debian/0000755000000000000000000000000012242156637007176 5ustar debian/docs0000644000000000000000000000002112164235466010043 0ustar NEWS README TODO debian/README.Debian0000644000000000000000000000132412164235466011240 0ustar libpam-unix2 for Debian ----------------------- I had to migrate an OpenBSD server to Debian, so this is a package of the blowfish-capable pam_unix2 for Debian. -- Ivan Kohler , Sat Jan 24 16:16:26 PST 2004 In contrast to upstream version (which uses /etc/default/passwd), Debian version of this module uses /etc/security/pam_unix2.default as the configuration file. Super-quick HOWTO: - To recognize bcrypt hashes, edit /etc/pam.d/common-auth and /etc/pam.d/common-password, replacing pam_unix.so with pam_unix2.so - You can use "blowfish" instead of "md5" in common-password if you want bcrypt encryption to be the default -- Ivan Kohler , Sun Aug 8 07:52:50 PDT 2004 debian/postinst0000644000000000000000000000117712164235466011013 0ustar #!/bin/sh set -e # /sbin/unix2_chkpwd is installed setgid shadow by default. # For NIS it needs to be setuid root (see bugs #155583 and #544687). if [ -x /usr/bin/yppasswd ] then if ! dpkg-statoverride --list /sbin/unix2_chkpwd >/dev/null then dpkg-statoverride --update --add root root 4755 /sbin/unix2_chkpwd fi else if override=$(dpkg-statoverride --list /sbin/unix2_chkpwd) && \ [ "$override" = "root root 4755 /sbin/unix2_chkpwd" ] then dpkg-statoverride --remove /sbin/unix2_chkpwd chown root:shadow /sbin/unix2_chkpwd chmod 2755 /sbin/unix2_chkpwd fi fi #DEBHELPER# debian/dirs0000644000000000000000000000003212164235466010056 0ustar lib/security etc/security debian/changelog0000644000000000000000000001670012242156637011054 0ustar libpam-unix2 (1:2.6-2) unstable; urgency=low [ Hideki Yamane ] * QA upload. * debian/rules - add "-i" option to autoreconf (Closes: #725569) * debian/control - add "Build-Depends: autopoint" as above change * debian/patches - add specify-gettext-version.patch [ Michael Ablassmeier ] * QA Upload with changes by Hideki Yamane to fix FTBFS -- Hideki Yamane Thu, 17 Oct 2013 10:55:57 +0900 libpam-unix2 (1:2.6-1) unstable; urgency=low * QA upload. * New upstream version. * New patch 05_glibc216.diff to get the source to build with the new glibc version without the locking functions used (Closes: #701308). Thanks to Andreas Jaeger for the patch and Thorsten Kukuk for letting me know where to find it. * New patch 06_format_security.diff to fix format issue with pam_sysloc() call. -- Petter Reinholdtsen Mon, 01 Jul 2013 09:10:06 +0200 libpam-unix2 (1:2.4.1-6) unstable; urgency=low * QA upload. * Bump standards version to 3.9.3. * Avoid recursively forking unix2_chkpwd (closes: #544687). Thanks to Michael Fladischer for the bug report. * Add trigger file and postinst/postrm scripts to make unix2_chkpwd setuid root if nis is installed (see: #155583, #544687). Thanks to Christoph Pleger for the bug report. * Drop obsolete postrm snippet to clean after upgrades from etch. * Fix a typo in CPPFLAGS variable name. -- Jakub Wilk Sun, 10 Jun 2012 22:01:22 +0200 libpam-unix2 (1:2.4.1-5) unstable; urgency=low * QA upload (see #628848). + Set Maintainer to Debian QA Group. * Switch to source format 3.0 (quilt): + Add debian/source/format. + Rename debian/patch/00list to debian/patches/series. + Use .diff extension (rather than .dpatch) for patches. + Use DEP-3 for patch headers (rather than the dpatch-specific format). + Add extend-diff-ignore to debian/source/options, so that changes to config.