Post-freeze patch: remove Password: prompt after failed 2fa

[Patrick Uiterwijk]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Hi,

Post-freeze I would like to merge the following patch, which will remove the
Password: promot on RHEL7 boxes after a failed pasword+token.




commit 17f4dce44a5f105cb2f7850085d42626e054c224
Author: Patrick Uiterwijk <puiterwijk(a)redhat.com&gt;
Date:   Wed Sep 16 17:57:02 2015 +0000

    Remove the Password: promopt when 2fa failed

diff --git a/files/2fa/sudo.pam b/files/2fa/sudo.pam
index aa59ebf..08f7630 100644
- --- a/files/2fa/sudo.pam
+++ b/files/2fa/sudo.pam
@@ -1,6 +1,6 @@
 #%PAM-1.0
 auth       required     pam_env.so
- -auth       sufficient   pam_url.so config=/etc/pam_url.conf
+auth       requisite    pam_url.so config=/etc/pam_url.conf
 auth       requisite    pam_succeed_if.so uid >= 500 quiet
 auth       required     pam_deny.so
 
diff --git a/roles/totpcgi/files/sudo.pam b/roles/totpcgi/files/sudo.pam
index aa59ebf..08f7630 100644
- --- a/roles/totpcgi/files/sudo.pam
+++ b/roles/totpcgi/files/sudo.pam
@@ -1,6 +1,6 @@
 #%PAM-1.0
 auth       required     pam_env.so
- -auth       sufficient   pam_url.so config=/etc/pam_url.conf
+auth       requisite    pam_url.so config=/etc/pam_url.conf
 auth       requisite    pam_succeed_if.so uid >= 500 quiet
 auth       required     pam_deny.so
 


- -- 
With kind regards,
Patrick Uiterwijk
Fedora Infra
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1
>
> iQIcBAEBCgAGBQJV+a4HAAoJEIZXmA2atR5QNM8P/RtSRb7i8ThDKunZ07MoDOJq
> kQ9uI9l7OUkQmJEywxaMg73GhJdtSj0wYQ2qU+ILm3DAWR4zAOrITdrobdjj/RKm
> 6B7Pnzu6Hjtlqx7mzF6ZpkWzNLhDxSV5iGGSSEsSr9QxDew1FGLBf9Cy7qfL8s6A
> tyYQ5BueUWElPK+N4q9trknbv9PkCnw9mriiAnzQECvKCPcKzNmV1nAwriFu6GA3
> slhAfAnO5VijCv1LdOfftFZmH1c1TdSAZRUta1NYEEyaxuZCLT4YVtyv1SibRI2Q
> zrhbFjgfJzWPMxlREFIXsKiYniBFay2fwmMed+jhimi4XyhlwcFgHXUKQL5ImlEE
> a+UMBW3yNDOPkLbmoKZboP0uH4KxzSh5Lm6UnQ/2X/aKnjylFg6PwsSBlDlbax6x
> 5WN0jjGumrPdc1a1jN8lyG8Efdu/dFc0t14lsOYJUly6MWllq7RpNYLXh6KTwhyX
> hrjiGiDZt3Y4gsO585xN3gSRIY0xqEFG5+B8IfSG0QD1GjGr8TZSJ16IMw6F+46a
> D4JY8XgrR5la/+uISjey+GU2k4MhjP9gyL18dw1oQYX1bWZq2NPerfKvlGuHZz8l
> bI85GObr3pM3Lbv1iyOFWbabZ2xpk0Dsf2ViYLy9zgusumAyhkIy4UMbQVsbMC9d
> f9VLcgTfdjxW14Sx02yw
> =itcm
> -----END PGP SIGNATURE----- 
_______________________________________________
infrastructure mailing list
infrastructure(a)lists.fedoraproject.org
http://lists.fedoraproject.org/postorius/[e-mail]...

[Patrick Uiterwijk]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Corrected patch follows.
With the original one, it would still fall through to system-auth.

This patch removes that.
We don't need the original system-auth anymore, since we already have
pam_env, pam_succeed_if and pam_deny in the sudo pam.


diff --git a/files/2fa/sudo.pam b/files/2fa/sudo.pam
index aa59ebf..356a9db 100644
- --- a/files/2fa/sudo.pam
+++ b/files/2fa/sudo.pam
@@ -1,10 +1,9 @@
 #%PAM-1.0
 auth       required     pam_env.so
- -auth       sufficient   pam_url.so config=/etc/pam_url.conf
+auth       requisite    pam_url.so config=/etc/pam_url.conf
 auth       requisite    pam_succeed_if.so uid >= 500 quiet
 auth       required     pam_deny.so
 
- -auth       include      system-auth
 account    include      system-auth
 password   include      system-auth
 session    optional     pam_keyinit.so revoke
diff --git a/roles/totpcgi/files/sudo.pam b/roles/totpcgi/files/sudo.pam
index aa59ebf..356a9db 100644
- --- a/roles/totpcgi/files/sudo.pam
+++ b/roles/totpcgi/files/sudo.pam
@@ -1,10 +1,9 @@
 #%PAM-1.0
 auth       required     pam_env.so
- -auth       sufficient   pam_url.so config=/etc/pam_url.conf
+auth       requisite    pam_url.so config=/etc/pam_url.conf
 auth       requisite    pam_succeed_if.so uid >= 500 quiet
 auth       required     pam_deny.so
 
