From owner-freebsd-bugs@FreeBSD.ORG Wed Nov 30 19:20:22 2005 Return-Path: X-Original-To: freebsd-bugs@hub.freebsd.org Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 1442316A435 for ; Wed, 30 Nov 2005 19:20:21 +0000 (GMT) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by mx1.FreeBSD.org (Postfix) with ESMTP id 028A943D92 for ; Wed, 30 Nov 2005 19:20:04 +0000 (GMT) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.13.3/8.13.3) with ESMTP id jAUJK208045016 for ; Wed, 30 Nov 2005 19:20:02 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.13.3/8.13.1/Submit) id jAUJK2cQ045015; Wed, 30 Nov 2005 19:20:02 GMT (envelope-from gnats) Resent-Date: Wed, 30 Nov 2005 19:20:02 GMT Resent-Message-Id: <200511301920.jAUJK2cQ045015@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Toby Karyadi Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 5499E16A41F for ; Wed, 30 Nov 2005 19:15:31 +0000 (GMT) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (www.freebsd.org [216.136.204.117]) by mx1.FreeBSD.org (Postfix) with ESMTP id 0182343D5C for ; Wed, 30 Nov 2005 19:15:31 +0000 (GMT) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (localhost [127.0.0.1]) by www.freebsd.org (8.13.1/8.13.1) with ESMTP id jAUJFUgt081688 for ; Wed, 30 Nov 2005 19:15:30 GMT (envelope-from nobody@www.freebsd.org) Received: (from nobody@localhost) by www.freebsd.org (8.13.1/8.13.1/Submit) id jAUJFUw2081687; Wed, 30 Nov 2005 19:15:30 GMT (envelope-from nobody) Message-Id: <200511301915.jAUJFUw2081687@www.freebsd.org> Date: Wed, 30 Nov 2005 19:15:30 GMT From: Toby Karyadi To: freebsd-gnats-submit@FreeBSD.org X-Send-Pr-Version: www-2.3 Cc: Subject: bin/89770: pam_krb5 'authentication token failure' in passwd and a patch for it X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 30 Nov 2005 19:20:22 -0000 >Number: 89770 >Category: bin >Synopsis: pam_krb5 'authentication token failure' in passwd and a patch for it >Confidential: no >Severity: non-critical >Priority: medium >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Wed Nov 30 19:20:02 GMT 2005 >Closed-Date: >Last-Modified: >Originator: Toby Karyadi >Release: 6.0-RELEASE >Organization: >Environment: FreeBSD myhost 6.0-RELEASE FreeBSD 6.0-RELEASE #0: Thu Nov 3 09:36:13 UTC 2005 root@x64.samsco.home:/usr/obj/usr/src/sys/GENERIC i386 >Description: /usr/bin/passwd spits out the following error message: myhost% passwd Changing local password for moi Old password: passwd: pam_chauthtok(): authentication token failure This only happens when the pam configuration is specified to use pam_krb5.so, for example like in the following /etc/pam.d/passwd file: # # PAM configuration for the "passwd" service # # passwd(1) does not use the auth, account or session services. # password password required pam_unix.so no_warn try_first_pass password required pam_krb5.so try_first_pass >How-To-Repeat: Please read problem description for repro steps. Note, I assume that kerberos, (Heimdal, to be specific) has been setup properly, i.e. all of the k* tools works right and that kdc, kadmindd, kpasswdd all are up and running. >Fix: The problem is because the function pam_sm_chauthtok() in src/lib/libpam/modules/pam_krb5/pam_krb5.c does not handle the case where the PAM_PRELIM_CHECK is set. In comparison, pam_unix.c handles it by asking for the old password and return PAM_SUCCESS only if the old password is correct. The fix is simply to return PAM_SUCCESS when the PAM_PRELIM_CHECK is set above the code that checks if the PAM_UPDATE_AUTHTOK is set. Also look at src/contrib/openpam/lib/pam_chauthtok.c to see the calling sequence into pam_sm_chauthtok() of the pam modules. Below is the patch. For those who're not familier with patching (otherwise skip this section): 1. Copy the text from --- until the end of this message into a file, call it pam_krb5.c.patch 2. Put the file in /usr/src/lib/libpam/modules/pam_krb5/ and cd into that dir. 3. yourhost% patch < pam_krb5.c.patch 4. make clean 5. make 6. make install Enjoy, Toby --- pam_krb5.c.orig Thu Jul 7 14:16:38 2005 +++ pam_krb5.c Tue Nov 29 16:12:41 2005 @@ -666,6 +666,9 @@ const void *user; char *princ_name, *passdup; + if (flags & PAM_PRELIM_CHECK) + return PAM_SUCCESS; + if (!(flags & PAM_UPDATE_AUTHTOK)) return (PAM_AUTHTOK_ERR); >Release-Note: >Audit-Trail: >Unformatted: