Changeset 24102

Show
Ignore:
Timestamp:
10/20/09 00:47:54 (5 weeks ago)
Author:
broder
Message:

In the pam_krb5 config, instead of just skipping the pam_echo in case
of failure, immediately die.

This works around a bug in pam-auth-update where default=1 is treated
differently depending on whether or not the "end" in success=end has
been replaced with a number. This was causing pam-auth-update to
spuriously detect changes to /etc/pam.d/common-auth.

This change does have the effect that a failure of pam_krb5 will no
longer bubble down to any other potential auth providers. However, I
think that the scenario of (a) using >=debathena-login, (b) having a
second PAM auth module you want to use that, (c) is managed by
pam-auth-update and not by hand and (d) comes after pam_krb5 in
pam-auth-update's ordering scheme is pretty unlikely.

Files:
1 modified

Legend:

Unmodified
Added
Removed

  • trunk/debathena/config/pam-config/debian/libpam-krb5.pam-config

    r24065 r24102  
    44Auth-Type: Primary 
    55Auth-Initial: 
    6         [success=end authinfo_unavail=ignore default=1] pam_krb5.so minimum_uid=1 
     6        [success=end authinfo_unavail=ignore default=die]       pam_krb5.so minimum_uid=1 
    77        [default=die] pam_echo.so file=/etc/issue.net.no_network 
    88Auth: 
    9         [success=end authinfo_unavail=ignore default=1] pam_krb5.so minimum_uid=1 use_first_pass 
     9        [success=end authinfo_unavail=ignore default=die]       pam_krb5.so minimum_uid=1 use_first_pass 
    1010        [default=die] pam_echo.so file=/etc/issue.net.no_network 
    1111Account-Type: Primary