|
 |
905b4d |
From 5af7fea571868eed16655adffcc9314911e12417 Mon Sep 17 00:00:00 2001
|
|
|
905b4d |
From: Lukas Slebodnik <lslebodn@redhat.com>
|
|
|
905b4d |
Date: Mon, 20 Oct 2014 22:21:25 +0200
|
|
|
905b4d |
Subject: [PATCH 75/87] PAM: Remove authtok from PAM stack with OTP
|
|
|
905b4d |
|
|
|
905b4d |
We remove the password from the PAM stack when OTP is used to make sure
|
|
|
905b4d |
that other pam modules (pam-gnome-keyring, pam_mount) cannot use it anymore
|
|
|
905b4d |
and have to request a password on their own.
|
|
|
905b4d |
|
|
|
905b4d |
Resolves:
|
|
|
905b4d |
https://fedorahosted.org/sssd/ticket/2287
|
|
|
905b4d |
|
|
|
905b4d |
Reviewed-by: Nathaniel McCallum <npmccallum@redhat.com>
|
|
|
905b4d |
---
|
|
|
905b4d |
src/providers/krb5/krb5_auth.c | 14 ++++++++++++++
|
|
|
905b4d |
src/sss_client/pam_sss.c | 16 +++++++++++++++-
|
|
|
905b4d |
2 files changed, 29 insertions(+), 1 deletion(-)
|
|
|
905b4d |
|
|
|
905b4d |
diff --git a/src/providers/krb5/krb5_auth.c b/src/providers/krb5/krb5_auth.c
|
|
|
905b4d |
index f539d5068ec29f7b06f734a3417864b43122b1b7..c96b7aee99da8c3d43a67a04bb1f67ee048d4705 100644
|
|
|
905b4d |
--- a/src/providers/krb5/krb5_auth.c
|
|
|
905b4d |
+++ b/src/providers/krb5/krb5_auth.c
|
|
|
905b4d |
@@ -1161,6 +1161,20 @@ static void krb5_auth_done(struct tevent_req *subreq)
|
|
|
905b4d |
krb5_auth_store_creds(state->domain, pd);
|
|
|
905b4d |
}
|
|
|
905b4d |
|
|
|
905b4d |
+ if (res->otp == true && pd->cmd == SSS_PAM_AUTHENTICATE) {
|
|
|
905b4d |
+ uint32_t otp_flag = 1;
|
|
|
905b4d |
+ ret = pam_add_response(pd, SSS_OTP, sizeof(uint32_t),
|
|
|
905b4d |
+ (const uint8_t *) &otp_flag);
|
|
|
905b4d |
+ if (ret != EOK) {
|
|
|
905b4d |
+ DEBUG(SSSDBG_CRIT_FAILURE,
|
|
|
905b4d |
+ "pam_add_response failed: %d (%s).\n",
|
|
|
905b4d |
+ ret, sss_strerror(ret));
|
|
|
905b4d |
+ state->pam_status = PAM_SYSTEM_ERR;
|
|
|
905b4d |
+ state->dp_err = DP_ERR_OK;
|
|
|
905b4d |
+ goto done;
|
|
|
905b4d |
+ }
|
|
|
905b4d |
+ }
|
|
|
905b4d |
+
|
|
|
905b4d |
state->pam_status = PAM_SUCCESS;
|
|
|
905b4d |
state->dp_err = DP_ERR_OK;
|
|
|
905b4d |
ret = EOK;
|
|
|
905b4d |
diff --git a/src/sss_client/pam_sss.c b/src/sss_client/pam_sss.c
|
|
|
905b4d |
index abe9b05478cbf480b3430dccd1951e9bfb0e29c1..d64e826daeb80be8998ef3b410047e3a44051b07 100644
|
|
|
905b4d |
--- a/src/sss_client/pam_sss.c
|
|
|
905b4d |
+++ b/src/sss_client/pam_sss.c
|
|
|
905b4d |
@@ -206,7 +206,7 @@ static size_t add_string_item(enum pam_item_type type, const char *str,
|
|
|
905b4d |
return rp;
|
|
|
905b4d |
}
|
|
|
905b4d |
|
|
|
905b4d |
-static void overwrite_and_free_pam_items(struct pam_items *pi)
|
|
|
905b4d |
+static void overwrite_and_free_authtoks(struct pam_items *pi)
|
|
|
905b4d |
{
|
|
|
905b4d |
if (pi->pam_authtok != NULL) {
|
|
|
905b4d |
_pam_overwrite_n((void *)pi->pam_authtok, pi->pam_authtok_size);
|
|
|
905b4d |
@@ -222,6 +222,11 @@ static void overwrite_and_free_pam_items(struct pam_items *pi)
|
|
|
905b4d |
|
|
|
905b4d |
pi->pamstack_authtok = NULL;
|
|
|
905b4d |
pi->pamstack_oldauthtok = NULL;
|
|
|
905b4d |
+}
|
|
|
905b4d |
+
|
|
|
905b4d |
+static void overwrite_and_free_pam_items(struct pam_items *pi)
|
|
|
905b4d |
+{
|
|
|
905b4d |
+ overwrite_and_free_authtoks(pi);
|
|
|
905b4d |
|
|
|
905b4d |
free(pi->domain_name);
|
|
|
905b4d |
pi->domain_name = NULL;
|
|
|
905b4d |
@@ -998,6 +1003,15 @@ static int eval_response(pam_handle_t *pamh, size_t buflen, uint8_t *buf,
|
|
|
905b4d |
D(("do_pam_conversation failed."));
|
|
|
905b4d |
}
|
|
|
905b4d |
break;
|
|
|
905b4d |
+ case SSS_OTP:
|
|
|
905b4d |
+ D(("OTP was used, removing authtokens."));
|
|
|
905b4d |
+ overwrite_and_free_authtoks(pi);
|
|
|
905b4d |
+ ret = pam_set_item(pamh, PAM_AUTHTOK, NULL);
|
|
|
905b4d |
+ if (ret != PAM_SUCCESS) {
|
|
|
905b4d |
+ D(("Failed to remove PAM_AUTHTOK after using otp [%s]",
|
|
|
905b4d |
+ pam_strerror(pamh,ret)));
|
|
|
905b4d |
+ }
|
|
|
905b4d |
+ break;
|
|
|
905b4d |
default:
|
|
|
905b4d |
D(("Unknown response type [%d]", type));
|
|
|
905b4d |
}
|
|
|
905b4d |
--
|
|
|
905b4d |
1.9.3
|
|
|
905b4d |
|