1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
|
User-Visible pam-krb5 Changes
pam-krb5 2.5 (2006-11-03)
Don't free the results of pam_get_item(PAM_AUTHTOK) when changing
passwords. Thanks, Arne Nordmark.
Be a bit more thorough when checking authorization in
pam_sm_acct_mgmt. Re-retrieve the value of user in case the
application changed it, and if we have a ticket cache (we may not even
after a successful authentication if no_ccache was specified),
retrieve the principal from it rather than using the principal from
the context.
Overwrite passwords with 0 before freeing them, just out of paranoia
(and because PAM also does this internally).
pam-krb5 2.4 (2006-10-05)
Fix compilation problems with Heimdal. Thanks, Matthijs Mohlmann and
Douglas Engert.
Check for memory allocation failures when parsing PAM options rather
than segfaulting.
Fix several places where an uninitialized context could have been
passed into the argument parsing function.
Refactor the code to read configuration from krb5.conf to be easier
to read and understand. Parse renew_lifetime immediately and always
report an error rather than deferring time parsing until acquiring
tickets.
Log errors (not just authentication failures) at the LOG_ERR level
to match (some of) the recommendations of the Linux PAM documentation.
Log an error when an unknown option is passed via the PAM
configuration.
pam-krb5 2.3 (2006-09-03)
Fix the interface between the Kerberos prompting function and the
PAM conversation function on Linux. Prior to this fix, the PAM module
would only work on Solaris if Kerberos passed multiple prompts, which
happens when an account requires a password change. Solaris and Linux
PAM implementations expect a different structure of pam_message
structs in the conversation function; use a workaround to cater to
both of them. Based on a patch by Joachim Keltsch.
Implement retain_after_close, which specifies that the PAM module
should never destroy the user's ticket cache, even on session end.
Adjust for the differences in Solaris's PAM libraries: Include
pam_appl.h everywhere for structure and type definitions, and add
portability workarounds for the return statuses missing from the
Solaris implementation.
pam-krb5 2.2 (2006-08-28)
Allow the default realm to be overridden in the PAM options.
Use the realm, default or otherwise, when reading options from
krb5.conf so that realm-specific sections in [appdefaults] work
correctly.
Update the build and installation documentation for the new
Autoconf-based build system. This should have been in the last
release but was missed.
Initialize ticket options correctly when built with Heimdal.
Fix a typo that caused the Heimdal support not to compile. Thanks,
Matthijs Mohlmann.
pam-krb5 2.1 (2006-08-26)
Strip off a FILE: prefix from the cache path before creating it in
case the user set ccache or ccache_dir with a cache type prefix.
Thanks to Björn Torkelsson for the patch.
Added an Autoconf script to distinguish between Heimdal and MIT
Kerberos and take care of other portability issues. Rewrote the
Makefile accordingly.
Added portability and error reporting fixes for Heimdal, thanks to
Matthijs Mohlmann.
pam-krb5 2.0 (2006-08-11)
Always use a disk cache for temporary storage of credentials between
authentication and setcred or session initialization. This allows the
module to work correctly with OpenSSH ChallengeResponseAuthentication.
Add support for some PAM options that were supported by the
Sourceforge K5 PAM module, most notably minimum_uid and
renew_lifetime.
Support setting many PAM options from krb5.conf as well as on the PAM
command line, using the same application section as the Sourceforge
PAM module. Use the profile reading functions provided by the
Kerberos libraries.
Add support for use_authtok, which is like use_first_pass except that
it will never prompt even if no password is currently set.
Add a search_k5login option to check the user's password against every
principal listed in .k5login, to support use of this module to
authenticate user access to shared accounts.
Add an ignore_k5login option that bypasses all checks of .k5login
files entirely and relies solely on krb5_aname_to_localname checks.
Re-add the ccache option to specify the exact file name of the ticket
cache, and allow for randomization using mkstemp even when this option
is used.
Only call krb5_kuserok (the .k5login check) when the account to which
the user is authenticating is a local account. It's up to the
application to handle authorization checks for non-local accounts.
Support preliminary checks for password changing by using that to
obtain the user's current credentials. Correctly handle saved
passwords from previous authentications or password changes when
changing passwords, and correctly set the saved passwords for
subsequent password changes in the PAM stack.
Only initialize the ticket cache once, no matter how many times
setcred is called. This saves duplicate work and works around a bug
in X.org xdm that otherwise causes it to lose the PAM environment.
When reinitializing a ticket cache, never reinitialize the temporary
cache created by the authentication call. Instead, fall back to the
default ticket cache name if KRB5CCNAME isn't set.
Improve support for no_ccache. Now, it doesn't even generate a
temporary ticket cache during authentication but only uses an
in-memory credential list.
Do user ticket validation using the standard Kerberos library call
rather than rolling our own code. This means that the user can now
set options in krb5.conf to control whether that call should fail if
the local keytab isn't readable or contains no usable keys.
Completely rewrite the man page. Clean it up and make it more
readable and fully document all of the options. Also rewrite the
README file and clean up the rest of the package documentation.
Don't create a ticket cache until after successful authentication.
Understand the FILE: prefix to Kerberos ticket cache names and compare
and chown ticket caches properly with that prefix.
Add a trailing nul to the password in the Kerberos prompter function,
since some code relies on it being there.
Review the return status of each PAM function and ensure that we only
return failure statuses that are supported for that function.
Rename all internal functions with a pamk5_* prefix to avoid
conflicting with any application or system library functions.
Eliminate global variables in the PAM module and do a better job at
cleaning up memory usage. There are still a few places where the PAM
conversation functions may leak memory due to an incomplete
specification in the PAM API on who should free what memory.
The logging messages produced when debug is set should now be more
consistent and more complete.
pam-krb5 1.2 (2005-09-27)
Don't reinitialize the ticket cache if the old and new cache have the
same name, since otherwise we end up destroying it.
Always set KRB5CCNAME, even when reinitializing.
When reinitializing, look for the ticket cache in the saved context
even if KRB5CCNAME isn't set. OpenSSH calls it this way.
Drop the ccache option and add ccache_dir instead, which only
specifies the directory for ticket caches and is therefore easier to
implement.
pam-krb5 1.1 (2005-08-31)
Add support for reinitialization/refreshing of credentials in
pam_sm_setcred.
Set PAM_AUTHTOK and PAM_OLDAUTHTOK when authenticating to better
support stacking this module with others.
Add an ignore_root option to not do anything when the account to which
the user is authenticating is root. This allows one to log in via
console as root even when the network is down (thereby breaking the
PAM module in ways that login doesn't like due to timeouts in the
Kerberos libraries).
Store the entire context structure in PAM's memory rather than just
the name of the ticket cache so that we can pass around more data to
ourself.
Bring errors more in line with the official PAM specification.
Move prompt generation into the PAM module rather than letting the
Kerberos library generate the prompt. This way we don't leak
principal information to the caller, and the non-standard prompt also
broke some applications like gksudo.
Support session management and destruction of the ticket cache on
close of session.
Don't require that the user have a local account on the system.
Include the user UID in the default ticket cache name so that rpc.gssd
and similar programs can find it.
|
