From owner-cvs-all Sat Jan 19 9:23:55 2002 Delivered-To: cvs-all@freebsd.org Received: from nagual.pp.ru (pobrecita.freebsd.ru [194.87.13.42]) by hub.freebsd.org (Postfix) with ESMTP id 4574037B402; Sat, 19 Jan 2002 09:23:33 -0800 (PST) Received: (from ache@localhost) by nagual.pp.ru (8.11.6/8.11.6) id g0JHNSB11686; Sat, 19 Jan 2002 20:23:29 +0300 (MSK) (envelope-from ache) Date: Sat, 19 Jan 2002 20:23:27 +0300 From: "Andrey A. Chernov" To: Dag-Erling Smorgrav , mark@grondar.za Cc: cvs-committers@FreeBSD.org, cvs-all@FreeBSD.org Subject: Re: PAM pacthes we discuss Message-ID: <20020119172326.GA11604@nagual.pp.ru> References: <200201190901.g0J91H641020@freefall.freebsd.org> <20020119171353.GA11472@nagual.pp.ru> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20020119171353.GA11472@nagual.pp.ru> User-Agent: Mutt/1.3.24i Sender: owner-cvs-all@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG On Sat, Jan 19, 2002 at 20:13:55 +0300, Andrey A. Chernov wrote: > On Sat, Jan 19, 2002 at 17:08:55 +0100, Dag-Erling Smorgrav wrote: > > > out and submit them to markm and myself for review, along with a > > Here is the patch, similar /etc/pam.d/* changes are not included, And one for pam_unix, that have no functionality flow changes: Index: pam_unix.c =================================================================== RCS file: /home/ncvs/src/lib/libpam/modules/pam_unix/pam_unix.c,v retrieving revision 1.11 retrieving revision 1.14 diff -u -r1.11 -r1.14 --- pam_unix.c 25 Oct 2001 15:51:50 -0000 1.11 +++ pam_unix.c 19 Jan 2002 09:23:36 -0000 1.14 @@ -25,7 +25,7 @@ */ #include -__FBSDID("$FreeBSD: src/lib/libpam/modules/pam_unix/pam_unix.c,v 1.11 2001/10/25 15:51:50 sobomax Exp $"); +__FBSDID("$FreeBSD: src/lib/libpam/modules/pam_unix/pam_unix.c,v 1.14 2002/01/19 09:23:36 ache Exp $"); #include #include @@ -152,6 +152,8 @@ retval = strcmp(encrypted, pwd->pw_passwd) == 0 ? PAM_SUCCESS : PAM_AUTH_ERR; + if (pwd->pw_expire && time(NULL) >= pwd->pw_expire) + retval = PAM_AUTH_ERR; } else { @@ -502,15 +504,14 @@ syslog(LOG_ERR, "cannot set password cipher"); login_close(lc); /* Salt suitable for anything */ - srandomdev(); gettimeofday(&tv, 0); - to64(&salt[0], random(), 3); + to64(&salt[0], arc4random(), 3); to64(&salt[3], tv.tv_usec, 3); to64(&salt[6], tv.tv_sec, 2); - to64(&salt[8], random(), 5); - to64(&salt[13], random(), 5); - to64(&salt[17], random(), 5); - to64(&salt[22], random(), 5); + to64(&salt[8], arc4random(), 5); + to64(&salt[13], arc4random(), 5); + to64(&salt[17], arc4random(), 5); + to64(&salt[22], arc4random(), 5); salt[27] = '\0'; pwd->pw_passwd = crypt(pass, salt); @@ -596,15 +597,14 @@ syslog(LOG_ERR, "cannot set password cipher"); login_close(lc); /* Salt suitable for anything */ - srandomdev(); gettimeofday(&tv, 0); - to64(&salt[0], random(), 3); + to64(&salt[0], arc4random(), 3); to64(&salt[3], tv.tv_usec, 3); to64(&salt[6], tv.tv_sec, 2); - to64(&salt[8], random(), 5); - to64(&salt[13], random(), 5); - to64(&salt[17], random(), 5); - to64(&salt[22], random(), 5); + to64(&salt[8], arc4random(), 5); + to64(&salt[13], arc4random(), 5); + to64(&salt[17], arc4random(), 5); + to64(&salt[22], arc4random(), 5); salt[27] = '\0'; if (suser_override) -- Andrey A. Chernov http://ache.pp.ru/ To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe cvs-all" in the body of the message