Displaying 20 results from an estimated 400 matches similar to: "[Bug 381] New: unable to access expired accounts using PAM with openssh-3.4P1"
2003 Feb 20
0
"if 0" in auth-pam.c
Hi,
I was doing some research on why new openssh-versions (3.4 and 3.5p1)
doesnt ask you to change expired passwords (it just disconnects you) and
found something curious.
Line 259 of auth-pam.c has "#if 0" and then the code to set some vars
(eg. password_change_required to true) followed by an "endif". Why is
that? I'm not a C expert, but I think "if 0" is
2002 Dec 10
5
[PATCH] Password expiry with Privsep and PAM
Hi All.
Attached is a patch that implements password expiry with PAM and
privsep. It works by passing a descriptor to the tty to the monitor,
which sets up a child with that tty as stdin/stdout/stderr, then runs
chauthtok(). No setuid helpers.
I used some parts of Michael Steffens' patch (bugid #423) to make it
work on HP-UX.
It's still rough but it works. Tested on Solaris 8 and
2002 Dec 08
1
Password expiry related clarification in OpenSSH3.5p1
fyi (i'm behind in following the passord expire efforts).
----- Forwarded message from Logu <logsnaath at gmx.net> -----
Date: Sat, 7 Dec 2002 02:42:52 +0530
From: "Logu" <logsnaath at gmx.net>
To: <stevesk at cvs.openbsd.org>
Cc: <kumaresh_ind at gmx.net>
Subject: Password expiry related clarification in OpenSSH3.5p1
Hello Stevesk,
We are using
2002 Dec 21
6
[PATCH] PAM chauthtok + Privsep
Hello All.
Attached is an update to my previous patch to make do_pam_chauthtok and
privsep play nicely together.
First, a question: does anybody care about these or the password
expiration patches?
Anyway, the "PRIVSEP(do_pam_hauthtok())" has been moved to just after
the pty has been allocated but before it's made the controlling tty.
This allows the child running chauthtok to
2002 Nov 20
0
[PATCH #9] Password expiration via /bin/passwd.
This is an attempt to simplify the AIX expiry-via-passwd stuff and make
it more generic. (There's actually a net reduction in #ifdefs).
Patch against CVS:
1) configure finds passwd.
2) sshd uses passwd during session if required.
3) sshd uses passwd for PAM change if privsep disabled.
4) sshd uses Buffers for expire and post-login messages (no longer AIX
specific).
5) password_change_required
2003 Jul 09
0
[PATCH] Add expired password handling for AIX.
Hi All.
Attached is a patch which adds AIX native password expiry support to
sshd. It will only apply to -current and is a subset of the patch I have
been working on in the last few months (see bug #14 [1]). It contains
code by Pablo Sor, Mark Pitt and Zdenek Tlusty and fixes for bugs reported
by many others (see [2] for a full list).
It adds a do_tty_change_password function that execs
2003 Jul 30
1
[PATCH] Password expiry merge (AIX parts)
Hi All.
Attached is a patch introduces password expiry handling for AIX (other
platforms to follow). It is more or less the same as the previous patch
but has been updated to reflect recent changes to auth-passwd.c
I'm wondering if the AIX parts of auth.c should be moved to port-aix.c
and if the generic password change functions (currently at the end of
auth-passwd.c) belong in a separate
2003 Dec 07
0
[PATCH] Do PAM chauthtok via keyboard-interactive.
Hi All.
Attached is another patch that attempts to do pam_chauthtok() via SSH2
keyboard-interactive authentication. It now passes the results from the
authentication thread back to the monitor (based on a suggestion from
djm).
Because of this, it doesn't call do_pam_account twice and consequently
now works on AIX 5.2, which the previous version didn't. I haven't tested
it on any
2003 Jan 29
0
[PATCH] features for restricted shell environments
The patch below implements a couple of features which are useful
in an environment where users do not have a regular shell login.
It allows you to selectively disable certain features on a
system-wide level for users with a certain shell; it also allows
you to control and audit TCP forwarding in more detail.
Our system is an email server with a menu for the login shell;
we selectively allow port
2000 Sep 13
2
auth-pam.c support for pam_chauthtok()
When we installed OpenSSH 2.1.1p4 on our Solaris systems, our users
noticed that it did not honor password expiration consistently with
other Solaris login services.
