Bug 1092706 - Enabled PAM support
Summary: Enabled PAM support
Alias: None
Product: Fedora
Classification: Fedora
Component: ngircd
Version: rawhide
Hardware: Unspecified
OS: Unspecified
Target Milestone: ---
Assignee: Andreas Thienemann
QA Contact: Fedora Extras Quality Assurance
Depends On:
TreeView+ depends on / blocked
Reported: 2014-04-29 18:49 UTC by Sijis Aviles
Modified: 2014-10-11 18:02 UTC (History)
3 users (show)

Fixed In Version: ngircd-21.1-5.el6
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2014-10-11 18:02:54 UTC
Type: Bug

Attachments (Terms of Use)

Description Sijis Aviles 2014-04-29 18:49:30 UTC
Description of problem:

In looking at the configuration file, there appears to be PAM support, however it needs to be compiled. In discussing with Kevin its currently not compiled with those options.

Actual results:
Feature does not work

Comment 1 Fedora Update System 2014-04-29 20:09:10 UTC
ngircd-21.1-2.fc20 has been submitted as an update for Fedora 20.

Comment 2 Fedora Update System 2014-04-29 20:09:38 UTC
ngircd-21.1-2.fc19 has been submitted as an update for Fedora 19.

Comment 3 Fedora Update System 2014-04-29 20:10:05 UTC
ngircd-21.1-2.el6 has been submitted as an update for Fedora EPEL 6.

Comment 4 Fedora Update System 2014-04-30 20:46:42 UTC
Package ngircd-21.1-2.el6:
* should fix your issue,
* was pushed to the Fedora EPEL 6 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=epel-testing ngircd-21.1-2.el6'
as soon as you are able to.
Please go to the following url:
then log in and leave karma (feedback).

Comment 5 Orion Poplawski 2014-04-30 21:43:09 UTC
Breaks my existing ngircd config.  Not sure why yet.

Comment 6 Orion Poplawski 2014-04-30 21:54:10 UTC
So, it appears that the added PAM support is on by default and requires all users to authenticate with it.  I was also completely unable to de-activate PAM with:

        PAM = no
        PAMIsOptional = yes

So I was completely unable to make this version work for me.

Comment 7 Orion Poplawski 2014-04-30 21:55:52 UTC
I should state that this is on EL6.

Comment 8 Kevin Fenzi 2014-04-30 22:44:06 UTC
Odd. :( 

My reading of the docs was that it was disabled by default... sorry about that. 

Would you be willing to file upstream on this? 
Or would you prefer I do so?

Comment 9 Orion Poplawski 2014-04-30 22:54:39 UTC
Well, if you already have an ngircd bugzilla account, I'd prefer if you would.  Happy to help test things out though.

Comment 11 Kevin Fenzi 2014-05-01 00:39:07 UTC
From upstream:

"How does your ngircd.conf look like?
"ngircd --configtest" validates the configuration without errors?

"PAM=no" in an "[options]" section should disable PAM altogether … and at least
it seems to work for me.

Comment 12 Orion Poplawski 2014-05-01 02:40:25 UTC
Apparently I have let my ngircd.conf file stagnate while ngircd has moved on (understandable on EL I believe) as I didn't even have an [Options] section.  In fact the Fedora package's provided /etc/ngircd.conf file doesn't have it either, seems like it has stagnated as well.

Moving PAM=no there works for me.  However, I don't think that fixes the EPEL (and other) update issue - anyone without PAM=no in ngircd.conf file (which I think is likely everyone) will have their behavior change dramatically.

Comment 13 Kevin Fenzi 2014-05-01 16:53:15 UTC
Yeah, we can (and should) update the config file we ship by default from the template, however the file is config/noreplace, so I agree we definitely don't want to push this to stable releases. ;( 

Should we just push this in rawhide and add a release note for f21 for folks to sync their config then? Or should we just drop the idea entirely?

Comment 14 Sijis Aviles 2014-05-01 19:47:36 UTC
Oh no! Could we ask to have it disabled by default upstream and only explicitly enable it if PAM=yes? Is that even a valid request to do?

I was doing a new install and i happen to use the upstream example, so i never noticed the problem mentioned.

Comment 15 Kevin Fenzi 2014-05-02 15:04:58 UTC
I've reopened the upstream bug to ask if there could be a way to default to no when pam is build in and there's no PAM= directive. Will see what they say. 

I've also unpushed all these updates (but not yet reverted anything in git).

Comment 16 Kevin Fenzi 2014-05-17 18:14:42 UTC
ok, I've come up with a new plan thanks to upstream. ;) 

We enable pam. 
We ship a /etc/pam.d/ngircd that calls pam_permit.so

That way folks that want to use pam, can simply change the /etc/pam.d/ngircd, and everyone else can ignore it. 

Can you test these scratch builds:

rawhide: http://koji.fedoraproject.org/koji/taskinfo?taskID=6859668
el6: http://koji.fedoraproject.org/koji/taskinfo?taskID=6859696

Comment 17 Orion Poplawski 2014-08-11 16:43:30 UTC
I'm afraid I didn't test before the builds were cleaned up, but it seems reasonable.

Comment 18 Kevin Fenzi 2014-08-11 20:25:35 UTC
ok. I have pushed this fix to f22/f21. 

Was el6 also wanted?


Comment 19 Sijis Aviles 2014-09-17 19:14:07 UTC
whoah! I've totally forgot about this.

it would think putting it on el6 would be a good idea. I can't see a negative in doing it.

Comment 20 Fedora Update System 2014-09-24 19:49:52 UTC
ngircd-21.1-5.el6 has been submitted as an update for Fedora EPEL 6.

Comment 21 Fedora Update System 2014-10-11 18:02:54 UTC
ngircd-21.1-5.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.