From Darren.Moffat@sun.com Tue Nov 18 04:49:53 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id mAICnqTa023628 for ; Tue, 18 Nov 2008 04:49:52 -0800 (PST) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id mAICno3G015070 for <@sunmail2sca.sfbay.sun.com:PSARC-EXT@sun.com>; Tue, 18 Nov 2008 12:49:51 GMT Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KAJ0070B4Z1N000@brm-avmta-1.central.sun.com> for PSARC-EXT@sun.com (ORCPT PSARC-EXT@sun.com); Tue, 18 Nov 2008 05:49:49 -0700 (MST) Received: from gmp-eb-inf-2.sun.com ([192.18.6.24]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KAJ00GOL4YXROA0@brm-avmta-1.central.sun.com> for PSARC-EXT@sun.com (ORCPT PSARC-EXT@sun.com); Tue, 18 Nov 2008 05:49:45 -0700 (MST) Received: from fe-emea-09.sun.com (gmp-eb-lb-2-fe2.eu.sun.com [192.18.6.11]) by gmp-eb-inf-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id mAICnj22017608 for ; Tue, 18 Nov 2008 12:49:45 +0000 (GMT) Received: from conversion-daemon.fe-emea-09.sun.com by fe-emea-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0KAJ00D011TXJX00@fe-emea-09.sun.com> (original mail from Darren.Moffat@Sun.COM) for PSARC-EXT@sun.com (ORCPT PSARC-EXT@sun.com); Tue, 18 Nov 2008 12:49:44 +0000 (GMT) Received: from [129.156.173.21] by fe-emea-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0KAJ001IJ4YS8740@fe-emea-09.sun.com> for PSARC-EXT@sun.com (ORCPT PSARC-EXT@sun.com); Tue, 18 Nov 2008 12:49:40 +0000 (GMT) Date: Tue, 18 Nov 2008 12:49:40 +0000 From: Darren J Moffat Subject: PSARC/2008/718 pam_list compat mode Sender: Darren.Moffat@sun.com To: PSARC-EXT@sun.com Cc: Milan.Jurik@sun.com Message-id: <4922B9E4.5070708@Sun.COM> MIME-version: 1.0 Content-type: multipart/mixed; boundary="Boundary_(ID_U4eRdic4vyUSV17qBKkrhQ)" X-PMX-Version: 5.4.1.325704 User-Agent: Thunderbird 2.0.0.16 (X11/20080922) Status: RO Content-Length: 9642 This is a multi-part message in MIME format. --Boundary_(ID_U4eRdic4vyUSV17qBKkrhQ) Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT I'm submitting this closed approved automatic case for Milan Jurik. It is a very minor compatible update to the already delivered PSARC 2003/674. Usual protocol applies if someone feels this needs to be a fast-track I'll set a timer. Man page diffs are in the case materials/ directory and attached. -- Darren J Moffat --Boundary_(ID_U4eRdic4vyUSV17qBKkrhQ) Content-type: text/plain; name=pam_list_rfe.txt Content-transfer-encoding: 7BIT Content-disposition: inline; filename=pam_list_rfe.txt Template Version: @(#)onepager.txt 1.35 07/11/07 SMI Copyright 2007 Sun Microsystems 1. Introduction 1.1. Project/Component Working Name: pam_list: support passwd_compat mode style configurations 1.2. Name of Document Author/Supplier: Milan Jurik 1.3. Date of This Document: 11/05/08 1.4. Name of Major Document Customer(s)/Consumer(s): 1.4.1. The PAC or CPT you expect to review your project: Solaris PAC 1.4.2. The ARC(s) you expect to review your project: PSARC 1.4.3. The Director/VP who is "Sponsoring" this project: Chris.Armes@Sun.Com 1.4.4. The name of your business unit: Solaris Revenue Product Engineering 1.5. Email Aliases: 1.5.1. Responsible Manager: Joe.G@Sun.COM 1.5.2. Responsible Engineer: Milan.Jurik@Sun.COM 2. Project Summary 2.1. Project Description: Solaris contains PAM module pam_list which supports several forms of configuration files for account management. The project will improve compatibility with passwd_compat configuration files by adding new mode compat which will emulate the behaviour of nss compat mode. In this mode, local users will be counted as approved by default, the special entries will be evaluated only for non-local users and if there will be no match then user won't be approved. By special entries +/- entries are meant with the same meaning (approved/disapproved) as in other PAM module list modes. 