diff options
| author |   Sam James <sam@gentoo.org> | 2020-10-26 08:32:29 +0000 |
|---|---|---|
| committer | Sam James <sam@gentoo.org> | 2020-10-26 22:48:06 +0000 |
| commit | 99919c4b2b59af27e7ad1daa6fbe8c614a8463c0 (patch) | |
| tree | 6b6a97677188ab0ebe593bb0568826db0222e4f8 | |
| parent | templates/system-login.tpl: always need faillock (diff) | |
| download | pambase-99919c4b2b59af27e7ad1daa6fbe8c614a8463c0.tar.gz pambase-99919c4b2b59af27e7ad1daa6fbe8c614a8463c0.tar.bz2 pambase-99919c4b2b59af27e7ad1daa6fbe8c614a8463c0.zip | |
templates/system-auth.tpl: skip pam_unix with krb5
Before this change, success on pam_krb5 would result in jumping
one line (over pam_permit) back into pam_unix.
Incidentally, we did the later stanza correctly. This was a regression
from old pambase.
Bug: https://bugs.gentoo.org/748405
Signed-off-by: Sam James <sam@gentoo.org>
| -rw-r--r-- | templates/system-auth.tpl | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/templates/system-auth.tpl b/templates/system-auth.tpl index 8b61701..668303f 100644 --- a/templates/system-auth.tpl +++ b/templates/system-auth.tpl @@ -4,20 +4,20 @@ auth sufficient pam_ssh.so {% endif %} {% if krb5 %} -auth [success=1 default=ignore] pam_krb5.so {{ krb5_params }} +auth [success=4 default=ignore] pam_krb5.so {{ krb5_params }} {% endif %} -auth optional pam_permit.so auth requisite pam_faillock.so preauth auth [success=1 default=ignore] pam_unix.so {{ nullok|default('', true) }} {{ debug|default('', true) }} try_first_pass auth [default=die] pam_faillock.so authfail +auth optional pam_permit.so {% if krb5 %} -account [success=1 default=ignore] pam_krb5.so {{ krb5_params }} +account [success=2 default=ignore] pam_krb5.so {{ krb5_params }} {% endif %} account required pam_unix.so {{ debug|default('', true) }} -account optional pam_permit.so account required pam_faillock.so +account optional pam_permit.so {% if passwdqc %} password required pam_passwdqc.so config=/etc/security/passwdqc.conf |