|
 |
73cfcf |
diff -up Linux-PAM-1.2.0/modules/pam_unix/pam_unix.8.xml.no-fallback Linux-PAM-1.2.0/modules/pam_unix/pam_unix.8.xml
|
|
|
73cfcf |
--- Linux-PAM-1.2.0/modules/pam_unix/pam_unix.8.xml.no-fallback 2015-04-27 16:38:03.000000000 +0200
|
|
|
73cfcf |
+++ Linux-PAM-1.2.0/modules/pam_unix/pam_unix.8.xml 2015-05-15 15:54:21.524440864 +0200
|
|
|
73cfcf |
@@ -284,11 +284,10 @@
|
|
|
73cfcf |
<listitem>
|
|
|
73cfcf |
<para>
|
|
|
73cfcf |
When a user changes their password next,
|
|
|
73cfcf |
- encrypt it with the SHA256 algorithm. If the
|
|
|
73cfcf |
- SHA256 algorithm is not known to the <citerefentry>
|
|
|
73cfcf |
+ encrypt it with the SHA256 algorithm. The
|
|
|
73cfcf |
+ SHA256 algorithm must be supported by the <citerefentry>
|
|
|
73cfcf |
<refentrytitle>crypt</refentrytitle><manvolnum>3</manvolnum>
|
|
|
73cfcf |
- </citerefentry> function,
|
|
|
73cfcf |
- fall back to MD5.
|
|
|
73cfcf |
+ </citerefentry> function.
|
|
|
73cfcf |
</para>
|
|
|
73cfcf |
</listitem>
|
|
|
73cfcf |
</varlistentry>
|
|
|
73cfcf |
@@ -299,11 +298,10 @@
|
|
|
73cfcf |
<listitem>
|
|
|
73cfcf |
<para>
|
|
|
73cfcf |
When a user changes their password next,
|
|
|
73cfcf |
- encrypt it with the SHA512 algorithm. If the
|
|
|
73cfcf |
- SHA512 algorithm is not known to the <citerefentry>
|
|
|
73cfcf |
+ encrypt it with the SHA512 algorithm. The
|
|
|
73cfcf |
+ SHA512 algorithm must be supported by the <citerefentry>
|
|
|
73cfcf |
<refentrytitle>crypt</refentrytitle><manvolnum>3</manvolnum>
|
|
|
73cfcf |
- </citerefentry> function,
|
|
|
73cfcf |
- fall back to MD5.
|
|
|
73cfcf |
+ </citerefentry> function.
|
|
|
73cfcf |
</para>
|
|
|
73cfcf |
</listitem>
|
|
|
73cfcf |
</varlistentry>
|
|
|
73cfcf |
@@ -314,11 +312,10 @@
|
|
|
73cfcf |
<listitem>
|
|
|
73cfcf |
<para>
|
|
|
73cfcf |
When a user changes their password next,
|
|
|
73cfcf |
- encrypt it with the blowfish algorithm. If the
|
|
|
73cfcf |
- blowfish algorithm is not known to the <citerefentry>
|
|
|
73cfcf |
+ encrypt it with the blowfish algorithm. The
|
|
|
73cfcf |
+ blowfish algorithm must be supported by the <citerefentry>
|
|
|
73cfcf |
<refentrytitle>crypt</refentrytitle><manvolnum>3</manvolnum>
|
|
|
73cfcf |
- </citerefentry> function,
|
|
|
73cfcf |
- fall back to MD5.
|
|
|
73cfcf |
+ </citerefentry> function.
|
|
|
73cfcf |
</para>
|
|
|
73cfcf |
</listitem>
|
|
|
73cfcf |
</varlistentry>
|
|
|
73cfcf |
diff -up Linux-PAM-1.2.0/modules/pam_unix/passverify.c.no-fallback Linux-PAM-1.2.0/modules/pam_unix/passverify.c
|
|
|
73cfcf |
--- Linux-PAM-1.2.0/modules/pam_unix/passverify.c.no-fallback 2015-05-15 15:54:21.525440887 +0200
|
|
|
73cfcf |
+++ Linux-PAM-1.2.0/modules/pam_unix/passverify.c 2015-05-15 15:57:23.138613273 +0200
|
|
|
73cfcf |
@@ -437,10 +437,9 @@ PAMH_ARG_DECL(char * create_password_has
|
|
|
73cfcf |
sp = crypt(password, salt);
|
|
|
73cfcf |
#endif
|
|
|
73cfcf |
if (!sp || strncmp(algoid, sp, strlen(algoid)) != 0) {
|
|
|
73cfcf |
- /* libxcrypt/libc doesn't know the algorithm, use MD5 */
|
|
|
73cfcf |
+ /* libxcrypt/libc doesn't know the algorithm, error out */
|
|
|
73cfcf |
pam_syslog(pamh, LOG_ERR,
|
|
|
73cfcf |
- "Algo %s not supported by the crypto backend, "
|
|
|
73cfcf |
- "falling back to MD5\n",
|
|
|
73cfcf |
+ "Algo %s not supported by the crypto backend.\n",
|
|
|
73cfcf |
on(UNIX_BLOWFISH_PASS, ctrl) ? "blowfish" :
|
|
|
73cfcf |
on(UNIX_SHA256_PASS, ctrl) ? "sha256" :
|
|
|
73cfcf |
on(UNIX_SHA512_PASS, ctrl) ? "sha512" : algoid);
|
|
|
73cfcf |
@@ -450,7 +449,7 @@ PAMH_ARG_DECL(char * create_password_has
|
|
|
73cfcf |
#ifdef HAVE_CRYPT_R
|
|
|
73cfcf |
free(cdata);
|
|
|
73cfcf |
#endif
|
|
|
73cfcf |
- return crypt_md5_wrapper(password);
|
|
|
73cfcf |
+ return NULL;
|
|
|
73cfcf |
}
|
|
|
73cfcf |
sp = x_strdup(sp);
|
|
|
73cfcf |
#ifdef HAVE_CRYPT_R
|