{sub,guess} are ignored. + Remove explicit (un)patching code from debian/rules. + Remove dpatch from Build-Depends. * Use "<<" relation (rather than "<", which is deprecated). * Add ${misc:Depends}. * Bump debhelper compatibility level to 7: + Update debian/compat. + Update Build-Depends. + Use ‘dh_prep’ instead of ‘dh_clean -k’. + Don't remove build-stamp explicitly, it's now handled by dh_clean. * Acquire CFLAGS, CPPFLAGS and LDFLAGS from dpkg-buildflags and pass them to the configure script: + Update debian/rules. + Build depend on dpkg-dev (>= 1.15.7). + Add patch to fix FTBFS with -Werror=format-security. * Improve debian/rules: + Remove useless comments. + Don't ignore errors from ‘make distclean’. + Run ‘make clean’ in the unix2_chkpwd subdirectory instead of removing the files manually. + Update config.{sub,guess} unconditionally. + Don't fiddle with INSTALL_PROGRAM variable, as dh_strip does the right thing. + Pass --host to the configure script only when cross-compiling. + Don't depend on build* targets in binary-indep. + Merge install target into binary-arch. + Use dh_install instead of dh_movefiles. + Add build-arch and build-indep targets. * Improve debian/watch: + Upgrade version to 3. + Remove useless comments. + Remove ‘debian uupdate’. * Bump standards version to 3.9.2 (no changes needed). * Install /sbin/unix2_chkpwd as setgid shadow (rather than setuid root). Add lintian override for setgid-binary. * Respect LDFLAGS when building /sbin/unix2_chkpwd. Change link order, so that linking works with --as-needed (closes: #640942). Thanks to Colin Watson for the bug report. * Build-Depend on autotools-dev (needed for fresh config.{sub,guess} copies). Remove unused build-dependency on libtool. * Run autoreconf at build-time. + Add automake to Build-Depends. + Update debian/rules. + Update extend-diff-ignore in debian/source/options. * Reword README.Debian, so that it's clear that Debian version does _not_ use /etc/default/passwd (closes: #655565). Thanks to Vincent McIntyre for the bug report. * Fix typos in the configuration file and in the pam_unix2(8) manual page. -- Jakub Wilk Sat, 14 Jan 2012 01:57:57 +0100 libpam-unix2 (1:2.4.1-4) unstable; urgency=low * Don't error out on purging when obsolete /etc/security/pam_unix2.conf doesn't exist (closes: Bug#530903). -- Ivan Kohler Mon, 08 Jun 2009 19:56:56 -0700 libpam-unix2 (1:2.4.1-3) unstable; urgency=low * Fix watch file to be more accurate. -- Ivan Kohler Tue, 26 Aug 2008 09:42:37 -0700 libpam-unix2 (1:2.4.1-2) unstable; urgency=low * Update Build-Deps on libxcrypt to 1:2.4 to fix FTBFS (closes: Bug#492814) -- Ivan Kohler Tue, 29 Jul 2008 19:17:52 -0700 libpam-unix2 (1:2.4.1-1) unstable; urgency=low * Revert to upstream 2.4.1 to get this compiled & working against lenny libxcrypt (closes: Bug#487487). -- Ivan Kohler Tue, 22 Jul 2008 15:47:23 -0700 libpam-unix2 (2.5.0-3) unstable; urgency=low * Update watch file for new upstream x.y.z versioning. -- Ivan Kohler Tue, 10 Jun 2008 14:24:34 -0700 libpam-unix2 (2.5.0-2) unstable; urgency=low * Remove obsolete /etc/security/pam_unix2.conf config file from etch version on purge (closes: Bug#455033). * Clean up after unix2_chkpwd on "make clean". -- Ivan Kohler Tue, 03 Jun 2008 16:42:08 -0700 libpam-unix2 (2.5.0-1) unstable; urgency=low * New upstream release * Many, many thanks to Christoph Pleger for the unix2_chkpwd helper binary patch and to Steve Kemp for auditing the changes (closes: Bug#295526) -- Ivan Kohler Mon, 19 May 2008 19:17:29 -0700 libpam-unix2 (2.1-5) unstable; urgency=low * Use unix2_chkpwd as helper binary -- Christoph Pleger Tue, 13 May 2008 13:33:53 +0200 libpam-unix2 (2.1-4) unstable; urgency=low * Build against pam 0.99.7.1-1 (closes: Bug#429023) -- Ivan Kohler Wed, 08 Aug 2007 18:03:27 -0700 libpam-unix2 (2.1-3) unstable; urgency=low * Add Build-Dep: libpam0g-dev (>= 0.81) (closes: Bug#429023) -- Ivan Kohler Tue, 19 Jun 2007 12:10:19 -0700 libpam-unix2 (2.1-2) unstable; urgency=low * Brown-Paper-Bag-Release: Build-Dep on dpatch, though! (closes: Bug#428553) -- Ivan Kohler Tue, 12 Jun 2007 09:59:12 -0700 libpam-unix2 (2.1-1) unstable; urgency=low * New upstream release + Fix segfault on amd64 arch (& warning on i386) by replacing alloca with malloc (closes: Bug#351217) + Updates de.po translation; incorporates still-relevant changes from outstanding translation patch (closes: Bug#313780) * Properly implement the /etc/default/passwd to /etc/security/pam_unix2.default substitution with a dpatch, so it doesn't accidentally get lost again (closes: Bug#427058) * Acknowledge NMU removing Build-Dep on automake (closes: Bug#376556), thanks to Eric Dorland. -- Ivan Kohler Mon, 11 Jun 2007 17:16:26 -0700 libpam-unix2 (1.25-1) unstable; urgency=low * New upstream release -- Ivan Kohler Fri, 21 Jan 2005 18:31:54 -0800 libpam-unix2 (1.23-1) unstable; urgency=low * Initial Release (closes: Bug#237856). -- Ivan Kohler Sun, 8 Aug 2004 06:09:49 -0700 debian/patches/0000755000000000000000000000000012242156557010626 5ustar debian/patches/04_typos.diff0000644000000000000000000000107412164235466013143 0ustar Description: Fix a few typos. Author: Jakub Wilk Last-Update: 2012-01-11 --- a/doc/pam_unix2.8 +++ b/doc/pam_unix2.8 @@ -27,7 +27,7 @@ .BR session : .TP .B debug -A lot of debug informations are printed with +A lot of debug information is printed with .BR syslog (3). .TP .B nullok --- a/etc/passwd +++ b/etc/passwd @@ -6,7 +6,7 @@ # CRYPT={des,md5,blowfish} CRYPT=des -# Use another crypt hash for group passwowrds. +# Use another crypt hash for group passwords. # This is used by gpasswd, fallback is the CRYPT entry. # GROUP_CRYPT=des debian/patches/series0000644000000000000000000000022312242156557012040 0ustar 01_conf_location.diff 02_helper.diff 03_format_security.diff 04_typos.diff 05_glibc216.diff 06_format_security.diff specify-gettext-version.patch debian/patches/03_format_security.diff0000644000000000000000000000056612164235466015210 0ustar Description: Fix FTBFS with -Werror=format-security. Author: Jakub Wilk Last-Update: 2012-01-11 --- a/src/getuser.c +++ b/src/getuser.c @@ -427,7 +427,7 @@ *passwd = NULL; - retval = pam_prompt (pamh, PAM_PROMPT_ECHO_OFF, &resp, msgs); + retval = pam_prompt (pamh, PAM_PROMPT_ECHO_OFF, &resp, "%s", msgs); if (retval != PAM_SUCCESS) { debian/patches/05_glibc216.diff0000644000000000000000000000172712164614046013277 0ustar Description: Adjust source to work with glibc 2.16 Fix build failure caused by no longer providing the functions we used to use. Copy of pam_unix2-glibc216.patch dated 2013-07-02 from https://build.opensuse.org/package/show/Linux-PAM/pam-modules Author: Andreas Jaeger Bug-Debian: http://bugs.debian.org/701308 Index: pam_unix2-2.9.1/src/read-files.c =================================================================== --- pam_unix2-2.9.1.orig/src/read-files.c +++ pam_unix2-2.9.1/src/read-files.c @@ -30,8 +30,14 @@ #include #include #include -#include +#include #define __libc_lock_t pthread_mutex_t +#define __libc_lock_define_initialized(CLASS,NAME) \ + CLASS __libc_lock_t NAME = PTHREAD_MUTEX_INITIALIZER; +#define __libc_lock_lock(NAME) \ + pthread_mutex_lock, (&(NAME)) +#define __libc_lock_unlock(NAME) \ + pthread_mutex_unlock, (&(NAME)) #include "read-files.h" debian/patches/06_format_security.diff0000644000000000000000000000101212164614246015173 0ustar Description: Fix format error in pam_syslog() call Make sure pam_syslog call is always printing the right thing. Author: