Hi Dmitry,
If I understand it correctly, what you mean is that once a user is
authenticated in a system with pam_console, then all subsequent
authentication attempts by this user are successful without having to input
the password. This is kind of dangerous, as somebody could open a session
for an already authenticated user without them knowing it. I'd recommend
you to use pam_timestamp instead, as it offers the same functionality with
additional security features (authentication origin, timeout, etc.).
On Tue, Jan 17, 2023 at 3:48 PM Dmitry Butskoy <buc(a)buc.me> wrote:
Ben Cotton wrote:
> == Summary ==
> Remove pam_console as it is not enabled by default, can be replaced by
> systemd and has security issues.
Just to make sure -- pam_console provided an "auth" feature (see
https://bugzilla.redhat.com/show_bug.cgi?id=137802 ), which allows to
log just once when working on several virtual consoles (and yes, it was
19 years ago :) ). Is it possible with systemd-logind now?
~buc
_______________________________________________
devel mailing list -- devel(a)lists.fedoraproject.org
To unsubscribe send an email to devel-leave(a)lists.fedoraproject.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Do not reply to spam, report it:
https://pagure.io/fedora-infrastructure/new_issue
--
Iker Pedrosa
Software Engineer, Identity Management team
Red Hat <
https://www.redhat.com>
Txapela (gorria) buruan eta ibili munduan
(Red) hat on his head and walk the world
Basque proverb
<
https://www.redhat.com>