headers
Jason Gerfen | 1 Nov 2005 16:55
Picon
Favicon

pam_krb5+ldap testing?

I am sure there are people out there are currently using a combination 
of ldap and kerberos of linux client authentication and am wondering if 
I can possibly solicit some assistance in testing a module that is a 
modification of the latested pam_krb5 module?

--

-- 
Jason Gerfen

"My girlfriend threated to
 leave me if I went boarding...
 I will miss her."
 ~ DIATRIBE aka FBITKK
Permalink | Reply | 0 comments |
headers
Oliver Schulze L. | 1 Nov 2005 23:16

Re: The infamous "check pass; user unknown"

Hi,
is there any news about this? Any patch or bug#?

I'm interested in porting the solution to RHEL4

Many thanks
Oliver

Tomas Mraz wrote:

>On Thu, 2005-04-28 at 11:56 -0400, Oliver Schulze L. wrote:
>
>  
>
>>The problem is that in /var/log/messages I get this 2 lines for every 
>>*sucessfull*
>>login. That is for every kind of login: console, pop3, imap, ssh, etc
>>
>>Apr 28 11:53:00 server app(pam_unix)[13817]: check pass; user unknown
>>Apr 28 11:53:00 server app(pam_unix)[13817]: authentication failure; 
>>logname= uid=0 euid=0 tty= ruser= rhost=
>>    
>>
>
>This is fixed in the FC4 test releases already.
>
>  
>

--

--
(Continue reading)

Permalink | Reply | 3 comments |
headers
Raj | 2 Nov 2005 02:55
Picon
Favicon

looking for pam_tacplus with "use_first_pass" option..

any links for pam_tacplus which supports
"use_first_pass" option?

the one I have doesn't support it.

thanks
Raj

		
__________________________________ 
Yahoo! FareChase: Search multiple travel sites in one click.
http://farechase.yahoo.com
Permalink | Reply | 0 comments |
headers
Thorsten Kukuk | 2 Nov 2005 09:19
Picon

Linux-PAM 0.81 released


This is release fixes only a security issue in pam_unix module and a
regression in pam_limits introduced with version 0.80.

When SELinux was enabled the unix_chkpwd helper didn't verify the user
which was executing it and if SELinux policy didn't prevent it or if
SELinux was running in permissive mode it would allow brute force
attacks on other users passwords. The new release adds additional check
before password verification and logs attempts with wrong password.

Some user limits set in the limits.conf were applied incorrectly. The
new release fixes the problem.

Dmitry V. Levin,
Sebastien Tricaud,
Thorsten Kukuk,
Tomas Mraz.

--

-- 
Thorsten Kukuk         http://www.suse.de/~kukuk/      kukuk <at> suse.de
SUSE LINUX Products GmbH       Maxfeldstr. 5       D-90409 Nuernberg
--------------------------------------------------------------------    
Key fingerprint = A368 676B 5E1B 3E46 CFCE  2D97 F8FD 4E23 56C6 FB4B
Permalink | Reply | 0 comments |
headers
Jason Clifford | 2 Nov 2005 12:59

Anyone willing to write a module for a bounty?

I have a need for a pam module similar to pam_listfile that will lookup an 
item from a mysql database table.

pam_mysql is not suitable as I'm not looking to authenticate a user login 
but rather to check against a list of authorised items (usernames, IP 
addresses, etc).

I'm not really comfortable writing this myself though so I'm hoping 
someone out there is willing to consider doing so - I am willing to pay 
for this although there isn't a great deal of money in the bank.

Jason Clifford
--

-- 
UKFSN.ORG		     Finance Free Software while you surf the 'net
http://www.ukfsn.org/	       2Mb ADSL Broadband from just £14.98 / month 
http://www.linuxadsl.co.uk/	     ADSL Routers from just £21.98
Permalink | Reply | 0 comments |
headers
Hannes Krueger | 8 Nov 2005 13:12
Picon
Favicon

pam_limits not effective

Hi out there,

I tried to set some hard memory limits using /etc/secutity/limits.conf
I set hard limits for my user for rss, data, stack, memlock 1000
I also set a maxlogins of 4.
I added "session required pam_limits.so" to /etc/pam.d/xdm and login.

I was able to verify that the maxlogins limit works.
all other limits seem to be without effect.

Is there anything else to do?
Are there any special requirements to the kernel?

