Date: Tue, 25 Apr 2023 20:01:57 +0200 From: Jesper Schmitz Mouridsen <jsm@FreeBSD.org> To: freebsd-hackers@freebsd.org Subject: Re: Interacting with PAM issues Message-ID: <af464f16-6b45-3955-cc90-55a31d8c9c89@FreeBSD.org> In-Reply-To: <f7b6294b-fc57-f808-a7df-8182447457d4@yahoo.com> References: <f7b6294b-fc57-f808-a7df-8182447457d4.ref@yahoo.com> <f7b6294b-fc57-f808-a7df-8182447457d4@yahoo.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On 25.04.2023 19.26, Mikhail Zakharov wrote:
> Hi,
>
> I'm trying to write a custom PAM conversation function and perform
> authentication (re-check password) for my already logged in user. Below
> is the function:
>
> int pam_conv(int n, const struct pam_message **msg, struct pam_response
> **resp, void *data) {
>
> struct pam_response *pr;
> int i;
>
>
> if (n <= 0 || n > PAM_MAX_NUM_MSG) return PAM_CONV_ERR;
> if ((pr = calloc(n, sizeof(*pr))) == NULL) return PAM_BUF_ERR;
>
> for (i = 0; i < n; i++) {
> pr[i].resp = NULL;
> pr[i].resp_retcode = 0;
> switch (msg[i]->msg_style) {
> case PAM_PROMPT_ECHO_OFF:
> case PAM_PROMPT_ECHO_ON:
> pr[i].resp = strdup(passwd);
> break;
> case PAM_ERROR_MSG: /* Do we need this? */
> case PAM_TEXT_INFO:
> fprintf(stderr, "\n\r%s\n", msg[i]->msg);
> break;
> default:
> /* Clear possible passwords in responces; then free
> memory */
> for (i = 0; i < n; i++)
> if (pr[i].resp) {
> memset(pr[i].resp, 0, strlen(pr[i].resp));
> free(pr[i].resp);
> }
> free(pr);
> *resp = NULL;
> return PAM_CONV_ERR;
> }
> }
> *resp = pr;
> return PAM_SUCCESS;
> }
>
> And that's how I call it:
>
> int pam_auth(char *user) {
> static pam_handle_t *pamh;
> static struct pam_conv pamc;
> int rval;
> char *tty_name;
>
>
> pamc.conv = &pam_conv;
> /* Pretend we want login service */
> rval = pam_start("login", user, &pamc, &pamh);
> tty_name = ttyname(STDIN_FILENO);
> if (rval == PAM_SUCCESS) rval = pam_set_item(pamh, PAM_TTY, tty_name);
> if (rval == PAM_SUCCESS) rval = pam_authenticate(pamh, 0);
> if (pam_end(pamh, rval) != PAM_SUCCESS) pamh = NULL;
>
> return rval == PAM_SUCCESS ? 0 : 1;
> }
>
> Well, PAM login, allows to login as the same user without checking a
> password:
>
> # auth
> auth sufficient pam_self.so no_warn
> auth include system
>
> When trying other services e.g. "system", "ssh", "other"
> pam_authenticate() return Authentication error, PAM error 9.
>
> What do I do wrong? Surprisingly, I do not see the same issue on Mac and
> Centos.
>
> Best, Mikhail Zakharov
>
>
Hi
Do you run it as root?
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?af464f16-6b45-3955-cc90-55a31d8c9c89>