Bug 1421735 - The access.conf(5) man page needs to be updated
Summary: The access.conf(5) man page needs to be updated
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: pam
Version: 7.3
Hardware: All
OS: Linux
low
low
Target Milestone: rc
: ---
Assignee: Tomas Mraz
QA Contact: Dalibor Pospíšil
URL:
Whiteboard:
Keywords: ManPageChange
Depends On:
Blocks: 1420851 1473733
TreeView+ depends on / blocked
 
Reported: 2017-02-13 14:51 UTC by Trevor Vaughan
Modified: 2018-04-10 11:36 UTC (History)
4 users (show)

(edit)
Clone Of:
(edit)
Last Closed: 2018-04-10 11:35:33 UTC


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2018:0718 None None None 2018-04-10 11:36 UTC

Description Trevor Vaughan 2017-02-13 14:51:27 UTC
Description of problem:

The documented usage of access.conf has entries like the following:

+ : root : 192.168.200.1 192.168.200.4 192.168.200.9

This leads users to believe that the spaces around the colons are optional. In reality, these are parsed as part of the listsep option in pam_access.so and may leave your system in a vulnerable state if the spaces are not removed from the entries.

Documentation should be added to the access.conf file that explicitly tells users to remove all spaces around the fieldsep options if listsep is changed from the default.

Version-Release number of selected component (if applicable):

All version of EL 6 and EL 7

How reproducible:

Make the last entry in /etc/security/access.conf the following, then change listsep to 'listsep=,' in /etc/pam.d/password_auth and attempt to login as a user that should not be able to. The user will login successfully until the spaces around the colons are removed.

- : ALL : ALL

Comment 9 errata-xmlrpc 2018-04-10 11:35:33 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:0718


Note You need to log in before you can comment on or make changes to this bug.