src-test2/lib/libpam, branch stable/6FreeBSD source treehttps://cgit-dev.freebsd.org/src-test2/atom?h=stable%2F62008-08-23T09:02:17ZMFH OpenPAM Hydrangea2008-08-23T09:02:17ZDag-Erling Smørgravdes@FreeBSD.org2008-08-23T09:02:17Zurn:sha1:f89ec83c8f99e504cd536d6db301a3d3e2f79536MFC: (1.21-1.23) cleanup, additional error checking2007-12-06T13:35:18ZDag-Erling Smørgravdes@FreeBSD.org2007-12-06T13:35:18Zurn:sha1:ad5f485dc2556cd2dac96bc4680aca3bb5b1ccbd
Approved by: re (kensmith)
MFC: (1.6) childerr needs to be volatile.2007-09-28T07:04:35ZDag-Erling Smørgravdes@FreeBSD.org2007-09-28T07:04:35Zurn:sha1:c24ff0ea67b4bf1fcfa9564922ba2b328d88f157
PR: bin/85830
MFC with compatibility shims:2007-08-17T11:28:25ZYaroslav Tykhiyytykhiy@gmail.com2007-08-17T11:28:25Zurn:sha1:b877ac6de1ae88679cce13dd417fea45a555b147
pam_nologin(8) starts to provide an account management function in
addition to the existing authentication function so that sshd(8) can
respect nologin(5) while the rest of PAM consumers work as earlier.
In turn, sshd(8) starts to use the new account management function
in pam_nologin(8) and thus respect nologin(5) even when doing public
key authentication with sshd's internal routines (PAM authentication
isn't called at all in that case).
Based on:
1.12 +2 -10 src/lib/libpam/modules/pam_nologin/pam_nologin.c
1.6 +10 -11 src/lib/libpam/modules/pam_nologin/pam_nologin.8
1.16 +1 -1 src/etc/pam.d/sshd
Approved by: des
PR: bin/112574
MFC:2007-07-12T14:11:57ZYaroslav Tykhiyytykhiy@gmail.com2007-07-12T14:11:57Zurn:sha1:d383e6f1bf3c2f9f066350c08cdfdd8c56026305
Use the current user's login class for the decisions about where
the nologin(5) file is located and whether the user may bypass its
restriction.
Add some error checks.
Revision Changes Path
1.7 +16 -15 src/lib/libpam/modules/pam_nologin/pam_nologin.8
1.13 +42 -29 src/lib/libpam/modules/pam_nologin/pam_nologin.c
Note: To avoid POLA violation, the merged module still lets root
in irrespective of login.conf settings. In HEAD, root has to have
an explicit "ignorenologin" capability to bypass nologin(5).
PR: bin/107612
MFC:2007-04-26T06:39:01ZYaroslav Tykhiyytykhiy@gmail.com2007-04-26T06:39:01Zurn:sha1:e6de7a561cfe5e0075b28c61d2fcf2bce76a8649
pam_unix.c 1.52
pam_unix.8 1.13
In account management, verify whether the account has been locked
with `pw lock', so that it's impossible to log into a locked account
using an alternative authentication mechanism, such as an ssh key.
This change affects only accounts locked with pw(8), i.e., having a
`*LOCKED*' prefix in their password hash field, so people still can
use a different pattern to disable password authentication only.
Mention all account management criteria in the manpage.
PR: bin/71147
MFC: 1.12: The pam_unix module also provides password management.2006-10-16T12:02:15ZRuslan Ermilovru@FreeBSD.org2006-10-16T12:02:15Zurn:sha1:d5cd343c18315f358b6618698a8a193aad1233cf
PR: docs/93491
Approved by: re (hrs)
MFC: OpenSSH 4.4p1.2006-10-06T14:07:23ZDag-Erling Smørgravdes@FreeBSD.org2006-10-06T14:07:23Zurn:sha1:373eb4397043a0e03b2163ce91eb52fa42155e07
Approved by: re (kensmith)
MFC: (1.26) reject usernames that are longer than OPIE can handle.2006-09-30T11:07:10ZDag-Erling Smørgravdes@FreeBSD.org2006-09-30T11:07:10Zurn:sha1:59dc0ea81d62a4eae6d43f2f343c33b2cc52b851
Approved by: re (kensmith)
Fix build by making this look like rev. 1.25.2006-07-14T16:48:52ZRuslan Ermilovru@FreeBSD.org2006-07-14T16:48:52Zurn:sha1:bd66f9d86d0132d4c2b0a63bb32f5af2b79c9bda