From owner-cvs-src@FreeBSD.ORG Mon Apr 30 13:42:32 2007 Return-Path: X-Original-To: cvs-src@freebsd.org Delivered-To: cvs-src@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 61BB516A400; Mon, 30 Apr 2007 13:42:32 +0000 (UTC) (envelope-from yar@comp.chem.msu.su) Received: from comp.chem.msu.su (comp.chem.msu.su [158.250.32.97]) by mx1.freebsd.org (Postfix) with ESMTP id 7D54013C487; Mon, 30 Apr 2007 13:42:31 +0000 (UTC) (envelope-from yar@comp.chem.msu.su) Received: from comp.chem.msu.su (localhost [127.0.0.1]) by comp.chem.msu.su (8.13.4/8.13.4) with ESMTP id l3UDgTMI036456; Mon, 30 Apr 2007 17:42:29 +0400 (MSD) (envelope-from yar@comp.chem.msu.su) Received: (from yar@localhost) by comp.chem.msu.su (8.13.4/8.13.4/Submit) id l3UDgS4I036455; Mon, 30 Apr 2007 17:42:28 +0400 (MSD) (envelope-from yar) Date: Mon, 30 Apr 2007 17:42:28 +0400 From: Yar Tikhiy To: Ceri Davies Message-ID: <20070430134227.GG32601@comp.chem.msu.su> References: <200704260639.l3Q6d1SH027885@repoman.freebsd.org> <20070426105458.GA98415@nevermind.kiev.ua> <20070426114638.GC77408@submonkey.net> <20070427160740.GF3991@comp.chem.msu.su> <20070430131503.GY77408@submonkey.net> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20070430131503.GY77408@submonkey.net> User-Agent: Mutt/1.5.9i Cc: cvs-src@freebsd.org, Alexandr Kovalenko , src-committers@freebsd.org, cvs-all@freebsd.org Subject: Re: cvs commit: src/lib/libpam/modules/pam_unix pam_unix.8 pam_unix.c X-BeenThere: cvs-src@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: CVS commit messages for the src tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 30 Apr 2007 13:42:32 -0000 On Mon, Apr 30, 2007 at 02:15:04PM +0100, Ceri Davies wrote: > On Fri, Apr 27, 2007 at 08:07:40PM +0400, Yar Tikhiy wrote: > > On Thu, Apr 26, 2007 at 12:46:38PM +0100, Ceri Davies wrote: > > > On Thu, Apr 26, 2007 at 01:54:59PM +0300, Alexandr Kovalenko wrote: > > > > Hello, Yar Tikhiy! > > > > > > > > On Thu, Apr 26, 2007 at 06:39:01AM +0000, you wrote: > > > > > > > > > yar 2007-04-26 06:39:01 UTC > > > > > > > > > > FreeBSD src repository > > > > > > > > > > Modified files: (Branch: RELENG_6) > > > > > lib/libpam/modules/pam_unix pam_unix.8 pam_unix.c > > > > > Log: > > > > > MFC: > > > > > pam_unix.c 1.52 > > > > > pam_unix.8 1.13 > > > > > > > > > > In account management, verify whether the account has been locked > > > > > with `pw lock', so that it's impossible to log into a locked account > > > > > using an alternative authentication mechanism, such as an ssh key. > > > > > This change affects only accounts locked with pw(8), i.e., having a > > > > > `*LOCKED*' prefix in their password hash field, so people still can > > > > > use a different pattern to disable password authentication only. > > > > > > > > Using the very same logic you should also add checking for '*', and for > > > > any other string, which cannot be in password hash of different > > > > algorithms. By the way, what if some crypto algorithm, which will be > > > > used for password hashing can produce hash, which contains substring > > > > '*LOCKED*' ? > > > > > > We really need to grow the same mechanism for this as Solaris has. > > > The way that this works is: > > > > > > o If the password hash begins *NP* then the user has no password > > > and password authentication will always fail. > > > > > > o If the password hash begins *LK* then the account is considered > > > locked and all authentication fails. Also, cron and at will > > > not run jobs for that user. > > > > > > o Anything else, the account is considered enabled (although of > > > course, password checking can still fail if the hash is not > > > valid). > > > > > > I couldn't care less what the strings actually are, but we should > > > probably use *LOCKED* for the locked case, although I can see that we > > > may wish to use something else to provide a somewhat backward compatible > > > route - those who have been using the string *LOCKED* as stated in the > > > pw manual would get the same behaviour that they do now. > > > > > > I am willing to work on this, but not without general agreement on the > > > above. > > > > I believe that general consensus in PR bin/71147 was that in FreeBSD > > a *LOCKED* prefix means the account is totally locked out while a > > single asterisk in the password field means password authentication > > is disabled. And, it isn't unfounded. That practice has already > > been supported by adduser(8) for quite a while. Now OpenSSH, too, > > looks for *LOCKED* as the FreeBSD-specific indication of an account > > being locked out if PAM isn't used. So I see my change to pam_unix(8) > > just as a step in the direction we've already been moving in. To > > match Solaris, we just need to document our practice well. > > Well, we currently have an *NP* case as per above, but not a *LK* case, > so I disagree somewhat. Why? Now *LOCKED* in FreeBSD is nearly the same as *LK* in Solaris with the only difference being that cron or at doesn't seem to care about it. And a single asterisk works for us as *NP* does in Solaris, although it isn't a prefix, it occupies the whole password field. Did I miss anything? -- Yar