I am trying to set up a PAM module that lets one add a conditional password change scheme. The intended behavior is like this:
do you want to change authentication token for TestProgram?(s/n):
in case he decides he does (s)
- 3.1.1 (s) > user:...
- 3.1.2 >pass:...
- 3.1.3 >newpass:...
3.1.4 >repeat newpass:...
3.1.5 >password successfully changed (or not)
In case he just wanted to use passwd regularly
- 3.2.1 :user UNIX password:....
I have already managed to more or less make it work but i'm having trouble with the PAM flags. right now the module configuration (let's call it myauthschema) is like this:
auth sufficient /usr/lib/security/pam_mymod.so ...
and in my /etc/pam.d/passwd file i added first the line
In the pam_sm_chauthtok interface i do this:
if(flags & PAM_PRELIM_CHECK) return PAM_IGNORE;
Else execute pam conversation to know if you want to change this program credentials.
If you do, return
PAM_SUCCESS or an error (this should -end stack execution always, for either success or failure-),
If you want to use the regular module,
My problem is this: whenever I run
passwd it will run my module, but if I decide to
PAM_IGNORE it's result, I won't be prompted for my user password next, for the regular usage of
passwd command. Any ideas how it could be solved? it is very likely I'm failing to use the flags correctly, i.e., I always return
PAM_IGNORE on the first time
pam_sm_chauthok is called, but I'm not sure what I should return.
Maybe the correct behaviour is to ask first what I want to
chauthtok, then checking if it's the prelim check or not. If my question isn't clear, I'd like to hear it.
For what I know, it is very similar to this question I found digging the inter-web: http://www.spinics.net/lists/pam/msg05902.html