emo/shadow
1
0
Fork 0
Code Issues Pull Requests Packages Releases Activity

* NEWS, src/login.c: Also check if the authentication token of the

Browse Source 
user has to be updated in case the user was already authenticated.
This commit is contained in:
nekral-guest 2009-04-19 16:22:17 +00:00
parent ca10b825c7
commit 131e95ffaf
3 changed files with 14 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
ChangeLog
View File

@ -1,3 +1,8 @@
2009-04-19 Nicolas François <nicolas.francois@centraliens.net>
* NEWS, src/login.c: Also check if the authentication token of the
user has to be updated in case the user was already authenticated.
2009-04-19 Nicolas François <nicolas.francois@centraliens.net> 2009-04-19 Nicolas François <nicolas.francois@centraliens.net>
* src/login.c: fflg is already restricted to root. Move * src/login.c: fflg is already restricted to root. Move

2
NEWS
View File

@ -5,6 +5,8 @@ shadow-4.1.3.1 -> shadow-4.1.3.2 UNRELEASED
- login - login
* Do not trust the current utmp entry's ut_line to set PAM_TTY. This could * Do not trust the current utmp entry's ut_line to set PAM_TTY. This could
lead to DOS attacks. lead to DOS attacks.
* (PAM) Even if the user was already authenticated (-f flag), ask the
user to update his authentication token if needed.
shadow-4.1.3 -> shadow-4.1.3.1 2009-04-15 shadow-4.1.3 -> shadow-4.1.3.1 2009-04-15

17
src/login.c
View File

@ -811,18 +811,15 @@ int main (int argc, char **argv)
/* We don't get here unless they were authenticated above */ /* We don't get here unless they were authenticated above */
alarm (0); alarm (0);
retcode = pam_acct_mgmt (pamh, 0);
if (retcode == PAM_NEW_AUTHTOK_REQD) {
retcode = pam_chauthtok (pamh, PAM_CHANGE_EXPIRED_AUTHTOK);
}
PAM_FAIL_CHECK;
} else (fflg) {
retcode = pam_acct_mgmt (pamh, 0);
PAM_FAIL_CHECK;
} }
/* Check the account validity */
retcode = pam_acct_mgmt (pamh, 0);
if (retcode == PAM_NEW_AUTHTOK_REQD) {
retcode = pam_chauthtok (pamh, PAM_CHANGE_EXPIRED_AUTHTOK);
}
PAM_FAIL_CHECK;
/* Grab the user information out of the password file for future usage /* Grab the user information out of the password file for future usage
First get the username that we are actually using, though. First get the username that we are actually using, though.
*/ */