Red Hat Bugzilla – Bug 1421735
The access.conf(5) man page needs to be updated
Last modified: 2018-04-10 07:36:09 EDT
Description of problem: The documented usage of access.conf has entries like the following: + : root : 192.168.200.1 192.168.200.4 192.168.200.9 This leads users to believe that the spaces around the colons are optional. In reality, these are parsed as part of the listsep option in pam_access.so and may leave your system in a vulnerable state if the spaces are not removed from the entries. Documentation should be added to the access.conf file that explicitly tells users to remove all spaces around the fieldsep options if listsep is changed from the default. Version-Release number of selected component (if applicable): All version of EL 6 and EL 7 How reproducible: Make the last entry in /etc/security/access.conf the following, then change listsep to 'listsep=,' in /etc/pam.d/password_auth and attempt to login as a user that should not be able to. The user will login successfully until the spaces around the colons are removed. - : ALL : ALL
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2018:0718