2.2. Risks and Assumptions: None 3. Business Summary 3.1. Problem Area: To simplify migration from passwd_compat mode. 3.2. Market/Requester: Enterprise customers. 3.6. How will you know when you are done?: Proposed feature will be integrated. 4. Technical Description: 4.1. Details: The code needs only small modification to support new option and to react on it as needed. It needs to evaluate local users (those which aren't beginning with + or -) as approved. 4.2. Bug/RFE Number(s): 6682426 pam_list needs support to passwd_compat mode style configurations (+ line and ignoring local users) 4.3. In Scope: Adding compatibility with nss compat mode 4.4. Out of Scope: Obsoleting nss compat mode is out of scope of this RFE as it's largely used by many customers. It's also used for other things, not only account management. E.g. rewrite of some values in remote passwd database. This can't be done in PAM, it's nss_compat backend feature. 4.5. Interfaces: See attached man page changes. Only one new option paramater added to pam_list module. 4.6. Doc Impact: pam_list(5) needs few new sentences to describe new configuration option. 4.7. Admin/Config Impact: Admin can enable it by change in /etc/pam.conf 4.10. Packaging & Delivery: SUNWcsl contains PAM module, no new deliverables added. 4.11. Security Impact: Another possibility how to configure host based account management. 4.12. Dependencies: PSARC 2003/674 5. Reference Documents: N/A 6. Resources and Schedule: 6.1. Projected Availability: December 2008 6.2. Cost of Effort: 1 person/week 6.3. Cost of Capital Resources: N/A 6.4. Product Approval Committee requested information: 6.4.1. Consolidation or Component Name: ON 6.4.3. Type of CPT Review and Approval expected: RFE 6.4.4. Project Boundary Conditions: N/A 6.4.5. Is this a necessary project for OEM agreements: No 6.4.6. Notes: N/A 6.4.7. Target RTI Date/Release: December 2008 6.4.8. Target Code Design Review Date: November 2008 6.4.9. Update approval addition: No 6.5. ARC review type: FastTrack 6.6. ARC Exposure: open --Boundary_(ID_U4eRdic4vyUSV17qBKkrhQ) Content-type: text/plain; name=pam_list.diff.5 Content-transfer-encoding: 7BIT Content-disposition: inline; filename=pam_list.diff.5 --- pam_list.orig.5 Wed Oct 29 12:57:45 2008 +++ pam_list.new.5 Wed Nov 5 17:50:56 2008 @@ -1,198 +1,203 @@ Standards, Environments, and Macros pam_list(5) NAME pam_list - PAM account management module for UNIX SYNOPSIS pam_list.so.1 DESCRIPTION The pam_list module implements pam_sm_acct_mgmt(3PAM), which provides functionality to the PAM account management stack. The module provides functions to validate that the user's account is valid on this host based on a list of users and/or netgroups in the given file. The users and netgroups are separated by newline character. Netgroups are specified with character '@' as prefix before name of netgroup in the list. The maximum line lenght is 1023 characters. The username is the value of PAM_USER. The host is the value of PAM_RHOST or, if PAM_RHOST is not set, the value of the localhost as returned by gethostname(3C) is used. - If neither of the allow or deny options are specified then + If neither of the allow or deny or compat options are specified then the module will look for +/- entries