search for: pam_disallow_null_authtok

...pty password account name. If the user presses enter on the password prompt (NULL password) access is disallowed. However upon entry of any random string the user is allowed to enter. >Fix: This problem can be overcome if "pam_authenticate" is called with "PAM_DISALLOW_NULL_AUTHTOK" flag if empty passwords are not permitted. A possible patch for the problem is given below: *** auth-pam.c Tue Apr 24 00:08:37 2001 --- auth-amrita.c Tue Nov 6 22:58:46 2001 *************** *** 203,208 **** --- 203,209 ---- { extern ServerOptions option...

...se" level anyway. >+ if (!options.password_authentication || !options.permit_empty_passwd) >+ return(0); Handled in auth-passwd.c (see above). >- retval = (do_pam_authenticate(0) == PAM_SUCCESS); >+ retval = (do_pam_authenticate(options.permit_empty_passwd == 0 >+ ? PAM_DISALLOW_NULL_AUTHTOK >+ : 0) == PAM_SUCCESS); > dispatch_set(SSH2_MSG_USERAUTH_INFO_RESPONSE, NULL); This one should probably be ported to -current (will attach a patch). ------- You are receiving this mail because: ------- You are the assignee for the bug, or are watching the assignee.

http://bugzilla.mindrot.org/show_bug.cgi?id=559 Summary: PAM fixes Product: Portable OpenSSH Version: 3.6.1p2 Platform: All OS/Version: All Status: NEW Severity: normal Priority: P3 Component: sshd AssignedTo: openssh-unix-dev at mindrot.org ReportedBy: fcusack at fcusack.com - start PAM

----- Forwarded message from Andrea Barisani <lcars at infis.univ.trieste.it> ----- Date: Fri, 2 May 2003 14:01:33 +0200 From: Andrea Barisani <lcars at infis.univ.trieste.it> To: openssh at openssh.com Subject: openssh 3.6.1_p2 problem with pam Hi, I've just updated to openssh 3.6.1_p2 and I notice this behaviour: # ssh -l lcars mybox [2 seconds delay] lcars at mybox's

...;m getting is that SecurID auth works OK, but normal password auth doesn't. I narrowed down the failure to the following section in auth-pam.c : __pampasswd = password; pamstate = INITIAL_LOGIN; pam_retval = do_pam_authenticate( options.permit_empty_passwd == 0 ? PAM_DISALLOW_NULL_AUTHTOK : 0); but I can't see how this works. Can anyone enlighten me please? I know that the password is correct but pam_retval is still not equal to PAM_SUCCESS. Cheers, Ed. _________________________________________________________________ Join the world?s largest e-mail service with MSN Hotma...

...*password == '\0' && options.permit_empty_passwd == 0 && + prompt_type == PAM_PROMPT_ECHO_OFF) return 0; __pampasswd = password; pamstate = INITIAL_LOGIN; + pamprompt = prompt_type; pam_retval = do_pam_authenticate( options.permit_empty_passwd == 0 ? PAM_DISALLOW_NULL_AUTHTOK : 0); if (pam_retval == PAM_SUCCESS) { diff -uNr openssh-3.0.2p1.orig/auth-pam.h openssh-3.0.2p1/auth-pam.h --- openssh-3.0.2p1.orig/auth-pam.h Mon Mar 26 22:12:24 2001 +++ openssh-3.0.2p1/auth-pam.h Fri Feb 15 02:15:02 2002 @@ -7,7 +7,7 @@ void start_pam(const char *user); void finish_pam(vo...

...normal > password auth doesn't. I narrowed down the failure to the following > section > in auth-pam.c : > > __pampasswd = password; > > pamstate = INITIAL_LOGIN; > pam_retval = do_pam_authenticate( > options.permit_empty_passwd == 0 ? PAM_DISALLOW_NULL_AUTHTOK > : > 0); > > but I can't see how this works. Can anyone enlighten me please? I know > that > the password is correct but pam_retval is still not equal to > PAM_SUCCESS. > > Cheers, > > Ed. > > _______________________________________________________...

...22: error: `PAM_SUCCESS' undeclared (first use in this function) pam_ldap.c:3224: error: dereferencing pointer to incomplete type pam_ldap.c:3226: error: dereferencing pointer to incomplete type pam_ldap.c:3235: error: `flags' undeclared (first use in this function) pam_ldap.c:3235: error: `PAM_DISALLOW_NULL_AUTHTOK' undeclared (first use in this function) pam_ldap.c:3235: error: invalid use of undefined type `struct pam_response' pam_ldap.c:3235: error: dereferencing pointer to incomplete type pam_ldap.c:3238: error: `PAM_AUTH_ERR' undeclared (first use in this function) pam_ldap.c:3241: error: in...