I'm using 2.6.5-7.201-default (Suse kernel)

# Class Based Kernel Resource Management
#
CONFIG_CKRM=y
CONFIG_RCFS_FS=m
CONFIG_CKRM_TYPE_TASKCLASS=y
CONFIG_CKRM_RES_NUMTASKS=m
CONFIG_CKRM_CPU_SCHEDULE=y
# CONFIG_CKRM_CPU_SCHEDULE_AT_BOOT is not set
CONFIG_CKRM_RES_BLKIO=y
CONFIG_CKRM_TYPE_SOCKETCLASS=y
CONFIG_CKRM_RBCE=m
CONFIG_CKRM_CRBCE=m
CONFIG_DELAY_ACCT=y
CONFIG_KALLSYMS=y
CONFIG_FUTEX=y
(Continue reading)

Permalink | Reply | 1 comment |
headers
Philippe C. Martin | 8 Nov 2005 17:18

PAM newbie

Hi,

I am attempting to write a windows-GINA-like logon manager for GNU/Linux: 
gdk/kmd/xdm + smart card support. 
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/secauthn/security/gina.asp

To make things simple :-) I intend to write most of it in Python (I have found 
this PAM wrapper: http://packages.debian.org/unstable/python/python2.3-pam.

The architecture should be gdm-like: 
http://www.gnome.org/projects/gdm/gdmtalk.pdf with a smart card event manager 
added: www.snakecard.com/WordPress.

My current understanding is (simplified):

rc.local launches my "gdm" which in turn forks the various daemons:
1) smart event manager
2) greater (gdm uses two layers) here

Simple sequence of event:
1) the PC boots and a "regular" logon dialog box (username + password) is 
displayed (this is the greater)
2) the user inserts a card, the dialog box is replaced by another one which 
requests a PIN code
3) the greater calls an external module  that authenticates the cards, gives 
it the PIN code, retrieves username and password and logs on.

Is that external module a PAM module ?

Where should I start to study PAM ?
(Continue reading)

Permalink | Reply | 0 comments |
headers
Adm.rodrigo | 21 Nov 2005 11:56
Picon
Favicon

Re: Anyone willing to write a module for a bounty?

Hi! :D

Wed, 2 Nov 2005 11:59:15 +0000 (GMT)
Jason Clifford <jason <at> ukpost.com> escreveu:

JC> I have a need for a pam module similar to pam_listfile that will lookup
an 
JC> item from a mysql database table.

What I did was basicaly a merge from pam_mysql and pam_listfile module.  I
did not include the apply option from the pam_listfile module because I did
not understand it, but it may be included in future versions.

Theres much todo, some of it I have put in the TODO file, but this first
version seems to do what jason has asked.  Please try it out, if something
goes wrong please turn debug on and send me the syslog output.

Regards,
  Rodrigo Wanderley
________________________________________________________
Venha para a DIGINET - O maior e melhor provedor do RN! 
Ligue e assine:		4 0 0 8 - 9 0 0 0

http://www.digi.com.br

--

-- 
Esta mensagem foi verificada pelo sistema de anti-virus e
 acredita-se estar livre de perigo.
(Continue reading)

Permalink | Reply | 0 comments |
headers
Thorsten Kukuk | 21 Nov 2005 16:37
Picon

Linux-PAM 0.99.2.0 released


Hello,

The Linux-PAM developement team is pleased to announce the release
of version 0.99.2.0.

This release is the first version based on autoconf, automake and
libtool which is declared as "stable" by the Authors.

We would like to ask all Linux Distributors to update to this version,
the old "0.8x" branch will be no longer supported.

Beside the security fix from the 0.81 release it contains the
following changes since 0.99.1.0:

* Fix parsing of full path tty name in various modules
* pam_xauth: Look for xauth executable in multiple places
* pam_env: Support /etc/environment again, but don't treat it as
  error if it is missing.
* pam_userdb: Fix memory leak.

See the ChangeLog file for more details.

You can find the tar archives "Linux-PAM-0.99.2.0.tar.gz" and
"Linux-PAM-0.99.2.0-docs.tar.gz" on ftp.kernel.org and all mirrors
in the directory /pub/linux/libs/pam/pre/library/


Dmitry V. Levin,
Sebastien Tricaud,
(Continue reading)

Permalink | Reply | 2 comments |
headers
Darrell Fuhriman | 21 Nov 2005 18:16

Re: Linux-PAM 0.99.2.0 released

Thorsten Kukuk <kukuk <at> suse.de> writes:

> This release is the first version based on autoconf, automake and
> libtool which is declared as "stable" by the Authors.

This implies that portability is a priority (despite the
Linux-PAM name).  I don't get a clean build on Solaris, although
I would like to.

If I spend the time doing the clean-up, is there a reasonable
chance of getting the changes included in the distribution?

Darrell
Permalink | Reply | 1 comment |

Gmane