Bug 509092
| Summary: | pam_krb5 update breaks graphical apps (gnome and kde) | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 5 | Reporter: | Olivier Fourdan <ofourdan> | ||||||||||
| Component: | pam_krb5 | Assignee: | Nalin Dahyabhai <nalin> | ||||||||||
| Status: | CLOSED ERRATA | QA Contact: | BaseOS QE Security Team <qe-baseos-security> | ||||||||||
| Severity: | medium | Docs Contact: | |||||||||||
| Priority: | medium | ||||||||||||
| Version: | 5.3 | CC: | cward, kem, maarten, rlerch, syeghiay, tao | ||||||||||
| Target Milestone: | rc | Keywords: | Patch, Regression | ||||||||||
| Target Release: | --- | ||||||||||||
| Hardware: | All | ||||||||||||
| OS: | Linux | ||||||||||||
| Whiteboard: | |||||||||||||
| Fixed In Version: | pam_krb5-2.2.14-15 | Doc Type: | Bug Fix | ||||||||||
| Doc Text: |
Certain applications which do not properly implement PAM conversations may fail to authenticate users whose passwords have expired and must be changed, or may succeed without forcing the user's password to be changed. This bug is triggered by a previously-applied fix to pam_krb5 which makes it comply more closely to PAM specifications. If an application misbehaves, enabling the "chpw_prompt" option for its service should restore the old behavior.
|
Story Points: | --- | ||||||||||
| Clone Of: | Environment: | ||||||||||||
| Last Closed: | 2010-03-30 08:33:16 UTC | Type: | --- | ||||||||||
| Regression: | --- | Mount Type: | --- | ||||||||||
| Documentation: | --- | CRM: | |||||||||||
| Verified Versions: | Category: | --- | |||||||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||||||
| Embargoed: | |||||||||||||
| Bug Depends On: | |||||||||||||
| Bug Blocks: | 541103 | ||||||||||||
| Attachments: |
|
||||||||||||
|
Description
Olivier Fourdan
2009-07-01 10:21:08 UTC
Makes perfect sense, and the patch looks good. We can add some additional machinery to the configure script to let the default set of services for which this is enabled be set at build-time and have the .spec file use that. If we have the exact list, that'll be very helpful in building a package with the fix. Created attachment 350263 [details]
Proposed patch (updated)
Ok, actually, to be able to pass a list of services in krb5.conf, the logic of the parsing needs to be changed slightly to actually parse the list if the option is not set explicitly.
So this new patch add this logic, parse the list of services passed to the option "chpw_prompt" (the additional code is actually similar to the other options that accept a list of services, e.g. "tokens", "use_shmem", "external", "validate", etc.).
So please consider this patch in place of the original one.
With that patch, the following option added in krb5.conf in section [appdefaults] pam {...} make kdm, gdm, kscreensaver, kdesktop-lock and gnome-screensaver behave correctly when the kerberos password as expired:
chpw_prompt = kcheckpass kscreensaver gdm gnome-screensaver
E.g:
[appdefaults]
pam = {
debug = false
ticket_lifetime = 36000
renew_lifetime = 36000
forwardable = true
krb4_convert = false
chpw_prompt = kcheckpass kscreensaver gdm gnome-screensaver
}
Event posted on 07-31-2009 05:48am EDT by spoyarek vlock seems to be affected by this as well. Fixed with the patch. This event sent from IssueTracker by spoyarek issue 312727 Created attachment 359512 [details]
Proposed patch (updated)
To allow chaining PAM modules, PAM_AUTHTOK needs to be updated if the password is changed.
Attaching a new patch that additionally updates PAM_AUTHTOK and PAM_OLDAUTHTOK for other PAM module to work when the password was changed.
This patch is based on our customer's own patch.
Created attachment 361721 [details]
proposed patch
Tweaks Olivier's patch to only set PAM_AUTHTOK (PAM_OLDAUTHTOK is only used when PAM's doing password-changing, so we don't need to bother with it) and to expand on the documentation.
Technical note added. If any revisions are required, please edit the "Technical Notes" field accordingly. All revisions will be proofread by the Engineering Content Services team. New Contents: Certain applications which do not properly implement PAM conversations may fail to authenticate users whose passwords have expired and must be changed, or may succeed without forcing the user's password to be changed. This bug is triggered by a previously-applied fix to pam_krb5 which makes it comply more closely to PAM specifications. If an application misbehaves, enabling the "chpw_prompt" option for its service should restore the old behavior. An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on therefore solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHSA-2010-0258.html |