Attachment 581954 Details for Bug 818741 – patch disabling MD5 fallback

[patch] patch disabling MD5 fallback

pam-1.1.5-rhbz818741.patch (text/plain), 3.05 KB, created by Paul Wouters on 2012-05-03 20:11:51 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Paul Wouters

Created: 2012-05-03 20:11:51 UTC

Size: 3.05 KB

patch

obsolete

>diff -Naur Linux-PAM-1.1.5-orig/modules/pam_unix/pam_unix.8.xml Linux-PAM-1.1.5/modules/pam_unix/pam_unix.8.xml
>--- Linux-PAM-1.1.5-orig/modules/pam_unix/pam_unix.8.xml	2011-06-21 05:04:56.000000000 -0400
>+++ Linux-PAM-1.1.5/modules/pam_unix/pam_unix.8.xml	2012-05-01 13:02:28.053020766 -0400
>@@ -269,7 +269,7 @@
>             SHA256 algorithm is not known to the <citerefentry>
> 	    <refentrytitle>crypt</refentrytitle><manvolnum>3</manvolnum>
>             </citerefentry> function,
>-            fall back to MD5.
>+            DO NOT fall back to MD5.
>           </para>
>         </listitem>
>       </varlistentry>
>@@ -284,7 +284,7 @@
>             SHA512 algorithm is not known to the <citerefentry>
> 	    <refentrytitle>crypt</refentrytitle><manvolnum>3</manvolnum>
>             </citerefentry> function,
>-            fall back to MD5.
>+            DO NOT fall back to MD5.
>           </para>
>         </listitem>
>       </varlistentry>
>@@ -299,7 +299,7 @@
>             blowfish algorithm is not known to the <citerefentry>
> 	    <refentrytitle>crypt</refentrytitle><manvolnum>3</manvolnum>
>             </citerefentry> function,
>-            fall back to MD5.
>+            DO NOT fall back to MD5.
>           </para>
>         </listitem>
>       </varlistentry>
>diff -Naur Linux-PAM-1.1.5-orig/modules/pam_unix/passverify.c Linux-PAM-1.1.5/modules/pam_unix/passverify.c
>--- Linux-PAM-1.1.5-orig/modules/pam_unix/passverify.c	2012-05-01 12:57:58.667000001 -0400
>+++ Linux-PAM-1.1.5/modules/pam_unix/passverify.c	2012-05-01 13:04:42.491986527 -0400
>@@ -427,15 +427,14 @@
> 	if (!sp || strncmp(algoid, sp, strlen(algoid)) != 0) {
> 		/* libxcrypt/libc doesn't know the algorithm, use MD5 */
> 		pam_syslog(pamh, LOG_ERR,
>-			   "Algo %s not supported by the crypto backend, "
>-			   "falling back to MD5\n",
>+			   "Algo %s not supported by the crypto backend.\n",
> 			   on(UNIX_BLOWFISH_PASS, ctrl) ? "blowfish" :
> 			   on(UNIX_SHA256_PASS, ctrl) ? "sha256" :
> 			   on(UNIX_SHA512_PASS, ctrl) ? "sha512" : algoid);
> 		if(sp) {
> 		   memset(sp, '\0', strlen(sp));
> 		}
>-		return crypt_md5_wrapper(password);
>+		return NULL;
> 	}
> 
> 	return x_strdup(sp);
>diff -Naur Linux-PAM-1.1.5-orig/modules/pam_unix/README Linux-PAM-1.1.5/modules/pam_unix/README
>--- Linux-PAM-1.1.5-orig/modules/pam_unix/README	2011-06-21 05:38:51.000000000 -0400
>+++ Linux-PAM-1.1.5/modules/pam_unix/README	2012-05-01 13:01:17.154990165 -0400
>@@ -118,19 +118,19 @@
> 
>     When a user changes their password next, encrypt it with the SHA256
>     algorithm. If the SHA256 algorithm is not known to the crypt(3) function,
>-    fall back to MD5.
>+    DO NOT fall back to MD5 but fail.
> 
> sha512
> 
>     When a user changes their password next, encrypt it with the SHA512
>     algorithm. If the SHA512 algorithm is not known to the crypt(3) function,
>-    fall back to MD5.
>+    DO NOT fall back to MD5 but fail.
> 
> blowfish
> 
>     When a user changes their password next, encrypt it with the blowfish
>     algorithm. If the blowfish algorithm is not known to the crypt(3) function,
>-    fall back to MD5.
>+    DO NOT fall back to MD5 but fail.
> 
> rounds=n
>

Actions: View | Diff

Attachments on bug 818741: 581954