2

I am trying to set up a PAM module that lets one add a conditional password change scheme. The intended behavior is like this:

  1. passwd

  2. do you want to change authentication token for TestProgram?(s/n):

in case he decides he does (s)

  • 3.1.1 (s) > user:...
  • 3.1.2 >pass:...
  • 3.1.3 >newpass:...
  • 3.1.4 >repeat newpass:...

  • 3.1.5 >password successfully changed (or not)

In case he just wanted to use passwd regularly

  • 3.2.1 :user UNIX password:....

...

I have already managed to more or less make it work but i'm having trouble with the PAM flags. right now the module configuration (let's call it myauthschema) is like this:

auth sufficient /usr/lib/security/pam_mymod.so ...

and in my /etc/pam.d/passwd file i added first the line

@include myauthschema

In the pam_sm_chauthtok interface i do this:

if(flags & PAM_PRELIM_CHECK) return PAM_IGNORE;

Else execute pam conversation to know if you want to change this program credentials. If you do, return PAM_SUCCESS or an error (this should -end stack execution always, for either success or failure-),

If you want to use the regular module,

return PAM_IGNORE*

My problem is this: whenever I run passwd it will run my module, but if I decide to PAM_IGNORE it's result, I won't be prompted for my user password next, for the regular usage of passwd command. Any ideas how it could be solved? it is very likely I'm failing to use the flags correctly, i.e., I always return PAM_IGNORE on the first time pam_sm_chauthok is called, but I'm not sure what I should return.

Maybe the correct behaviour is to ask first what I want to chauthtok, then checking if it's the prelim check or not. If my question isn't clear, I'd like to hear it.

For what I know, it is very similar to this question I found digging the inter-web: http://www.spinics.net/lists/pam/msg05902.html

3
  • This question might fare better on serverfault or unix/linux as it is very technical. My hunch is this issue is tied to a "catch 22" of the passwd command itself calling the (now modified) PAM stack.
    – zedman9991
    Sep 28, 2011 at 18:35
  • 1
    For several reasons i've decided it is not possible to separate the two authentication schemes on the same stack, which is pretty reasonable considering it is not supposed to work that way. Thanks for anyone who checked out this question and gave it a thought. Sep 28, 2011 at 22:51
  • Closed as per @Bruno's request.
    – Rory Alsop
    Sep 29, 2011 at 13:44

0

Browse other questions tagged .