Date: Sat, 19 Jan 2002 20:23:27 +0300 From: "Andrey A. Chernov" <ache@nagual.pp.ru> To: Dag-Erling Smorgrav <des@ofug.org>, mark@grondar.za Cc: cvs-committers@FreeBSD.org, cvs-all@FreeBSD.org Subject: Re: PAM pacthes we discuss Message-ID: <20020119172326.GA11604@nagual.pp.ru> In-Reply-To: <20020119171353.GA11472@nagual.pp.ru> References: <200201190901.g0J91H641020@freefall.freebsd.org> <xzp1ygm9vc8.fsf@flood.ping.uio.no> <20020119171353.GA11472@nagual.pp.ru>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sat, Jan 19, 2002 at 20:13:55 +0300, Andrey A. Chernov wrote:
> On Sat, Jan 19, 2002 at 17:08:55 +0100, Dag-Erling Smorgrav wrote:
>
> > out and submit them to markm and myself for review, along with a
>
> Here is the patch, similar /etc/pam.d/* changes are not included,
And one for pam_unix, that have no functionality flow changes:
Index: pam_unix.c
===================================================================
RCS file: /home/ncvs/src/lib/libpam/modules/pam_unix/pam_unix.c,v
retrieving revision 1.11
retrieving revision 1.14
diff -u -r1.11 -r1.14
--- pam_unix.c 25 Oct 2001 15:51:50 -0000 1.11
+++ pam_unix.c 19 Jan 2002 09:23:36 -0000 1.14
@@ -25,7 +25,7 @@
*/
#include <sys/cdefs.h>
-__FBSDID("$FreeBSD: src/lib/libpam/modules/pam_unix/pam_unix.c,v 1.11 2001/10/25 15:51:50 sobomax Exp $");
+__FBSDID("$FreeBSD: src/lib/libpam/modules/pam_unix/pam_unix.c,v 1.14 2002/01/19 09:23:36 ache Exp $");
#include <sys/types.h>
#include <sys/time.h>
@@ -152,6 +152,8 @@
retval = strcmp(encrypted, pwd->pw_passwd) == 0 ?
PAM_SUCCESS : PAM_AUTH_ERR;
+ if (pwd->pw_expire && time(NULL) >= pwd->pw_expire)
+ retval = PAM_AUTH_ERR;
}
else {
@@ -502,15 +504,14 @@
syslog(LOG_ERR, "cannot set password cipher");
login_close(lc);
/* Salt suitable for anything */
- srandomdev();
gettimeofday(&tv, 0);
- to64(&salt[0], random(), 3);
+ to64(&salt[0], arc4random(), 3);
to64(&salt[3], tv.tv_usec, 3);
to64(&salt[6], tv.tv_sec, 2);
- to64(&salt[8], random(), 5);
- to64(&salt[13], random(), 5);
- to64(&salt[17], random(), 5);
- to64(&salt[22], random(), 5);
+ to64(&salt[8], arc4random(), 5);
+ to64(&salt[13], arc4random(), 5);
+ to64(&salt[17], arc4random(), 5);
+ to64(&salt[22], arc4random(), 5);
salt[27] = '\0';
pwd->pw_passwd = crypt(pass, salt);
@@ -596,15 +597,14 @@
syslog(LOG_ERR, "cannot set password cipher");
login_close(lc);
/* Salt suitable for anything */
- srandomdev();
gettimeofday(&tv, 0);
- to64(&salt[0], random(), 3);
+ to64(&salt[0], arc4random(), 3);
to64(&salt[3], tv.tv_usec, 3);
to64(&salt[6], tv.tv_sec, 2);
- to64(&salt[8], random(), 5);
- to64(&salt[13], random(), 5);
- to64(&salt[17], random(), 5);
- to64(&salt[22], random(), 5);
+ to64(&salt[8], arc4random(), 5);
+ to64(&salt[13], arc4random(), 5);
+ to64(&salt[17], arc4random(), 5);
+ to64(&salt[22], arc4random(), 5);
salt[27] = '\0';
if (suser_override)
--
Andrey A. Chernov
http://ache.pp.ru/
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe cvs-all" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20020119172326.GA11604>