix/pam_unix_passwd.c: Likewise. * modules/pam_unix/pam_unix_sess.c: Likewise. * modules/pam_unix/passverify.c: Add support for (gost-)yescrypt. * modules/pam_unix/passverify.h: Use 64 bit type for control flags. * modules/pam_unix/support.c: Set sane rounds for (gost-)yescrypt. * modules/pam_unix/support.h: Add support for (gost-)yescrypt.
* pam_unix: Add support for crypt_checksalt, if libcrypt supports it.Björn Esser2018-11-221-0/+15
| | | | | | | | | | | | | | | libxcrypt v4.3 has added the crypt_checksalt function to whether the prefix at the begining of a given hash string refers to a supported hashing method. Future revisions of this function will add support to check whether the hashing method, the prefix refers to, was disabled or considered deprecated by the system's factory presets or system administrator. Furthermore it will be able to detect whether the parameters, which are used by the corresponding hashing method, being encoded in the hash string are not considered to be strong enough anymore. *modules/pam_unix/passverify.c: Add support for crypt_checksalt.
* pam_unix: Prefer a gensalt function, that supports auto entropy.Björn Esser2018-11-221-0/+13
| | | | | | * modules/pam_unix/pam_unix_passwd.c: Initialize rounds parameter to 0. * modules/pam_unix/passverify.c: Prefer gensalt with auto entropy. * modules/pam_unix/support.c: Fix sanitizing of rounds parameter.
generated by cgit v1.2.3 (git 2.39.1) at 2025-04-08 07:16:46 +0000