in the local /etc/passwd file. If this style is used, nsswitch.conf(4) must not be configured with compat for the passwd database. If no relevant +/- entry exists for the user, pam_list is not participating in result. + If compat option is specified then the module will look for + +/- entries in the local /etc/passwd file. Other entries in + this file will be counted as + entries. If no relevant entry + exits for the user, pam_list will deny the access. The following options can be passed to the module: allow= The full pathname to a file of allowed users and/or netgroups. Only one of allow= or deny= can be specified. deny= The full pathname to a file of denied users and/or netgroups. Only one of deny= or allow= can be specified. debug Provide syslog(3C) debugging information at the LOG_AUTH | LOG_DEBUG level. user The module should only perform netgroup matches on the username. This is the default option. SunOS 5.11 Last change: 9 Aug 2007 1 Standards, Environments, and Macros pam_list(5) nouser The username should not be used in the netgroup match. host Only the host should be used in netgroup matches. nohost The hostname should not be used in net- group matches. user_host_exact The user and hostname must be in the same netgroup. + compat Activate compat mode ERRORS The following error values are returned: PAM_SERVICE_ERR An invalid set of module options was given in the pam.conf(4) for this module, or the user/netgroup file could not be opened. PAM_BUF_ERR A memory buffer error occurred. PAM_IGNORE The module is ignored, as it is not par- ticipating in the result. PAM_PERM_DENIED The user is not on the allow list or is on the deny list. PAM_SUCCESS The account is valid for use at this time. PAM_USER_UNKNOWN No account is present for the user ATTRIBUTES See attributes(5) for descriptions of the following attri- butes: SunOS 5.11 Last change: 9 Aug 2007 2 Standards, Environments, and Macros pam_list(5) ____________________________________________________________ | ATTRIBUTE TYPE | ATTRIBUTE VALUE | |______________________________|______________________________| | Interface Stability | Committed | |______________________________|______________________________| | MT-Level | MT-Safe with exceptions | |______________________________|______________________________| The interfaces in libpam(3LIB) are MT-Safe only if each thread within the multithreaded application uses its own PAM handle. SEE ALSO pam(3PAM), pam_authenticate(3PAM), pam_sm_acct_mgmt(3PAM), syslog(3C), libpam(3LIB), nsswitch.conf(4), pam.conf(4), attributes(5) SunOS 5.11 Last change: 9 Aug 2007 3 --Boundary_(ID_U4eRdic4vyUSV17qBKkrhQ)-- From carlsonj@phorcys.east.sun.com Tue Nov 18 05:39:32 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id mAIDdVDu024832 for ; Tue, 18 Nov 2008 05:39:31 -0800 (PST) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id mAIDdQ5k016638; Tue, 18 Nov 2008 13:39:30 GMT Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KAJ00C0579TDJ00@brm-avmta-1.central.sun.com>; Tue, 18 Nov 2008 06:39:29 -0700 (MST) Received: from phorcys.east.sun.com ([129.148.174.143]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KAJ00G7X79SROE0@brm-avmta-1.central.sun.com>; Tue, 18 Nov 2008 06:39:29 -0700 (MST) Received: from phorcys.east.sun.com (localhost [127.0.0.1]) by phorcys.east.sun.com (8.14.3+Sun/8.14.3) with ESMTP id mAIDdSjf013276; Tue, 18 Nov 2008 08:39:28 -0500 (EST) Received: (from carlsonj@localhost) by phorcys.east.sun.com (8.14.3+Sun/8.14.3/Submit) id mAIDdS6U013273; Tue, 18 Nov 2008 08:39:28 -0500 (EST) Date: Tue, 18 Nov 2008 08:39:28 -0500 From: James Carlson Subject: Re: PSARC/2008/718 pam_list compat mode In-reply-to: <4922B9E4.5070708@Sun.COM> To: Darren J Moffat Cc: PSARC-EXT@sun.com, Milan.Jurik@sun.com Message-id: <18722.50576.549939.737002@gargle.gargle.HOWL> MIME-version: 1.0 X-Mailer: VM 7.01 under Emacs 21.3.1 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <4922B9E4.5070708@Sun.COM> Status: RO Content-Length: 718 Darren J Moffat writes: > I'm submitting this closed approved automatic case for Milan Jurik. It > is a very minor compatible update to the already delivered PSARC > 2003/674. Usual protocol applies if someone feels this needs to be a > fast-track I'll set a timer. +1 Nit: while you're updating the man page, please have this part translated from Boris Badenoff to English: > If no relevant +/- entry exists for the user, pam_list is > not participating in result. :-/ -- James Carlson, Solaris Networking Sun Microsystems / 35 Network Drive 71.232W Vox +1 781 442 2084 MS UBUR02-212 / Burlington MA 01803-2757 42.496N Fax +1 781 442 1677 From kmcdonald@egenera.com Tue Nov 18 06:11:31 2008 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id mAIEBU3C025854 for ; Tue, 18 Nov 2008 06:11:31 -0800 (PST) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id mAIEBQYA007142; Tue, 18 Nov 2008 22:11:27 +0800 (SGT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KAJ00F078R1JK00@brm-avmta-1.central.sun.com>; Tue, 18 Nov 2008 07:11:25 -0700 (MST) Received: from sca-ea-mail-3.sun.com ([192.18.43.21]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KAJ00ELU8R14I10@brm-avmta-1.central.sun.com>; Tue, 18 Nov 2008 07:11:25 -0700 (MST) Received: from relay22.sun.com (relay22.sun.com [192.12.251.34] (may be forged)) by sca-ea-mail-3.sun.com (8.13.6+Sun/8.12.9) with ESMTP id mAIE430A011192; Tue, 18 Nov 2008 14:11:25 +0000 (GMT) Received: from mms24es.mms.us.syntegra.com ([150.143.232.70] [150.143.232.70]) by relay22i.sun.com with ESMTP id BT-MMP-1398027; Tue, 18 Nov 2008 14:11:24 +0000 (Z) Received: from relay24.sun.com (relay24.sun.com [192.12.251.74]) by mms24es.mms.us.syntegra.com with ESMTP id BT-MMP-7559881; Tue, 18 Nov 2008 14:11:23 +0000 (Z) Received: from webaccess.egenera.com ([63.139.209.15] [63.139.209.15]) by relay24i.sun.com with ESMTP id BT-MMP-39428827; Tue, 18 Nov 2008 14:11:22 +0000 (Z) Received: from [192.168.0.102] ([71.10.244.147]) by webaccess.egenera.com over TLS secured channel with Microsoft SMTPSVC(6.0.3790.3959); Tue, 18 Nov 2008 09:11:20 -0500 Date: Tue, 18 Nov 2008 09:09:58 -0500 From: Kyle McDonald Subject: Re: PSARC/2008/718 pam_list compat mode In-reply-to: <4922B9E4.5070708@Sun.COM> To: Darren J Moffat Cc: PSARC-EXT@sun.com, Milan.Jurik@sun.com Message-id: <4922CCB6.4000900@Egenera.COM> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 X-Brightmail-Tracker: AAAAAA== X-Antispam: No, score=0.0/5.0, scanned in 1.742sec at (localhost [127.0.0.1]) by smf-spamd v1.3.1 - http://smfs.sf.net/ References: <4922B9E4.5070708@Sun.COM> User-Agent: Thunderbird 2.0.0.17 (Windows/20080914) X-OriginalArrivalTime: 18 Nov 2008 14:11:20.0741 (UTC) FILETIME=[87F8C550:01C94987] Status: RO Content-Length: 980 Darren J Moffat wrote: > I'm submitting this closed approved automatic case for Milan Jurik. > It is a very minor compatible update to the already delivered PSARC > 2003/674. Usual protocol applies if someone feels this needs to be a > fast-track I'll set a timer. > > Man page diffs are in the case materials/ directory and attached. > I read the man page, and see netgroups