From mboxrd@z Thu Jan 1 00:00:00 1970
Return-Path: <gentoo-commits+bounces-1217815-garchives=archives.gentoo.org@lists.gentoo.org>
Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
(No client certificate requested)
by finch.gentoo.org (Postfix) with ESMTPS id A789313835A
for <garchives@archives.gentoo.org>; Mon, 26 Oct 2020 22:49:59 +0000 (UTC)
Received: from pigeon.gentoo.org (localhost [127.0.0.1])
by pigeon.gentoo.org (Postfix) with SMTP id A3528E08C3;
Mon, 26 Oct 2020 22:49:58 +0000 (UTC)
Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183])
(using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits))
(No client certificate requested)
by pigeon.gentoo.org (Postfix) with ESMTPS id 8AD62E08C3
for <gentoo-commits@lists.gentoo.org>; Mon, 26 Oct 2020 22:49:58 +0000 (UTC)
Received: from oystercatcher.gentoo.org (unknown [IPv6:2a01:4f8:202:4333:225:90ff:fed9:fc84])
(using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits))
(No client certificate requested)
by smtp.gentoo.org (Postfix) with ESMTPS id 4E18D340D2D
for <gentoo-commits@lists.gentoo.org>; Mon, 26 Oct 2020 22:49:56 +0000 (UTC)
Received: from localhost.localdomain (localhost [IPv6:::1])
by oystercatcher.gentoo.org (Postfix) with ESMTP id C71DD3AB
for <gentoo-commits@lists.gentoo.org>; Mon, 26 Oct 2020 22:49:54 +0000 (UTC)
From: "Sam James" <sam@gentoo.org>
To: gentoo-commits@lists.gentoo.org
Content-Transfer-Encoding: 8bit
Content-type: text/plain; charset=UTF-8
Reply-To: gentoo-dev@lists.gentoo.org, "Sam James" <sam@gentoo.org>
Message-ID: <1603752486.99919c4b2b59af27e7ad1daa6fbe8c614a8463c0.sam@gentoo>
Subject: [gentoo-commits] proj/pambase:master commit in: templates/
X-VCS-Repository: proj/pambase
X-VCS-Files: templates/system-auth.tpl
X-VCS-Directories: templates/
X-VCS-Committer: sam
X-VCS-Committer-Name: Sam James
X-VCS-Revision: 99919c4b2b59af27e7ad1daa6fbe8c614a8463c0
X-VCS-Branch: master
Date: Mon, 26 Oct 2020 22:49:54 +0000 (UTC)
Precedence: bulk
List-Post: <mailto:gentoo-commits@lists.gentoo.org>
List-Help: <mailto:gentoo-commits+help@lists.gentoo.org>
List-Unsubscribe: <mailto:gentoo-commits+unsubscribe@lists.gentoo.org>
List-Subscribe: <mailto:gentoo-commits+subscribe@lists.gentoo.org>
List-Id: Gentoo Linux mail <gentoo-commits.gentoo.org>
X-BeenThere: gentoo-commits@lists.gentoo.org
X-Auto-Response-Suppress: DR, RN, NRN, OOF, AutoReply
X-Archives-Salt: 2e10d5de-d687-4614-9545-6bce4ac35df7
X-Archives-Hash: b81b5f3371a732ad7074da92f4e70807
commit: 99919c4b2b59af27e7ad1daa6fbe8c614a8463c0
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Mon Oct 26 08:32:29 2020 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Mon Oct 26 22:48:06 2020 +0000
URL: https://gitweb.gentoo.org/proj/pambase.git/commit/?id=99919c4b
templates/system-auth.tpl: skip pam_unix with krb5
Before this change, success on pam_krb5 would result in jumping
one line (over pam_permit) back into pam_unix.
Incidentally, we did the later stanza correctly. This was a regression
from old pambase.
Bug: https://bugs.gentoo.org/748405
Signed-off-by: Sam James <sam <AT> gentoo.org>
templates/system-auth.tpl | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/templates/system-auth.tpl b/templates/system-auth.tpl
index 8b61701..668303f 100644
--- a/templates/system-auth.tpl
+++ b/templates/system-auth.tpl
@@ -4,20 +4,20 @@ auth sufficient pam_ssh.so
{% endif %}
{% if krb5 %}
-auth [success=1 default=ignore] pam_krb5.so {{ krb5_params }}
+auth [success=4 default=ignore] pam_krb5.so {{ krb5_params }}
{% endif %}
-auth optional pam_permit.so
auth requisite pam_faillock.so preauth
auth [success=1 default=ignore] pam_unix.so {{ nullok|default('', true) }} {{ debug|default('', true) }} try_first_pass
auth [default=die] pam_faillock.so authfail
+auth optional pam_permit.so
{% if krb5 %}
-account [success=1 default=ignore] pam_krb5.so {{ krb5_params }}
+account [success=2 default=ignore] pam_krb5.so {{ krb5_params }}
{% endif %}
account required pam_unix.so {{ debug|default('', true) }}
-account optional pam_permit.so
account required pam_faillock.so
+account optional pam_permit.so
{% if passwdqc %}
password required pam_passwdqc.so config=/etc/security/passwdqc.conf