The patch below is against OpenSSH 2.2.0p1 and adds support for PAM
password changes on expiration via pam_chauthtok(). A brief summary of
changes:
auth-pam.c:
* change declaration of pamh to "static pam_handle_t *pamh",
2000 Oct 11
1
Expired passwords & PAM
Currently, OpenSSH prints the message:
"Warning: You password has expired, please change it now"
if the password has expired. It would be nice if the user could/had to
change password before continuing, like with Linux console login. I've
tried to make an patch, but it doesn't work. Ideas?
--- auth-pam.c.org Wed Oct 11 18:03:43 2000
+++ auth-pam.c Wed Oct 11 18:03:44
2003 Jan 02
4
[Bug 423] Workaround for pw change in privsep mode (3.5.p1)
http://bugzilla.mindrot.org/show_bug.cgi?id=423
------- Additional Comments From stevesk at pobox.com 2003-01-02 11:52 -------
regarding log() clash, shouldn't the HP libsec log() be
static or renamed or ?
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
2002 Aug 28
5
password aging problem with ssh protocol 2
Hi,
I'm using openssh3.1p1 and I'm having some problem with password aging
with ssh protocol 2. Every time a password expires and I try to login I
get the following message
ssh username at hostname
username at hostname's password:
Warning: Your password has expired, please change it now
Enter login password:
removing root credentials would break the rpc services that
use secure rpc
2003 Mar 27
0
[Bug 524] Keyboard-interactive PAM back end hides information
http://bugzilla.mindrot.org/show_bug.cgi?id=524
Summary: Keyboard-interactive PAM back end hides information
Product: Portable OpenSSH
Version: -current
Platform: All
OS/Version: All
Status: NEW
Severity: minor
Priority: P2
Component: sshd
AssignedTo: openssh-unix-dev at mindrot.org
2001 Feb 22
5
PAM Service Name Patch
I've attached a patch relative to OpenSSH 2.5.1p1 which sets the
default PAM service name to __progname instead of the hard-coded value
"sshd". This allows you to have multiple invokations of sshd under
different names, each with its own PAM configuration.
Please let me know if you have any questions or problems.
--
Mark D. Roth <roth at feep.net>
http://www.feep.net/~roth/
2002 Apr 26
0
PAM keyboard-interactive
The following patch (relative to -current) makes PAM a proper
kbd-interactive citizen. There are a few limitations (grep for todo), but
the code seems to work OK for protocols 1 & 2 with and without privsep.
Please have a play!
auth2-pam.c is based on code from FreeBSD.
Index: auth2-chall.c
===================================================================
RCS file:
2001 Oct 24
2
disable features
this (uncomplete) patch makes various features compile time
options and saves up to 24K in the resulting
ssh/sshd binaries. i don't know whether this
should be added to the CVS since it makes
the code less readable.
perhaps WITH_COMPRESSION should be added, since
it removes the dependency on libz
-m
Index: Makefile.inc
===================================================================
RCS
2018 Sep 28
2
Support for RFC4252 in sshd with PAM
Hi
I'm trying to integration a Java application using SSHJ
<https://github.com/hierynomus/sshj> client-side - into OpenSSH 7.4. This
is fine, except where I get to a password expiry situation.
Looking at RFC4252 <https://www.ietf.org/rfc/rfc4252.txt> (which is
supported by SSHJ) I don't see any SSH_MSG_USERAUTH_PASSWD_CHANGEREQ [60]
messages getting passed from
2002 Jul 02
3
New PAM kbd-int diff
Below is a new PAM kbd-int diff based on FreeBSD's code. This code makes
PAM kbd-int work with privilege separation.
Contrary to what I have previously stated - it *does* handle multiple
prompts. What it does not handle is multiple passes through the PAM
conversation function, which would be required for expired password
changing.
I would really appreciate some additional eyes over the
2002 Feb 15
0
[Bug 118] New: Implement TIS (protocol 1) via PAM
http://bugzilla.mindrot.org/show_bug.cgi?id=118
Summary: Implement TIS (protocol 1) via PAM
Product: Portable OpenSSH
Version: -current
Platform: All
OS/Version: All
Status: NEW
Severity: normal
Priority: P3
Component: sshd
AssignedTo: openssh-unix-dev at mindrot.org
ReportedBy: fcusack at