bin/89770: pam_krb5 'authentication token failure' in passwd and a
patch for it
Toby Karyadi
toby at simplecubes.com
Wed Nov 30 19:20:22 GMT 2005
>Number: 89770
>Category: bin
>Synopsis: pam_krb5 'authentication token failure' in passwd and a patch for it
>Confidential: no
>Severity: non-critical
>Priority: medium
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Wed Nov 30 19:20:02 GMT 2005
>Closed-Date:
>Last-Modified:
>Originator: Toby Karyadi
>Release: 6.0-RELEASE
>Organization:
>Environment:
FreeBSD myhost 6.0-RELEASE FreeBSD 6.0-RELEASE #0: Thu Nov 3 09:36:13 UTC 2005
root at x64.samsco.home:/usr/obj/usr/src/sys/GENERIC i386
>Description:
/usr/bin/passwd spits out the following error message:
myhost% passwd
Changing local password for moi
Old password:
passwd: pam_chauthtok(): authentication token failure
This only happens when the pam configuration is specified to use pam_krb5.so, for example like in the following /etc/pam.d/passwd file:
#
# PAM configuration for the "passwd" service
#
# passwd(1) does not use the auth, account or session services.
# password
password required pam_unix.so no_warn try_first_pass
password required pam_krb5.so try_first_pass
>How-To-Repeat:
Please read problem description for repro steps. Note, I assume that kerberos, (Heimdal, to be specific) has been setup properly, i.e. all of the k* tools works right and that kdc, kadmindd, kpasswdd all are up and running.
>Fix:
The problem is because the function pam_sm_chauthtok() in src/lib/libpam/modules/pam_krb5/pam_krb5.c does not handle the case where the PAM_PRELIM_CHECK is set. In comparison, pam_unix.c handles it by asking for the old password and return PAM_SUCCESS only if the old password is correct. The fix is simply to return PAM_SUCCESS when the PAM_PRELIM_CHECK is set above the code that checks if the PAM_UPDATE_AUTHTOK is set.
Also look at src/contrib/openpam/lib/pam_chauthtok.c to see the calling sequence into pam_sm_chauthtok() of the pam modules.
Below is the patch.
For those who're not familier with patching (otherwise skip this section):
1. Copy the text from --- until the end of this message into a file, call it pam_krb5.c.patch
2. Put the file in /usr/src/lib/libpam/modules/pam_krb5/ and cd into that dir.
3. yourhost% patch < pam_krb5.c.patch
4. make clean
5. make
6. make install
Enjoy,
Toby
--- pam_krb5.c.orig Thu Jul 7 14:16:38 2005
+++ pam_krb5.c Tue Nov 29 16:12:41 2005
@@ -666,6 +666,9 @@
const void *user;
char *princ_name, *passdup;
+ if (flags & PAM_PRELIM_CHECK)
+ return PAM_SUCCESS;
+
if (!(flags & PAM_UPDATE_AUTHTOK))
return (PAM_AUTHTOK_ERR);
>Release-Note:
>Audit-Trail:
>Unformatted:
More information about the freebsd-bugs
mailing list