Bug 437179

Description of problem:
On RHEL 4.6, the default auth section for /etc/pam.d/system-auth looks like this:
 
------------------------------------------
auth        required      /lib/security/$ISA/pam_env.so
auth        sufficient    /lib/security/$ISA/pam_unix.so likeauth nullok
auth        required      /lib/security/$ISA/pam_deny.so
------------------------------------------
 
We wanted to put pam_krb5.so before pam_unix.so so that if a user's Kerberos
password is the same as their Unix password, they'll still get their Kerberos
credentials.  So we inserted pam_krb5.so before pam_unix.so and added
"use_first_pass" (or "try_first_pass") on the pam_unix.so line, so that it would
get the stored password from the preceding module:
 
------------------------------------------
auth        required      /lib/security/$ISA/pam_env.so
auth        sufficient    /lib/security/$ISA/pam_krb5.so
auth        sufficient    /lib/security/$ISA/pam_unix.so use_first_pass likeauth
nullok
auth        required      /lib/security/$ISA/pam_deny.so
------------------------------------------
 
This works, but it has one flaw: when SSH'ing to this server, on the first
prompt the user can enter either their Kerberos password or their Unix password
to authenticate, just as expected.  However, if they enter an incorrect password
the first time, on subsequent attempts they can ONLY authenticate using their
Kerberos password...even if they enter the correct Unix password it will be
rejected.
 
I believe the problem here is that pam_krb5.so is storing the password the first
time it's called but is NOT changing it on subsequent calls--and therefore, the
pam_unix.so module is seeing the initial incorrect password every time through.
 
I've tested this same configuration change on a server running RHEL5, and it
works perfectly there.  Also, FYI, this is the only change we've made to the PAM
configuration, and the SSH configuration is unchanged from a stock RHEL4
install.  So if my guess is right, it would appear that this is a bug in the
pam_krb5.so that's distributed with RHEL 4.6 (namely pam_krb5-2.1.17-1).


Version-Release number of selected component (if applicable):
pam_krb5-2.1.17-1

How reproducible:
(see above)

Steps to Reproduce:
1. Configure /etc/pam.d/system-auth as per the above description
2. Sign in via SSH
3. Specify an incorrect password the first time you're prompted for it
4. Specify the correct password the second time you're prompted for it; it will
be rejected by PAM
  
Actual results:
A correct password is rejected after an incorrect password has been entered

Expected results:
A correct password should allow the user to sign in regardless of any preceding
errors (as it does on RHEL5).

Additional info:
See Redhat service request 1806540 for further information on this issue.