Bug 1421735

Summary:	The access.conf(5) man page needs to be updated
Product:	Red Hat Enterprise Linux 7	Reporter:	Trevor Vaughan <tvaughan>
Component:	pam	Assignee:	Tomas Mraz <tmraz>
Status:	CLOSED ERRATA	QA Contact:	Dalibor Pospíšil <dapospis>
Severity:	low	Docs Contact:
Priority:	low
Version:	7.3	CC:	cww, dapospis, pkis, qe-baseos-security
Target Milestone:	rc	Keywords:	ManPageChange
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	pam-1.1.8-19.el7	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2018-04-10 11:35:33 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1420851, 1473733

Description Trevor Vaughan 2017-02-13 14:51:27 UTC

Description of problem:

The documented usage of access.conf has entries like the following:

+ : root : 192.168.200.1 192.168.200.4 192.168.200.9

This leads users to believe that the spaces around the colons are optional. In reality, these are parsed as part of the listsep option in pam_access.so and may leave your system in a vulnerable state if the spaces are not removed from the entries.

Documentation should be added to the access.conf file that explicitly tells users to remove all spaces around the fieldsep options if listsep is changed from the default.

Version-Release number of selected component (if applicable):

All version of EL 6 and EL 7

How reproducible:

Make the last entry in /etc/security/access.conf the following, then change listsep to 'listsep=,' in /etc/pam.d/password_auth and attempt to login as a user that should not be able to. The user will login successfully until the spaces around the colons are removed.

- : ALL : ALL

Comment 9 errata-xmlrpc 2018-04-10 11:35:33 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:0718