mentioned. netgroups are specifically mentioned as supported by the files pointed to by the allow= and deny= options. It's not clear though, if +@netgroup, and -@netgroup supported in the passwd file? Were they already? My main reason for continuing to use compat mode in nsswitch.conf, is not for +username, or -username. While those are still useful, 99% of the time I use +@netgroup. -Kyle > ------------------------------------------------------------------------ > > _______________________________________________ > opensolaris-arc mailing list > opensolaris-arc@opensolaris.org From Darren.Moffat@sun.com Tue Nov 18 06:15:37 2008 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id mAIEFbmb025892 for ; Tue, 18 Nov 2008 06:15:37 -0800 (PST) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id mAIEFTjH002163 for <@sunmail2sca.sfbay.sun.com:PSARC-EXT@sun.com>; Tue, 18 Nov 2008 06:15:34 -0800 (PST) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KAJ00J018XUY000@nwk-avmta-2.sfbay.sun.com> for PSARC-EXT@sun.com (ORCPT PSARC-EXT@Sun.COM); Tue, 18 Nov 2008 06:15:30 -0800 (PST) Received: from gmp-eb-inf-1.sun.com ([192.18.6.21]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KAJ00B9E8XTW9D0@nwk-avmta-2.sfbay.sun.com> for PSARC-EXT@sun.com (ORCPT PSARC-EXT@Sun.COM); Tue, 18 Nov 2008 06:15:30 -0800 (PST) Received: from fe-emea-10.sun.com (gmp-eb-lb-1-fe3.eu.sun.com [192.18.6.10]) by gmp-eb-inf-1.sun.com (8.13.7+Sun/8.12.9) with ESMTP id mAIEFSt5008640 for ; Tue, 18 Nov 2008 14:15:28 +0000 (GMT) Received: from conversion-daemon.fe-emea-10.sun.com by fe-emea-10.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0KAJ00M0165IAW00@fe-emea-10.sun.com> (original mail from Darren.Moffat@Sun.COM) for PSARC-EXT@Sun.COM (ORCPT PSARC-EXT@Sun.COM); Tue, 18 Nov 2008 14:15:28 +0000 (GMT) Received: from [129.156.173.21] by fe-emea-10.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0KAJ00BHQ8XC9O90@fe-emea-10.sun.com> for PSARC-EXT@Sun.COM (ORCPT PSARC-EXT@Sun.COM); Tue, 18 Nov 2008 14:15:12 +0000 (GMT) Date: Tue, 18 Nov 2008 14:15:12 +0000 From: Darren J Moffat Subject: Re: PSARC/2008/718 pam_list compat mode In-reply-to: <4922CCB6.4000900@Egenera.COM> Sender: Darren.Moffat@sun.com To: Kyle McDonald Cc: PSARC-EXT@sun.com, Milan.Jurik@sun.com Message-id: <4922CDF0.6060707@Sun.COM> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <4922B9E4.5070708@Sun.COM> <4922CCB6.4000900@Egenera.COM> User-Agent: Thunderbird 2.0.0.16 (X11/20080922) Status: RO Content-Length: 1085 Kyle McDonald wrote: > Darren J Moffat wrote: >> I'm submitting this closed approved automatic case for Milan Jurik. >> It is a very minor compatible update to the already delivered PSARC >> 2003/674. Usual protocol applies if someone feels this needs to be a >> fast-track I'll set a timer. >> >> Man page diffs are in the case materials/ directory and attached. >> > I read the man page, and see netgroups mentioned. netgroups are > specifically mentioned as supported by the files pointed to by the > allow= and deny= options. It's not clear though, if +@netgroup, and > -@netgroup supported in the passwd file? > > Were they already? Yes already covered in PSARC/2003/674 ---- BEGIN quote from PSARC/2003/674 ---- Either one of: allow= or deny= can be specified. If neither is specified then the module parses the local /etc/passwd file looking for +/- entries and uses those instead of a separate file. The contents of the file are a list of usernames and/or netgroups, where netgroups begin with the '@' symbol. ---- END quote ---- -- Darren J Moffat