I am trying to set up a PAM module that lets one add a conditional password change scheme. The intended behavior is like this:
passwd
do you want to change authentication token for TestProgram?(s/n):
in case he decides he does (s)
- 3.1.1 (s) > user:...
- 3.1.2 >pass:...
- 3.1.3 >newpass:...
3.1.4 >repeat newpass:...
3.1.5 >password successfully changed (or not)
In case he just wanted to use passwd regularly
- 3.2.1 :user UNIX password:....
...
I have already managed to more or less make it work but i'm having trouble with the PAM flags. right now the module configuration (let's call it myauthschema) is like this:
auth sufficient /usr/lib/security/pam_mymod.so ...
and in my /etc/pam.d/passwd file i added first the line
@include myauthschema
In the pam_sm_chauthtok interface i do this:
if(flags & PAM_PRELIM_CHECK) return PAM_IGNORE;
Else execute pam conversation to know if you want to change this program credentials.
If you do, return PAM_SUCCESS
or an error (this should -end stack execution always, for either success or failure-),
If you want to use the regular module,
return PAM_IGNORE*
My problem is this: whenever I run passwd
it will run my module, but if I decide to PAM_IGNORE
it's result, I won't be prompted for my user password next, for the regular usage of passwd
command. Any ideas how it could be solved? it is very likely I'm failing to use the flags correctly, i.e., I always return PAM_IGNORE
on the first time pam_sm_chauthok
is called, but I'm not sure what I should return.
Maybe the correct behaviour is to ask first what I want to chauthtok
, then checking if it's the prelim check or not. If my question isn't clear, I'd like to hear it.
For what I know, it is very similar to this question I found digging the inter-web: http://www.spinics.net/lists/pam/msg05902.html