Petter Reinholdtsen Forwarded: no Last-Update: 2013-07-02 --- libpam-unix2-2.6.orig/src/unix_sess.c +++ libpam-unix2-2.6/src/unix_sess.c @@ -124,7 +124,7 @@ pam_log_session (pam_handle_t *pamh, int return PAM_SESSION_ERR; } - pam_syslog (pamh, options.log_level, logmsg); + pam_syslog (pamh, options.log_level, "%s", logmsg); free (logmsg); return PAM_SUCCESS; debian/patches/01_conf_location.diff0000644000000000000000000000173612164235466014604 0ustar Description: Change upstream /etc/default/passwd to the more Debian/FHS-friendly. Author: Ivan Kohler Last-Update: 2012-01-11 --- a/doc/pam_unix2.8 +++ b/doc/pam_unix2.8 @@ -18,7 +18,7 @@ .PP The options can be added in the PAM configuration files for every single service. -.B /etc/default/passwd +.B /etc/security/pam_unix2.default defines, which password encryption algorithm should be used in case of a password change. .SH OPTIONS @@ -93,7 +93,7 @@ and login expire are ignored, only on aging warning is printed. If no shadow information exists, it always returns success. .SH FILES -/etc/default/passwd +/etc/security/pam_unix2.default .SH "SEE ALSO" .BR login (1), .BR passwd (1), --- a/src/logindefs.c +++ b/src/logindefs.c @@ -155,7 +155,7 @@ static void load_defaults (void) { - load_defaults_internal ("/etc/default/passwd"); + load_defaults_internal ("/etc/security/pam_unix2.default"); load_defaults_internal ("/etc/login.defs"); } debian/patches/specify-gettext-version.patch0000644000000000000000000000071512242156557016461 0ustar Description: necessary to specify gettext version autopoint needs to specify gettext version in configure.in Author: Hideki Yamane --- Bug-Debian: http://bugs.debian.org/ Last-Update: 2013-10-17 --- libpam-unix2-2.6.orig/configure.in +++ libpam-unix2-2.6/configure.in @@ -93,7 +93,7 @@ else LDFLAGS="${LDFLAGS} -G" fi -AM_GNU_GETTEXT_VERSION +AM_GNU_GETTEXT_VERSION(0.18) AM_GNU_GETTEXT([external]) AC_SUBST(LIBPAM) debian/patches/02_helper.diff0000644000000000000000000002706012164235466013245 0ustar Description: Call helper binary in case of possibly insufficient permissions. Author: Christoph Pleger Last-Update: 2012-01-11 --- a/src/unix_auth.c +++ b/src/unix_auth.c @@ -57,6 +57,7 @@ #define PAM_SM_AUTH #include +#include #if defined (HAVE_SECURITY_PAM_EXT_H) #include #endif @@ -69,6 +70,7 @@ #include "public.h" +#define CHKPWD_HELPER "/sbin/unix2_chkpwd" /* This module actually performs UNIX/shadow authentication. */ @@ -121,6 +123,76 @@ return 0; } +static int _unix2_run_helper_binary(pam_handle_t *pamh, const char *passwd, + const char *user, const options_t *options) +{ + int retval, child, fds[2]; + sigset_t sigset; + char *service; + + pam_get_item (pamh, PAM_SERVICE, (void *) &service); + + if (options->debug) + pam_syslog (pamh, LOG_DEBUG, "_unix2_run_helper_binary called."); + /* create a pipe for the password */ + if (pipe(fds) != 0) { + if (options->debug) + pam_syslog (pamh, LOG_DEBUG, "could not make pipe"); + return PAM_AUTH_ERR; + } + + /* Block SIGCHLD */ + sigemptyset(&sigset); + sigaddset(&sigset, SIGCHLD); + sigprocmask(SIG_BLOCK, &sigset, 0); + + /* fork */ + child = fork(); + if (child == 0) { + char *args[] = { NULL, NULL, NULL, NULL }; + static char *envp[] = { NULL }; + + /* XXX - should really tidy up PAM here too */ + + /* reopen stdin as pipe */ + close(fds[1]); + dup2(fds[0], STDIN_FILENO); + + /* exec binary helper */ + args[0] = x_strdup(CHKPWD_HELPER); + args[1] = x_strdup(service); + args[2] = x_strdup(user); + + execve(CHKPWD_HELPER, args, envp); + + /* should not get here: exit with error */ + if (options->debug) + pam_syslog (pamh, LOG_DEBUG, "helper binary is not available"); + exit(PAM_AUTHINFO_UNAVAIL); + } else if (child > 0) { + if (passwd != NULL) { /* send the password to the child */ + write(fds[1], passwd, strlen(passwd)+1); + passwd = NULL; + } else { + write(fds[1], "", 1); /* blank password */ + } + close(fds[0]); /* close here to avoid possible SIGPIPE above */ + close(fds[1]); + (void) waitpid(child, &retval, 0); /* wait for helper to complete */ + retval = (retval == 0) ? PAM_SUCCESS:PAM_AUTH_ERR; + } else { + if (options->debug) + pam_syslog (pamh, LOG_DEBUG, "fork failed"); + retval = PAM_AUTH_ERR; + } + + /* Unblock SIGCHLD */ + sigprocmask(SIG_BLOCK, &sigset, 0); + + if (options->debug) + pam_syslog (pamh, LOG_DEBUG, "returning %d", retval); + return retval; +} int pam_sm_authenticate (pam_handle_t *pamh, int flags, int argc, @@ -307,7 +379,7 @@ salt = strdupa (sp->sp_pwdp); else { - if (strcmp (pw->pw_passwd, "x") == 0) + if ((strcmp (pw->pw_passwd, "x") == 0) && ((geteuid() == 0))) __write_message (pamh, flags, PAM_TEXT_INFO, _("Permissions on the password database may be too restrictive.")); salt = strdupa (pw->pw_passwd); @@ -329,10 +401,21 @@ if (strcmp (crypt_r (password, salt, &output), salt) != 0) { + if (geteuid() && (strcmp(program_invocation_name, CHKPWD_HELPER) != 0)) + { + /* we are not root, perhaps this is the reason? Run helper */ + if (options.debug) + pam_syslog (pamh, LOG_DEBUG, "running helper binary"); + + retval = _unix2_run_helper_binary(pamh, password, name, &options); + return retval; + } + if (options.debug) pam_syslog (pamh, LOG_DEBUG, "wrong password, return PAM_AUTH_ERR"); return PAM_AUTH_ERR; } + if (options.debug) pam_syslog (pamh, LOG_DEBUG, "pam_sm_authenticate: PAM_SUCCESS"); return PAM_SUCCESS; --- /dev/null +++ b/unix2_chkpwd/Makefile @@ -0,0 +1,15 @@ +# Author: Christoph Pleger + +all: unix2_chkpwd + +unix2_chkpwd: unix2_chkpwd.o + $(LINK.c) -o unix2_chkpwd unix2_chkpwd.o -lpam + +clean: + rm -f unix2_chkpwd unix2_chkpwd.o + +install: all + install -m 755 -d $(DESTDIR)/sbin + install -m u=rwx,g=rsx,o=rx -g shadow unix2_chkpwd $(DESTDIR)/sbin + install -m 755 -d $(DESTDIR)/usr/share/man/man8 + install -m 644 unix2_chkpwd.8 $(DESTDIR)/usr/share/man/man8 --- /dev/null +++ b/unix2_chkpwd/unix2_chkpwd.8 @@ -0,0 +1,79 @@ +.\" Copyright (C) 2003 International Business Machines Corporation +.\" This file is distributed according to the GNU General Public License. +.\" See the file COPYING in the top level source directory for details. +.\" +.de Sh \" Subsection +.br +.if t .Sp +.ne 5 +.PP +\fB\\$1\fR +.PP +.. +.de Sp \" Vertical space (when we can't use .PP) +.if t .sp .5v +.if n .sp +.. +.de Ip \" List item +.br +.ie \\n(.$>=3 .ne \\$3 +.el .ne 3 +.IP "\\$1" \\$2 +.. +.TH "UNIX2_CHKPWD" 8 "2003-03-21" "Linux-PAM 0.76" "Linux-PAM Manual" +.SH NAME +unix2_chkpwd \- helper binary that verifies the password of the current user +.SH "SYNOPSIS" +.ad l +.hy 0 + +/sbin/unix2_chkpwd \fIservicename\fR \fIusername\fR +.sp +.ad +.hy +.SH "DESCRIPTION" +.PP +\fBunix2_chkpwd\fR is a helper program for applications that verifies +the password of the current user. It is not intended to be run directly from +the command line and logs a security violation if done so. + +It is typically installed setuid root or setgid shadow and called by +applications, which only wishes to do an user authentication and +nothing more. + +.SH "OPTIONS" +.PP +unix2_pwdchk requires the following arguments: +.TP +\fIpam_service\fR +The name of the service using unix2_chkpwd. This is required to be one of +the services in /etc/pam.d +.TP +\fIusername\fR +The name of the user whose password you want to verify. + +.SH "INPUTS" +.PP +unix2_pwdchk expects the password via stdin. + +.SH "RETURN CODES" +.PP +\fBunix2_chkpwd\fR has the following return codes: +.TP +1 +unix2_chkpwd was inappropriately called from the command line or the password is incorrect. + +.TP +0 +The password is correct. + +.SH "HISTORY" +Written by Olaf Kirch loosely based on unix_chkpwd by Andrew Morgan + +.SH "SEE ALSO" + +.PP +\fBpam\fR(8) + +.SH AUTHOR +Emily Ratliff. --- /dev/null +++ b/unix2_chkpwd/unix2_chkpwd.c @@ -0,0 +1,264 @@ +/* + * Set*id helper program for PAM authentication. + * + * It is supposed to be called from pam_unix2's + * pam_sm_authenticate function if the function notices + * that it's unable to get the password from the shadow file + * because it doesn't have sufficient permissions. + * + * Copyright (C) 2002 SuSE Linux AG + * + * Written by okir@suse.de, loosely based on unix_chkpwd + * by Andrew Morgan. + */ + +#include +#include + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +enum { + UNIX_PASSED = 0, + UNIX_FAILED = 1 +}; + +static char * program_name; +static char pass[64]; +static int npass = -1; + +/* + * Log error messages + */ +static void +_log_err(int err, const char *format,...) +{ + va_list args; + + va_start(args, format); + openlog(program_name, LOG_CONS | LOG_PID, LOG_AUTH); + vsyslog(err, format, args); + va_end(args); + closelog(); +} + +static void +su_sighandler(int sig) +{ + if (sig > 0) { + _log_err(LOG_NOTICE, "caught signal %d.", sig); + exit(sig); + } +} + +/* + * Setup signal handlers + */ +static void +setup_signals(void) +{ + struct sigaction action; + + memset((void *) &action, 0, sizeof(action)); + action.sa_handler = su_sighandler; + action.sa_flags = SA_RESETHAND; + sigaction(SIGILL, &action, NULL); + sigaction(SIGTRAP, &action, NULL); + sigaction(SIGBUS, &action, NULL); + sigaction(SIGSEGV, &action, NULL); + action.sa_handler = SIG_IGN; + action.sa_flags = 0; + sigaction(SIGTERM, &action, NULL); + sigaction(SIGHUP, &action, NULL); + sigaction(SIGINT, &action, NULL); + sigaction(SIGQUIT, &action, NULL); + sigaction(SIGALRM, &action, NULL); +} + +static int +_converse(int num_msg, const struct pam_message **msg, + struct pam_response **resp, void *appdata_ptr) +{ + struct pam_response *reply; + int num; + + if (!(reply = malloc(sizeof(*reply) * num_msg))) + return PAM_CONV_ERR; + + for (num = 0; num < num_msg; num++) { + reply[num].resp_retcode = PAM_SUCCESS; + reply[num].resp = NULL; + switch (msg[num]->msg_style) { + case PAM_PROMPT_ECHO_ON: + return PAM_CONV_ERR; + case PAM_PROMPT_ECHO_OFF: + /* read the password from stdin */ + if (npass < 0) { + npass = read(STDIN_FILENO, pass, sizeof(pass)-1); + if (npass < 0) { + _log_err(LOG_DEBUG, "error reading password"); + return UNIX_FAILED; + } + pass[npass] = '\0'; + } + reply[num].resp = strdup(pass); + break; + case PAM_TEXT_INFO: + case PAM_ERROR_MSG: + /* ignored */ + break; + default: + /* Must be an error of some sort... */ + return PAM_CONV_ERR; + } + } + + *resp = reply; + return PAM_SUCCESS; +} + +static int +_authenticate(const char *service, const char *user) +{ + struct pam_conv conv = { _converse, NULL }; + pam_handle_t *pamh; + int err; + + err = pam_start(service, user, &conv, &pamh); + if (err != PAM_SUCCESS) { + _log_err(LOG_ERR, "pam_start(%s, %s) failed (errno %d)", + service, user, err); + return UNIX_FAILED; + } + + err = pam_authenticate(pamh, 0); + if (err != PAM_SUCCESS) + _log_err(LOG_ERR, "pam_authenticate(%s, %s): %s", + service, user, + pam_strerror(pamh, err)); + pam_end(pamh, err); + + if (err != PAM_SUCCESS) + return UNIX_FAILED; + return UNIX_PASSED; +} + +static char * +getuidname(uid_t uid) +{ + struct passwd *pw; + static char username[32]; + + pw = getpwuid(uid); + if (pw == NULL) + return NULL; + + strncpy(username, pw->pw_name, sizeof(username)); + username[sizeof(username) - 1] = '\0'; + + endpwent(); + return username; +} + +static int +sane_pam_service(const char *name) +{ + const char *sp; + char path[128]; + + if (strlen(name) > 32) + return 0; + for (sp = name; *sp; sp++) { + if (!isalnum(*sp) && *sp != '_' && *sp != '-') + return 0; + } + + snprintf(path, sizeof(path), "/etc/pam.d/%s", name); + return access(path, R_OK) == 0; +} + +int +main(int argc, char *argv[]) +{ + const char *program_name; + char *service, *user; + int fd; + uid_t uid; + + uid = getuid(); + + /* + * Make sure standard file descriptors are connected. + */ + while ((fd = open("/dev/null", O_RDWR)) <= 2) + ; + close(fd); + + /* + * Get the program name + */ + if (argc == 0) + program_name = "unix2_chkpwd"; + else if ((program_name = strrchr(argv[0], '/')) != NULL) + program_name++; + else + program_name = argv[0]; + + /* + * Catch or ignore as many signal as possible. + */ + setup_signals(); + + /* + * Check argument list + */ + if (argc < 2 || argc > 3) { + _log_err(LOG_NOTICE, "Bad number of arguments (%d)", argc); + return UNIX_FAILED; + } + + /* + * Get the service name and do some sanity checks on it + */ + service = argv[1]; + if (!sane_pam_service(service)) { + _log_err(LOG_ERR, "Illegal service name '%s'", service); + return UNIX_FAILED; + } + + /* + * Discourage users messing around (fat chance) + */ + if (isatty(STDIN_FILENO) && uid != 0) { + _log_err(LOG_NOTICE, + "Inappropriate use of Unix helper binary [UID=%d]", + uid); + fprintf(stderr, + "This binary is not designed for running in this way\n" + "-- the system administrator has been informed\n"); + sleep(10); /* this should discourage/annoy the user */ + return UNIX_FAILED; + } + + /* + * determine the caller's user name + */ + user = getuidname(uid); + if (argc == 3 && strcmp(user, argv[2])) { + user = argv[2]; + /* Discourage use of this program as a + * password cracker */ + if (uid != 0) + sleep(5); + } + return _authenticate(service, user); +} debian/libpam-unix2.install0000644000000000000000000000013612164235466013076 0ustar lib/security/pam*.so etc/security/pam_unix2.* usr/share/locale/*/*/* usr/share/man/*/* sbin/* debian/copyright0000644000000000000000000000443212164235466011135 0ustar This package was debianized by Ivan Kohler on Sun, 8 Aug 2004 06:09:49 -0700. It was downloaded from ftp://ftp.suse.com/pub/people/kukuk/pam/pam_unix2/ Upstream Author: Thorsten Kukuk Olaf Kirch Copyright: Copyright (C) 2001-2004 SuSE Linux AG Nuernberg, Germany /* * Copyright (c) 2000 SuSE GmbH Nuernberg, Germany. * Author: Thorsten Kukuk * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, and the entire permission notice in its entirety, * including the disclaimer of warranties. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * 3. The name of the author may not be used to endorse or promote * products derived from this software without specific prior * written permission. * * ALTERNATIVELY, this product may be distributed under the terms of * the GNU Public License, in which case the provisions of the GPL are * required INSTEAD OF the above restrictions. (This clause is * necessary due to a potential bad interaction between the GPL and * the restrictions contained in a BSD-style copyright.) * * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE * DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED * OF THE POSSIBILITY OF SUCH DAMAGE. */ On Debian GNU/Linux systems, the complete text of the GNU General Public License can be found in `/usr/share/common-licenses/GPL'. debian/prerm0000644000000000000000000000053112164235466010246 0ustar #!