- -auth       include      system-auth
 account    include      system-auth
 password   include      system-auth
 session    optional     pam_keyinit.so revoke




On Wed, Sep 16, 2015 at 07:59:35PM +0200, Patrick Uiterwijk wrote:
>  Hi,
>  
>  Post-freeze I would like to merge the following patch, which will remove the
>  Password: promot on RHEL7 boxes after a failed pasword+token.
>  
>  
>  
>  
>  commit 17f4dce44a5f105cb2f7850085d42626e054c224
>  Author: Patrick Uiterwijk <puiterwijk(a)redhat.com&gt;
>  Date:   Wed Sep 16 17:57:02 2015 +0000
>  
>      Remove the Password: promopt when 2fa failed
>  
>  diff --git a/files/2fa/sudo.pam b/files/2fa/sudo.pam
>  index aa59ebf..08f7630 100644
>  --- a/files/2fa/sudo.pam
>  +++ b/files/2fa/sudo.pam
>  @@ -1,6 +1,6 @@
>   #%PAM-1.0
>   auth       required     pam_env.so
>  -auth       sufficient   pam_url.so config=/etc/pam_url.conf
>  +auth       requisite    pam_url.so config=/etc/pam_url.conf
>   auth       requisite    pam_succeed_if.so uid >= 500 quiet
>   auth       required     pam_deny.so
>   
>  diff --git a/roles/totpcgi/files/sudo.pam b/roles/totpcgi/files/sudo.pam
>  index aa59ebf..08f7630 100644
>  --- a/roles/totpcgi/files/sudo.pam
>  +++ b/roles/totpcgi/files/sudo.pam
>  @@ -1,6 +1,6 @@
>   #%PAM-1.0
>   auth       required     pam_env.so
>  -auth       sufficient   pam_url.so config=/etc/pam_url.conf
>  +auth       requisite    pam_url.so config=/etc/pam_url.conf
>   auth       requisite    pam_succeed_if.so uid >= 500 quiet
>   auth       required     pam_deny.so
>   
>  
>  
>  -- 
>  With kind regards,
>  Patrick Uiterwijk
>  Fedora Infra
>  _______________________________________________
>  infrastructure mailing list
>  infrastructure(a)lists.fedoraproject.org
>  http://lists.fedoraproject.org/postorius/[e-mail]... 
- -- 
With kind regards,
Patrick Uiterwijk
Fedora Infra
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1
>
> iQIcBAEBCgAGBQJV+a/DAAoJEIZXmA2atR5QeWcP/0EOvaFVaEHlVYdTvM7emzep
> sAckQ0wsK8nVbu739OEQYJGzt1dNDiUCZISrpsaqxym8CwIfaE8FaFTpcPeGRmez
> 9lJjE0SZehqjEGPGJvIxrkWU434I3HBxwSfyOvVOgKdizwcNH1k9Rx+Y4tEsN5JJ
> TDpc2kH6/0mv4ACt7JxGXNjtwcEInfVBiOHRspdaTyJginB2XLDTF4OH9xMnIDdE
> NR4XySngUcscAZs4/vwb6ahRmv5rOh//72NhwAxVeYyrul6sIxe1NDmDg7/oHUKN
> P08L4usJcDGTc0YUkYb+cChActo9TFGof3sAEF3pMEhkDt/qlE3odnE7z7ScMjrR
> TESWs0kU72+auMuR4GUEFuN2dTRay+9oEHelBmZ3xMZVdG3wemYpVFXlOo1pa4sx
> H1YdNseDUwxcXN7IP5MCXmm6eBOv6YA2z/LYoE+UseZ4TfYFDs5auZPJoDuTnYwe
> 8iC+obcHclQlpQ0WZNWFKzg4PFPD/IhbA6VljFAq+kZ4fYDjTyAiMYoF2eQbr2yq
> 7zZbucCNacaD4Nzi6CPmqT6forteL8OkNZLwYBYaFozjzD1p8E44i1wSsgcKoLaW
> 4Vz/6nMx0iPuOlvThkmC552fZ0hLZkzmgiDkG3Mi8yiXUCG0bcij+HSCVPQHzj33
> JfOCCyOFCFW2e2Oe/H66
> =wsm9
> -----END PGP SIGNATURE----- 
_______________________________________________
infrastructure mailing list
infrastructure(a)lists.fedoraproject.org
http://lists.fedoraproject.org/postorius/[e-mail]...

[Kevin Fenzi]

+1 provided it tests ok in stg. ;) 

kevin

_______________________________________________
infrastructure mailing list
infrastructure(a)lists.fedoraproject.org
http://lists.fedoraproject.org/postorius/[e-mail]...

[Stephen John Smoogen]

Same here.

On 16 September 2015 at 12:10, Kevin Fenzi <kevin(a)scrye.com&gt; wrote:
>  +1 provided it tests ok in stg. ;)
>
>  kevin
>
>  _______________________________________________
>  infrastructure mailing list
>  infrastructure(a)lists.fedoraproject.org
>  http://lists.fedoraproject.org/postorius/[e-mail]...
>  


-- 
Stephen J Smoogen.
_______________________________________________
infrastructure mailing list
infrastructure(a)lists.fedoraproject.org
http://lists.fedoraproject.org/postorius/[e-mail]...