mainOATH Toolkit - Support: sr #109111, fail gracefully for missing users

 
 

sr #109111: fail gracefully for missing users

Submitter:  None
Submitted:  Mon 01 Aug 2016 04:59:34 PM UTC
   
 
Category:  None Priority:  5 - Normal
Severity:  1 - Wish Status:  Done
Privacy:  Public Assigned to:  jas
Originator Email:  -email is unavailable- Open/Closed:  Closed
Operating System:  GNU/Linux
* Mandatory Fields

Add a New Comment Rich Markup
   

Wed 11 Nov 2020 05:10:19 PM UTC, comment #1: 

Thank you for the patch!  It has been applied.

Simon Josefsson <jas>
Group administrator
Mon 01 Aug 2016 04:59:34 PM UTC, original submission:  

fail gracefully for missing users

when the pam module is enabled, it forces all users to immediately
start using OATH, or they can't login at all.

a more progressive approach would seem more reasonable to me,
especially since each user need to get an admin user to update the
central file for them.

this patch adds an early check to the users file and makes sure the
user exists before prompting for a password.

if the user is missing, it exits early with a standard error code
(PAM_USER_UNKNOWN) which can then be ignored in the PAM configuration
(as shown in the README file). this leaves the policy decision up to
the admin (and defaults to "fail closed").

if the user is present, the code path remains the same except the
usersfile is scanned twice, which may be a performance penalty on very
slow filesystems or very large files. the only workaround I can think
of for this would be to load the whole file into memory, but this
could have significant memory impact on large files.

the function used (`oath_authenticate_usersfile`) is a little overkill
as it actually goes and tries to authenticate the user with an empty
password. this is harmless because the file isn't updated if the OTP
is incorrect and because no warning is sent to syslog.

a possible improvement on this would be to have a warning shown to the
user inciting them to configure OATH or to warn them about a possible
typo in their username before they enter their regular passphrase

diffstat:

 pam_oath/README     |  2 +-
 pam_oath/pam_oath.c | 17 +++++++++++++++++
 2 files changed, 18 insertions(+), 1 deletion(-)

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #38288:  0001-fail-gracefully-for-missing-users.patch added by None (3KiB - text/x-patch - slight modification to the pam.d README suggestion)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by jas (Posted a comment)
  • -email is unavailable- added by None (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2020-11-11 jas StatusNone Done
        Assigned toNone jas
        Open/ClosedOpen Closed
    2016-08-20 None Attached File- Added 0001-fail-gracefully-for-missing-users.patch, #38288
    2016-08-01 None Attached File- Added 0001-fail-gracefully-for-missing-users.patch, #38066

    Back to the top

    Powered by Savane 3.13-4448.
    Corresponding source code