Commit Graph

342 Commits

Author SHA1 Message Date
des
95277118f4 Increase WARNS. 2005-09-26 20:34:09 +00:00
des
343777dab2 Correct the logic for determining whether the user has already entered
a password.  Also, work around some harmless type pun warnings.

MFC after:	3 days
2005-09-26 20:33:53 +00:00
des
01dcf64138 Do not use passphraseless keys for authentication unless the nullok
option was specified.

PR:		bin/81231
Submitted by:	"Daniel O'Connor" <doconnor@gsoft.com.au>
MFC after:	3 days
2005-09-22 05:35:24 +00:00
des
4ee54de329 Narrow the use of user credentials.
Fix one case where openpam_restore_cred() might be called twice in a row.

MFC after:	3 days
2005-09-21 16:08:40 +00:00
cperciva
a257862d4b When (re)allocating space for an array of pointers to char, use
sizeof(*list), not sizeof(**list).  (i.e., sizeof(pointer) rather than
sizeof(char)).

It is possible that this buffer overflow is exploitable, but it was
added after RELENG_5 forked and hasn't been MFCed, so this will not
receive an advisory.

Submitted by:	Vitezslav Novy
MFC after:	1 day
2005-09-19 18:43:11 +00:00
kensmith
174219188d Missed one piece of the cluster's quirk. Need to override WARNS because
if _FREEFALL_CONFIG is set gcc bails since pam_sm_setcred() in pam_krb5.c
no longer uses any of its parameters.

Pointy hat:	kensmith
Approved by:	re (scottl)
2005-07-08 14:53:45 +00:00
kensmith
28b7f562fc This is sort of an MFS. Peter made these changes to the RELENG_*
branches but missed HEAD.  This patch extends his a little bit,
setting it up via the Makefiles so that adding _FREEFALL_CONFIG
to /etc/make.conf is the only thing needed to cluster-ize things
(current setup also requires overriding CFLAGS).

From Peter's commit to the RELENG_* branches:
> Add the freebsd.org custer's source modifications under #ifdefs to aid
> keeping things in sync.  For ksu:
> * install suid-root by default
> * don't fall back to asking for a unix password (ie: be pure kerberos)
> * allow custom user instances for things like www and not just root

The Makefile tweaks will be MFC-ed, the rest is already done.

MFC after:      3 days
Approved by:    re (dwhite)
2005-07-07 14:16:38 +00:00
des
09a62d7510 Use the correct login class when setting a new password.
PR:		65557, 72949
Submitted by:	Stephen P. Cravey <clists@gotbrains.org>
Approved by:	re (scottl)
MFC after:	2 weeks
2005-07-05 18:42:18 +00:00
ru
38fc91ca96 Assorted markup fixes.
Approved by:	re
2005-06-15 19:04:04 +00:00
des
2b425cf5e2 Don't use a cast as an lvalue.
Add a redundant test to make it painfully obvious to the reader that this
code does not support IPv6.

Approved by:	re (dwhite)
MFC after:	1 week
2005-06-13 21:18:52 +00:00
des
060c66b4a3 Use appropriate error codes for each facility instead of just PAM_AUTH_ERR.
Noticed by:	pjd
2005-06-10 06:16:13 +00:00
des
d78c118916 Revert the commits that made libssh an INTERNALLIB; they caused too much
trouble, especially on amd64.

Requested by:	ru
2005-06-07 09:31:28 +00:00
des
741e51c695 Fix libssh dependency. 2005-06-06 19:01:01 +00:00
ume
a3047efe51 NI_WITHSCOPEID cleanup
Reviewed by:	des
2005-05-13 20:51:09 +00:00
ru
1541af42f1 Expand *n't contractions. 2005-02-13 22:25:33 +00:00
des
b0d098fb3c In addition to the PAM environment, export a handful of useful PAM items.
Suggested by:	Ed Maste <emaste@phaedrus.sandvine.ca>
2005-02-01 10:37:07 +00:00
rwatson
3441ac65f8 When "no_ccache" is set as an argument to the pam_krb5 module, don't
copy the acquired TGT from the in-memory cache to the on-disk cache
at login.  This was documented but un-implemented behavior.

MFC after:		1 week
PR:			bin/64464
Reported and tested by:	Eric van Gyzen <vangyzen at stat dot duke dot edu>
2005-01-24 16:49:50 +00:00
rwatson
8cc1e1c0d7 The final argument to verify_krb_v5_tgt() is the debug flag, not the
ticket forwardable flag, so key generation of debugging output to
"debug" rather than "forwardable".

Update copyright.

MFC after:	3 days
2005-01-23 15:57:07 +00:00
ru
3666aefb6a Fixed xref. 2005-01-21 10:48:35 +00:00
ru
f4c44b761b NOCRYPT -> NO_CRYPT 2004-12-21 10:16:04 +00:00
ru
e1caf1330c NOINSTALLLIB -> NO_INSTALLLIB 2004-12-21 09:51:09 +00:00
ru
74176cc161 NODOCCOMPRESS -> NO_DOCCOMPRESS
NOINFO -> NO_INFO
NOINFOCOMPRESS -> NO_INFOCOMPRESS
NOLINT -> NO_LINT
NOPIC -> NO_PIC
NOPROFILE -> NO_PROFILE
2004-12-21 09:33:47 +00:00
bz
4b83c5852a Add knob NO_NIS (fka NO_YP_LIBC) and make world compileable when set.
If turned on  no NIS support and related programs will be built.