/bin/sh set -e if [ "$1" != upgrade ] then if override=$(dpkg-statoverride --list /sbin/unix2_chkpwd) && \ [ "$override" = "root root 4755 /sbin/unix2_chkpwd" ] then dpkg-statoverride --remove /sbin/unix2_chkpwd chown root:shadow /sbin/unix2_chkpwd chmod 2755 /sbin/unix2_chkpwd fi fi #DEBHELPER# debian/control0000644000000000000000000000107612242156557010606 0ustar Source: libpam-unix2 Section: admin Priority: extra Maintainer: Debian QA Group Build-Depends: debhelper (>= 7), dpkg-dev (>= 1.15.7), libpam0g-dev (>= 0.81), autoconf, automake, autopoint, libxcrypt-dev (>= 1:2.4), libxcrypt-dev (<< 1:3.0) Build-Conflicts: libxcrypt2 Standards-Version: 3.9.3 Package: libpam-unix2 Architecture: any Depends: ${shlibs:Depends}, ${misc:Depends} Description: Blowfish-capable PAM module This is a PAM module, backward-compatible with pam_unix, that additionally supports bcrypt Blowfish-based password hashing. debian/triggers0000644000000000000000000000003312164235466010744 0ustar interest /usr/bin/yppasswd debian/watch0000644000000000000000000000013712164235466010231 0ustar version=3 ftp://ftp.suse.com/pub/people/kukuk/pam/pam_unix2/pam_unix2-(\w+\.[\w\.]+)\.tar\.bz2 debian/source/0000755000000000000000000000000012164235466010477 5ustar debian/source/format0000644000000000000000000000001412164235466011705 0ustar 3.0 (quilt) debian/source/options0000644000000000000000000000023312164235466012113 0ustar extend-diff-ignore = "^config[.](sub|guess)$" extend-diff-ignore = "^(aclocal[.]m4|config[.]h[.]in|configure)$" extend-diff-ignore = "(^|/)Makefile[.]in$" debian/libpam-unix2.lintian-overrides0000644000000000000000000000016312164235466015066 0ustar # Yes, we know it's setgid, that's the whole point. libpam-unix2: setgid-binary sbin/unix2_chkpwd 2755 root/shadow debian/rules0000755000000000000000000000334512242156557010264 0ustar #!/usr/bin/make -f DEB_HOST_GNU_TYPE ?= $(shell dpkg-architecture -qDEB_HOST_GNU_TYPE) DEB_BUILD_GNU_TYPE ?= $(shell dpkg-architecture -qDEB_BUILD_GNU_TYPE) ifeq ($(DEB_BUILD_GNU_TYPE), $(DEB_HOST_GNU_TYPE)) confflags = --build $(DEB_HOST_GNU_TYPE) else confflags = --build $(DEB_BUILD_GNU_TYPE) --host $(DEB_HOST_GNU_TYPE) endif confflags += --prefix=/usr --mandir=\$${prefix}/share/man --infodir=\$${prefix}/share/info export CFLAGS = -Wall $(shell dpkg-buildflags --get CFLAGS) export CPPFLAGS = $(shell dpkg-buildflags --get CPPFLAGS) export LDFLAGS = $(shell dpkg-buildflags --get LDFLAGS) config.status: configure dh_testdir autoreconf -vif cp -f /usr/share/misc/config.sub config.sub cp -f /usr/share/misc/config.guess config.guess ./configure $(confflags) .PHONY: build build-arch build-indep build: build-arch build-indep build-indep: ; build-arch: build-stamp build-stamp: config.status dh_testdir $(MAKE) $(MAKE) -C unix2_chkpwd touch build-stamp .PHONY: clean clean: dh_testdir dh_testroot [ ! -f Makefile ] || $(MAKE) distclean $(MAKE) -C unix2_chkpwd clean dh_clean .PHONY: binary binary-arch binary-indep binary: binary-arch binary-indep binary-indep: ; binary-arch: build-arch dh_testdir dh_testroot dh_prep dh_installdirs $(MAKE) install DESTDIR=$(CURDIR)/debian/tmp $(MAKE) -C unix2_chkpwd install DESTDIR=$(CURDIR)/debian/tmp mkdir debian/tmp/etc/security mv debian/tmp/etc/default/passwd debian/tmp/etc/security/pam_unix2.default rmdir debian/tmp/etc/default dh_install dh_installchangelogs ChangeLog dh_installdocs dh_installexamples dh_installman dh_lintian dh_link dh_strip dh_compress dh_fixperms --exclude /sbin/unix2_chkpwd dh_installdeb dh_shlibdeps dh_gencontrol dh_md5sums dh_builddeb debian/compat0000644000000000000000000000000212164235466010375 0ustar 7