F40 Change Proposal:Switch pam_userdb from BerkeleyDB to GDBM (System Wide)

[Aoife Moloney]

Wiki https://fedoraproject.org/wiki/Changes/PamBerkeleyDBtoGdbm

== Summary ==
pam_userdb was built with support for BerkeleyDB, but this project is
no longer maintained as open source, so it is replaced by GDBM.

== Owner ==
* Name: [[User:ipedrosa| Iker Pedrosa]] [[User:fjanus| Filip Janus]]
* Email: [e-mail] [e-mail]

== Detailed Description ==
Currently, the Fedora provided BerkeleyDB versions is 5.x, which has
been unmaintained upstream for several years. BerkeleyDB v6.x is
license incompatible, so moving to that version is not an option.

The proposal is to switch to GDBM, which has upstream support and
whose license is compatible with Fedora.

== Feedback ==
This proposal contains manual steps to be executed by system
administrators in the upgrade path. It is a risky point, as it relies
on sysadmins reading the documentation, but it's the best solution so
far. The database location is defined in the PAM stack, and the system
administrator can set it to any value. Therefore, the only way to
automate this would be to embed the database port in the PAM module
code. But the port should be handled by libdb as this will allow it to
concentrate all the effort on a single binary, which will do this job
for other packages as well.

An [https://lists.fedoraproject.org/archives/list/[e-mail]/...
email thread] was opened in Fedora devel to discuss this topic. Steve
Grubb mentioned that this approach was used in the past to update
other PAM modules. So even if the solution is not ideal, the best
approach is to document the database porting process and let the
system administrator run it manually.

== Benefit to Fedora ==
* This change uses a database that is Fedora license compatible.
* This changes uses an upstream maintained database version, with new
features and bug fixing. pam_userdb controls user authentication, and
a bug in the database could lead to a security vulnerability.

== Scope ==
* Proposal owners:
** libdb includes a new subpackage libdb-convert-util, that provides
db_converter, a program to port a BerkeleyDB database to GDBM.
** Change PAM database build option to GDBM.

* Other developers: N/A

* Release engineering: https://pagure.io/releng/issue/11649

* Policies and guidelines: Yes. Opened a
[https://gitlab.com/fedora/docs/fedora-linux-documentation/fedora-linux-sysad...
MR in the System Administrator’s Guide] with the documentation
proposal.

* Trademark approval: N/A

* Alignment with Community Initiatives: N/A

== Upgrade/compatibility impact ==
=== Upgrade ===
* If the pam_userdb module is used by the system, then the
user/sysadmin will have to run the conversion tool. This can't be done
automatically because the database location is configurable, and the
conversion tool will need manual intervention.

=== Compatibility ===
* pam_userdb module is mainly used in vsftpd environments. If this
module is used by the system and the database isn't converted, then
the user won't be able to authenticate in vsftpd environments. The
user would still be able to authenticate using other methods (i.e. su,
ssh) and run the conversion tool.

== How To Test ==
* Run `db_converter` to convert the database. Example
`db_converter --src /etc/vsftpd/login.db --dest /etc/vsftpd/login.gdbm`

* vsftpd login

* Check that the user is authenticated

== User Experience ==
Users won't experience any change.

== Dependencies ==
vsftpd depends on this change, but nothing needs to be done in this package.

== Contingency Plan ==
* Contingency mechanism: Postpone to the next release.
* Contingency deadline: Beta freeze.
* Blocks release? No.

== Documentation ==
[https://gitlab.com/fedora/docs/fedora-linux-documentation/fedora-linux-sysad...
MR in the System Administrator’s Guide] with the documentation
proposal.

== Release Notes ==
pam_userdb switches database provider to GDM.
[https://gitlab.com/fedora/docs/fedora-linux-documentation/fedora-linux-sysad...
Instructions on how to update in the System Administrator’s Guide]

[Aoife Moloney]

The discussion thread is now available for feedback on this proposed change here https://discussion.fedoraproject.org/t/f40-change-proposal-switch-pam-userdb...