Lost parts rediscovered by:	Danny Braniss <danny at cs.huji.ac.il>
PR:		bin/68303
No objections:	des, gshapiro, nectar
Reviewed by:	ru
Approved by:	rwatson (mentor)
MFC after:	2 weeks
2004-11-13 20:40:32 +00:00
ru
5db2b9d5b3 For variables that are only checked with defined(), don't provide
any fake value.
2004-10-24 15:33:08 +00:00
cperciva
e629b37603 Join the 21st century: Cryptography is no longer an optional component
of releases.  The -DNOCRYPT build option still exists for anyone who
really wants to build non-cryptographic binaries, but the "crypto"
release distribution is now part of "base", and anyone installing from a
release will get cryptographic binaries.

Approved by:	re (scottl), markm
Discussed on:	freebsd-current, in late April 2004
2004-08-06 07:27:08 +00:00
kan
425239bf6e Downgrade WARNS level for GCC 3.4.2. 2004-07-28 05:49:15 +00:00
ru
b5e1c67f19 Markup nits. 2004-07-05 06:39:03 +00:00
ru
6651f20e0d Sort SEE ALSO references (in dictionary order, ignoring case). 2004-07-04 20:55:50 +00:00
ru
01548ace15 Mechanically kill hard sentence breaks. 2004-07-02 23:52:20 +00:00
ru
5d2b66a3c7 Deal with unsafe tab characters. 2004-07-02 19:55:26 +00:00
ru
615a6a246a Markup, grammar, punctuation. 2004-07-01 18:20:57 +00:00
kan
211c1eafc9 Revert the last change. There are more 64bit platforms than amd64, and
they break due to diferent alignment restrictions.
2004-06-25 12:32:45 +00:00
kan
e14478e091 Remove the use of cast as lvalue. 2004-06-25 01:54:26 +00:00
markm
0b0ae8e16e Make NULL a (void*)0 whereever possible, and fix the warnings(-Werror)
that this provokes. "Wherever possible" means "In the kernel OR NOT
C++" (implying C).

There are places where (void *) pointers are not valid, such as for
function pointers, but in the special case of (void *)0, agreement
settles on it being OK.

Most of the fixes were NULL where an integer zero was needed; many
of the fixes were NULL where ascii <nul> ('\0') was needed, and a
few were just "other".

Tested on: i386 sparc64
2004-03-05 08:10:19 +00:00
cperciva
81f9b2b83a style cleanup: Remove duplicate $FreeBSD$ tags.
These files had tags after the copyright notice,
inside the comment block (incorrect, removed),
and outside the comment block (correct).

Approved by:	rwatson (mentor)
2004-02-10 20:42:33 +00:00
des
18879fb0df Fix numerous constness and aliasing issues. 2004-02-10 10:13:21 +00:00
ru
70146d9d56 Put libraries in the link order.
Reported by:	lorder(1) (modified to work with libraries)
2004-02-04 10:23:09 +00:00
ru
78280d4ce2 This module doesn't use libgssapi (and it looks never did). 2004-02-04 09:41:47 +00:00
des
2549da444c Implement pam_sm_close_session().
PR:		bin/61657
Submitted by:	Joe R. Doupnik <jrd@cc.usu.edu>
2004-01-26 19:28:37 +00:00
ru
24ae6823ef Deal better with the crypto version of the PAM library that goes
on the release media -- only put what is different in the crypto
version compared to the base version.  This reduces PAM entries
in /usr/lib in the "crypto" distribution to:

	libpam.a
	libpam.so@
	libpam.so.2
	pam_krb5.so@
	pam_krb5.so.2
	pam_ksu.so@
	pam_ksu.so.2
	pam_ssh.so@
	pam_ssh.so.2

The libpam.so* is still redundant (it is identical to the "base"
version), but we can't set DISTRIBUTION differently for libpam.a
and libpam.so.

(The removal of libpam.so* from the crypto distribution could be
addressed by the release/scripts/crypto-make.sh script, but then
we'd also need to remove redundant PAM headers, and I'm not sure
this is worth a hassle.)
2004-01-18 14:58:07 +00:00
schweikh
6cbe68d985 Remove crossref to pam.conf(5) which never existed. 2004-01-17 09:46:49 +00:00
des
3812c7acf5 Fix a strict aliasing issue. Also remove an unnecessary pam_get_item()
call (pam_get_authtok() will return the previous token if try_first_pass
or use_first_pass is specified).  Incidentally fix an ugly bug where the
buffer holding the prompt was freed immediately before use, instead of
after.
2003-12-11 15:51:03 +00:00
des
e64a27f5c0 More strict aliasing fixes.
Submitted by:	Andreas Hauser <andy-freebsd@splashground.de>
2003-12-11 15:48:09 +00:00
des
9c38a55797 Fix strict aliasing breakage in PAM modules (except pam_krb5, which needs
more work than the others).  This should make most modules build with -O2.
2003-12-11 13:55:16 +00:00
sobomax
7c6af783e5 Fix on sparc64.
Reported by:	rwatson/tinderbox
MFC after:	2 weeks
2003-11-12 23:36:17 +00:00
sobomax
c33bd8de41 Add a new configuration variable - nas_ipaddr, which if set allows to
set NAS-IP-Address attribute in requests generated by the pam_radius
module. This attribute is mandatory for some Radius servers out there.

Reviewed by:	des
MFC after:	2 weeks
2003-11-12 17:47:23 +00:00
kensmith
c204cb0df7 - fix to UID test description, non-zero -> zero
PR:		docs/57799
Reviewed by:	des
Approved by:	blackend (mentor)
2003-10-17 17:03:38 +00:00
des
b9a4363200 Ignore ECHILD from waitpid(2) (our child may have been reaped by the
calling process's SIGCHLD handler)

PR:		bin/45669
2003-09-19 11:33:03 +00:00
des
2da157461a Revert previous commit after fixing libpam. 2003-07-21 19:56:28 +00:00
des
86393d5322 Add a __DECONST() to unbreak the build. 2003-07-15 14:36:36 +00:00