From owner-freebsd-security Tue Jan 23 14:13:45 2001 Delivered-To: freebsd-security@freebsd.org Received: from gw.nectar.com (gw.nectar.com [208.42.49.153]) by hub.freebsd.org (Postfix) with ESMTP id 6DA4937B69D for ; Tue, 23 Jan 2001 14:13:22 -0800 (PST) Received: from hamlet.nectar.com (hamlet.nectar.com [10.0.1.102]) by gw.nectar.com (Postfix) with ESMTP id D6ECE193E4; Tue, 23 Jan 2001 16:13:18 -0600 (CST) Received: (from nectar@localhost) by hamlet.nectar.com (8.11.1/8.9.3) id f0NMDIE81819; Tue, 23 Jan 2001 16:13:18 -0600 (CST) (envelope-from nectar@spawn.nectar.com) Date: Tue, 23 Jan 2001 16:13:18 -0600 From: "Jacques A. Vidrine" To: "David J. MacKenzie" Cc: freebsd-security@freebsd.org Subject: Re: PAM patches, iteration 4 Message-ID: <20010123161318.A95429@hamlet.nectar.com> Mail-Followup-To: "Jacques A. Vidrine" , "David J. MacKenzie" , freebsd-security@freebsd.org References: <20010123184611.E675046C7@dagger.web.us.uu.net> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5i In-Reply-To: <20010123184611.E675046C7@dagger.web.us.uu.net>; from djm@web.us.uu.net on Tue, Jan 23, 2001 at 01:46:11PM -0500 X-Url: http://www.nectar.com/ Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org On Tue, Jan 23, 2001 at 01:46:11PM -0500, David J. MacKenzie wrote: > I've updated the docs to reflect PAM, cleaned up some error handling, > and included my patch to work around the pam_setcred() dispatch problem. > I also removed the non-logincap code path from su and rshd, since it's > already mandatory in login. As before, this replaces my earlier patches. > I'd welcome having PAM experts examine them closely. I think they're > ready for a wider audience. Oops, I just committed a 3-line patch to login.c to call pam_setcred. This'll put your diff off a wee bit. These patches look like good to me. The pam_setcred workaround is no worse than what we have now [1], and it is useful. I'll let you know how they work for me (on -STABLE). Thanks! -- Jacques Vidrine / n@nectar.com / jvidrine@verio.net / nectar@FreeBSD.org [1] All the PAM modules in the base system just return PAM_SUCCESS, so this will have no effect unless a third-party module is installed, such as ports/security/krb5. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message