search for: pam_get_user

...ing: passing arg 3 of `pam_get_item' from incompatible pointer type nsswitch/pam_winbind.c: At top level: nsswitch/pam_winbind.c:417: error: syntax error before "int" nsswitch/pam_winbind.c: In function `pam_sm_authenticate': nsswitch/pam_winbind.c:428: warning: passing arg 2 of `pam_get_user' from incompatible pointer type nsswitch/pam_winbind.c: At top level: nsswitch/pam_winbind.c:461: error: syntax error before "int" nsswitch/pam_winbind.c:472: error: syntax error before "int" nsswitch/pam_winbind.c: In function `pam_sm_acct_mgmt': nsswitch/pam_winbind.c...

...nbind.c:312: warning: assignment discards qualifiers from pointer target type nsswitch/pam_winbind.c:370: warning: passing arg 3 of `pam_get_item' from incompatible pointer type nsswitch/pam_winbind.c: In function `pam_sm_authenticate': nsswitch/pam_winbind.c:396: warning: passing arg 2 of `pam_get_user' from incompatible pointer type nsswitch/pam_winbind.c: In function `pam_sm_acct_mgmt': nsswitch/pam_winbind.c:450: warning: passing arg 2 of `pam_get_user' from incompatible pointer type nsswitch/pam_winbind.c: In function `pam_sm_chauthtok': nsswitch/pam_winbind.c:525: warning: pa...

...bind.c:402: warning: passing arg 3 of `pam_get_item' from incomp nsswitch/pam_winbind.c: At top level: nsswitch/pam_winbind.c:417: error: syntax error before "int" nsswitch/pam_winbind.c: In function `pam_sm_authenticate': nsswitch/pam_winbind.c:428: warning: passing arg 2 of `pam_get_user' from incomp nsswitch/pam_winbind.c: At top level: nsswitch/pam_winbind.c:461: error: syntax error before "int" nsswitch/pam_winbind.c:472: error: syntax error before "int" nsswitch/pam_winbind.c: In function `pam_sm_acct_mgmt': nsswitch/pam_winbind.c:482: warning:...

...nbind.c:376: warning: assignment discards qualifiers from pointer target type nsswitch/pam_winbind.c:434: warning: passing arg 3 of `pam_get_item' from incompatible pointer type nsswitch/pam_winbind.c: In function `pam_sm_authenticate': nsswitch/pam_winbind.c:462: warning: passing arg 2 of `pam_get_user' from incompatible pointer type nsswitch/pam_winbind.c: In function `pam_sm_acct_mgmt': nsswitch/pam_winbind.c:534: warning: passing arg 2 of `pam_get_user' from incompatible pointer type nsswitch/pam_winbind.c: In function `pam_sm_chauthtok': nsswitch/pam_winbind.c:612: warning: pa...

...passing arg 3 of `pam_get_item' from incomp atible pointer type nsswitch/pam_winbind.c: At top level: nsswitch/pam_winbind.c:417: error: syntax error before "int" nsswitch/pam_winbind.c: In function `pam_sm_authenticate': nsswitch/pam_winbind.c:428: warning: passing arg 2 of `pam_get_user' from incomp atible pointer type nsswitch/pam_winbind.c: At top level: nsswitch/pam_winbind.c:461: error: syntax error before "int" nsswitch/pam_winbind.c:472: error: syntax error before "int" nsswitch/pam_winbind.c: In function `pam_sm_acct_mgmt': nsswitch/pam_win...

...passing arg 3 of `pam_get_item' from incomp atible pointer type nsswitch/pam_winbind.c: At top level: nsswitch/pam_winbind.c:417: error: syntax error before "int" nsswitch/pam_winbind.c: In function `pam_sm_authenticate': nsswitch/pam_winbind.c:428: warning: passing arg 2 of `pam_get_user' from incomp atible pointer type nsswitch/pam_winbind.c: At top level: nsswitch/pam_winbind.c:461: error: syntax error before "int" nsswitch/pam_winbind.c:472: error: syntax error before "int" nsswitch/pam_winbind.c: In function `pam_sm_acct_mgmt': nsswitch/pam_win...

