diff options
| author | Nalin Dahyabhai <nalin@fedoraproject.org> | 2008-02-25 18:33:34 +0000 |
|---|---|---|
| committer | Nalin Dahyabhai <nalin@fedoraproject.org> | 2008-02-25 18:33:34 +0000 |
| commit | a7d42c7b033afc04d091cf33f7c8cbae18c0caa9 (patch) | |
| tree | 8c3bb379b288a762c39817890a60c211c44fbaa1 | |
| parent | ea9df965b82948d26f77b5cda447547bdacf8c7a (diff) | |
- in login, allow PAM to interact with the user when they've been strongly
authenticated
- in login, signal PAM when we're changing an expired password that it's an
expired password, so that when cracklib flags a password as being weak
it's treated as an error even if we're running as root
| -rw-r--r-- | krb5-1.6.1-pam.patch | 6 | ||||
| -rw-r--r-- | krb5.spec | 7 |
2 files changed, 10 insertions, 3 deletions
diff --git a/krb5-1.6.1-pam.patch b/krb5-1.6.1-pam.patch index 943e662..392573e 100644 --- a/krb5-1.6.1-pam.patch +++ b/krb5-1.6.1-pam.patch @@ -240,7 +240,7 @@ When enabled, ftpd, krshd, and login.krb5 gain dependence on libpam. +#ifdef USE_PAM + if (login_use_pam) { -+ if (appl_pam_acct_mgmt(LOGIN_PAM_SERVICE, 0, username, "", ++ if (appl_pam_acct_mgmt(LOGIN_PAM_SERVICE, 1, username, "", + ttyname(STDIN_FILENO)) != 0) { + printf("Login incorrect\n"); + sleepexit(1); @@ -652,9 +652,9 @@ When enabled, ftpd, krshd, and login.krb5 gain dependence on libpam. + int ret = 0; + if (appl_pam_started) { +#ifdef DEBUG -+ printf("Changing PAM authentication token.\n"); ++ printf("Changing PAM expired authentication token.\n"); +#endif -+ ret = pam_chauthtok(appl_pamh, 0); ++ ret = pam_chauthtok(appl_pamh, PAM_CHANGE_EXPIRED_AUTHTOK); + } + return ret; +} @@ -226,6 +226,13 @@ to obtain initial credentials from a KDC using a private key and a certificate. %changelog +* Mon Feb 25 2008 Nalin Dahyabhai <nalin@redhat.com> +- in login, allow PAM to interact with the user when they've been strongly + authenticated +- in login, signal PAM when we're changing an expired password that it's an + expired password, so that when cracklib flags a password as being weak it's + treated as an error even if we're running as root + * Mon Feb 18 2008 Nalin Dahyabhai <nalin@redhat.com> 1.6.3-7 - drop netdb patch - kdb_ldap: add patch to treat 'nsAccountLock: true' as an indication that |