mainOATH Toolkit - Support: sr #109235, pam_oath only works as root

 
 

sr #109235: pam_oath only works as root

Submitter:  None
Submitted:  Tue 24 Jan 2017 09:49:50 PM UTC
   
 
Category:  None Priority:  5 - Normal
Severity:  4 - Important Status:  None
Privacy:  Public Assigned to:  None
Originator Email:  -email is unavailable- Open/Closed:  Open
Operating System:  GNU/Linux
* Mandatory Fields

Add a New Comment Rich Markup
   

Wed 25 Jan 2017 11:56:58 AM UTC, comment #1: 

I already post a Merge Request doing exactly what you suggest :
https://gitlab.com/oath-toolkit/oath-toolkit/merge_requests/1

I also post the patch on the mailing list :
http://lists.nongnu.org/archive/html/oath-toolkit-help/2016-07/msg00000.html

But I didn't have any review/comment since july (this project seams a bit dead…)

Maxime de Roucy <tchernomax>
Tue 24 Jan 2017 09:49:50 PM UTC, original submission:  

The usersfile setting for pam_oath.so specifies a file to read (and write) during authentication.  This file must be accessible to root only, of course, to provide security.

Not all software using libpam runs as root.  If it does, everything works as expected.  Otherwise, pam_oath.so cannot read the usersfile and therefore fails.  Example: i3lock, pamtester, xscreensaver and many others.

A simple fix is to use suid to root for all binaries, but this is of course not desirable.

pam_unix.so has a helper binary, /sbin/unix_chkpwd, with sgid to shadow to access /etc/shadow.  A similar helper would be required for pam_auth to do the actual work.

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by tchernomax (Posted a comment)
  • -email is unavailable- added by None (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    No changes have been made to this item

    Back to the top

    Powered by Savane 3.13-4448.
    Corresponding source code