...ind.c:376: warning: assignment discards qualifiers from pointer target type nsswitch/pam_winbind.c:434: warning: passing arg 3 of `pam_get_item' from incompatible pointer type nsswitch/pam_winbind.c: In function `pam_sm_authenticate': nsswitch/pam_winbind.c:462: warning: passing arg 2 of `pam_get_user' from incompatible pointer type nsswitch/pam_winbind.c: In function `pam_sm_acct_mgmt': nsswitch/pam_winbind.c:534: warning: passing arg 2 of `pam_get_user' from incompatible pointer type nsswitch/pam_winbind.c: In function `pam_sm_chauthtok': nsswitch/pam_winbind.c:612: warning:...

...l PAM user is > matching the one that initiated the transaction. > > See also: https://github.com/util-linux/util-linux/pull/3206 Note that linux-pam provides a module called pam_canonicalize_user with the following description: This PAM module uses the name of the user obtained via pam_get_user(3) as a key to query the password database, and replaces PAM_USER with the pw_name value that has been returned. >From this perspective, a blanket ban on the user name change would be too restrictive. -- ldv

...ning: passing arg 3 of `pam_get_item' from incompatible pointer type nsswitch/pam_winbind.c: At top level: nsswitch/pam_winbind.c:454: error: syntax error before "int" nsswitch/pam_winbind.c: In function `pam_sm_authenticate': nsswitch/pam_winbind.c:467: warning: passing arg 2 of `pam_get_user' from incompatible pointer type nsswitch/pam_winbind.c: At top level: nsswitch/pam_winbind.c:535: error: syntax error before "int" nsswitch/pam_winbind.c:546: error: syntax error before "int" nsswitch/pam_winbind.c: In function `pam_sm_acct_mgmt': nsswitch/pam_winbind.c:...

...nbind.c:344: warning: assignment discards qualifiers from pointer target type nsswitch/pam_winbind.c:402: warning: passing arg 3 of `pam_get_item' from incompatible pointer type nsswitch/pam_winbind.c: In function `pam_sm_authenticate': nsswitch/pam_winbind.c:428: warning: passing arg 2 of `pam_get_user' from incompatible pointer type nsswitch/pam_winbind.c: In function `pam_sm_acct_mgmt': nsswitch/pam_winbind.c:482: warning: passing arg 2 of `pam_get_user' from incompatible pointer type nsswitch/pam_winbind.c: In function `pam_sm_chauthtok': nsswitch/pam_winbind.c:559: warning: pa...

...auth.debug] PAM[27977]: load_modules(7f6e8, pam_sm_authenticate)=/usr/lib/security/pam_ldap.so.1 Nov 9 10:00:07 sshserver sshd[27977]: [ID 258498 auth.debug] PAM[27977]: load_function: successful load of pam_sm_authenticate Nov 9 10:00:07 sshserver sshd[27977]: [ID 334087 auth.debug] PAM[27977]: pam_get_user(7f6e8, 61746500, NULL) Nov 9 10:00:07 sshserver sshd[27977]: [ID 800047 auth.debug] debug3: PAM: sshpam_thread_conv entering, 1 messages Nov 9 10:00:07 sshserver sshd[27977]: [ID 800047 auth.debug] debug3: ssh_msg_send: type 1 Nov 9 10:00:07 sshserver sshd[27977]: [ID 800047 auth.debug] debug3:...

...PAM_CONV_CONST=" ], [ AC_MSG_RESULT(no) DEFINES="$DEFINES -DPAM_CONV_CONST=const" ]) CFLAGS="$otp_CFLAGS" # restore --8<-- And then I do pam_get_item(..., (PAM_GET_CONST void **) arg); pam_get_user(..., (PAM_GET_CONST void **) arg); conv(..., (PAM_CONV_CONST struct pam_message **) arg, ...); -frank

From: Marco Trevisan (Trevi?o) <mail at 3v1n0.net> PAM modules can change the user during their execution, in such case ssh would still use the user that has been provided giving potentially access to another user with the credentials of another one. So prevent this to happen, by ensuring that the final PAM user is matching the one that initiated the transaction. See also:

...th/lib20_auth_var_expand_crypt.so Feb 11 09:20:40 mail dovecot: auth-worker(34874): Debug: pam(woodsb02,192.168.1.13,<GRJsRuxkf17AqAEN>): lookup service=imap Feb 11 09:20:40 mail auth: in openpam_dispatch(): calling pam_sm_authenticate() in /usr/lib/pam_krb5.so.6 Feb 11 09:20:40 mail auth: in pam_get_user(): entering Feb 11 09:20:40 mail auth: in pam_get_item(): entering: PAM_USER Feb 11 09:20:40 mail auth: in pam_get_item(): returning PAM_SUCCESS Feb 11 09:20:40 mail auth: in pam_get_user(): returning PAM_SUCCESS Feb 11 09:20:40 mail auth: in pam_sm_authenticate(): Got user: woodsb02 Feb 11 09:20:4...

...crypt.so > Feb 11 09:20:40 mail dovecot: auth-worker(34874): Debug: > pam(woodsb02,192.168.1.13,<GRJsRuxkf17AqAEN>): lookup service=imap > Feb 11 09:20:40 mail auth: in openpam_dispatch(): calling > pam_sm_authenticate() in /usr/lib/pam_krb5.so.6 > Feb 11 09:20:40 mail auth: in pam_get_user(): entering > Feb 11 09:20:40 mail auth: in pam_get_item(): entering: PAM_USER > Feb 11 09:20:40 mail auth: in pam_get_item(): returning PAM_SUCCESS > Feb 11 09:20:40 mail auth: in pam_get_user(): returning PAM_SUCCESS > Feb 11 09:20:40 mail auth: in pam_sm_authenticate(): Got user: &gt...

...nbind.c:325: warning: assignment discards qualifiers from pointer target type nsswitch/pam_winbind.c:383: warning: passing arg 3 of `pam_get_item' from incompatible pointer type nsswitch/pam_winbind.c: In function `pam_sm_authenticate': nsswitch/pam_winbind.c:409: warning: passing arg 2 of `pam_get_user' from incompatible pointer type nsswitch/pam_winbind.c: In function `pam_sm_acct_mgmt': nsswitch/pam_winbind.c:463: warning: passing arg 2 of `pam_get_user' from incompatible pointer type nsswitch/pam_winbind.c: In function `pam_sm_chauthtok': nsswitch/pam_winbind.c:540: warning: pa...

Hi, The main (and probably the only) use case of this PAM module is to let sudo authenticate users via their ssh-agent, therefore without having to type any password and without being tempted to use the NOPASSWD sudo option for such convenience. The principle is originally implemented by an existing module [0][1] and many pages that explain how to use it for such purpose can be found online.

Hello, I've developed a custom PAM module which only allows a user to authenticate to the server only if another user of the same machine also authenticates succesfully. It's currently a simple module which also works as a PAM aware application since it authenticates each user with PAM itself. Both the pamtester utility and su can use this module correctly. However, when I try to use

...syntax error before '*' token pam_ldap.c: In function `pam_sm_authenticate': pam_ldap.c:3289: error: `argc' undeclared (first use in this function) pam_ldap.c:3291: error: `argv' undeclared (first use in this function) pam_ldap.c:3309: warning: implicit declaration of function `pam_get_user' pam_ldap.c:3309: error: `pamh' undeclared (first use in this function) pam_ldap.c:3310: error: `PAM_SUCCESS' undeclared (first use in this function) pam_ldap.c:3317: error: `PAM_AUTHTOK' undeclared (first use in this function) pam_ldap.c:3317: warning: dereferencing type-punned poi...