2:02 p.m.
Hi,
this one should fix #223. Because sshd runs as root the old password was
not sent to sssd and changing the user password failed. Please review
carefully.
bye,
Sumit
3:29 p.m.
New subject: [PATCH] use old password if available during password change
On Fri, 2009-10-09 at 21:02 +0200, Sumit Bose wrote:
Hi,
this one should fix #223. Because sshd runs as root the old password
was
not sent to sssd and changing the user password failed. Please review
carefully.
I guess the problem here is to understand what do current pam modules,
when used through the proxy backend, expect.
Do they skip checks or ignore if the provided password is valid or not ?
Should we think of forking a child in proxy and running it as the user
that is attempting the password change? (Assuming we know it ?)
Otherwise the patch looks sane to me, so I'd give a tentative ack.
Simo.
7:49 a.m.
New subject: [PATCH] use old password if available during password change
On Fri, Oct 09, 2009 at 04:29:42PM -0400, Simo Sorce wrote:
On Fri, 2009-10-09 at 21:02 +0200, Sumit Bose wrote:
> Hi,
>
> this one should fix #223. Because sshd runs as root the old password
> was
> not sent to sssd and changing the user password failed. Please review
> carefully.
I guess the problem here is to understand what do current pam modules,
when used through the proxy backend, expect.
The current pam modules do not expect anything here, because they will
handle expired passowrd during pam_acct_mgmt and not during
pam_authenticate.
Do they skip checks or ignore if the provided password is valid or
not ?
Should we think of forking a child in proxy and running it as the user
that is attempting the password change? (Assuming we know it ?)
I think forking isn't needed here, because pam_sss should be kept
simple. Send everything you know to sssd and wait for a response.
bye,
Sumit
Otherwise the patch looks sane to me, so I'd give a tentative ack.
Simo.
_______________________________________________
sssd-devel mailing list
sssd-devel(a)lists.fedorahosted.org
https://fedorahosted.org/mailman/listinfo/sssd-devel
7:59 a.m.
On Mon, 2009-10-12 at 14:49 +0200, Sumit Bose wrote:
> Do they skip checks or ignore if the provided password is valid
or
not ?
> Should we think of forking a child in proxy and running it as the
user
> that is attempting the password change? (Assuming we know it ?)
I think forking isn't needed here, because pam_sss should be kept
simple. Send everything you know to sssd and wait for a response.
I meant forking in the proxy module, not in pam_sss, you can't fork in
pam_sss.
Simo.
--
Simo Sorce * Red Hat, Inc * New York
5316
days inactive
5321
days old
sssd-devel@lists.fedorahosted.org
4 comments
2 participants
participants (2)
-
Simo Sorce -
Sumit Bose