- (dtucker) [acconfig.h auth-pam.c configure.ac] Set real uid to non-root

   to convince Solaris PAM to honour password complexity rules.  ok djm@

diff --git a/ChangeLog b/ChangeLog
index 665854e755f883885705826d1f0f44e0bbe23d49..32f78b89491070fe910d8d8fd995d8eac59e3325 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,7 @@
+20040816
+ - (dtucker) [acconfig.h auth-pam.c configure.ac] Set real uid to non-root
+   to convince Solaris PAM to honour password complexity rules.  ok djm@
+
 20040815
  - (dtucker) [Makefile.in ssh-keysign.c ssh.c] Use permanently_set_uid() since
    it does the right thing on all platforms.  ok djm@

diff --git a/acconfig.h b/acconfig.h
index 37b8c226158675931e45c243d0fed7d6a433b965..6be585e6652c4b7250d09bbceb26c6850cf069a1 100644 (file)
--- a/acconfig.h
+++ b/acconfig.h
@@ -104,6 +104,9 @@
 /* Work around problematic Linux PAM modules handling of PAM_TTY */
 #undef PAM_TTY_KLUDGE
 
+/* Define if pam_chauthtok wants real uid set to the unpriv'ed user */
+#undef SSHPAM_CHAUTHTOK_NEEDS_RUID
+
 /* Use PIPES instead of a socketpair() */
 #undef USE_PIPES
 

diff --git a/auth-pam.c b/auth-pam.c
index 115ef6ad9f55d912b238107bde2f57af936fc2c9..63908a728a6d3c1ea816b3977baf87b567147355 100644 (file)
--- a/auth-pam.c
+++ b/auth-pam.c
@@ -201,6 +201,31 @@ pam_getenvlist(pam_handle_t *pamh)
 }
 #endif
 
+/*
+ * Some platforms, notably Solaris, do not enforce password complexity
+ * rules during pam_chauthtok() if the real uid of the calling process
+ * is 0, on the assumption that it's being called by "passwd" run by root.
+ * This wraps pam_chauthtok and sets/restore the real uid so PAM will do
+ * the right thing.
+ */
+#ifdef SSHPAM_CHAUTHTOK_NEEDS_RUID
+static int
+sshpam_chauthtok_ruid(pam_handle_t *pamh, int flags)
+{
+       int result;
+
+       if (sshpam_authctxt == NULL)
+               fatal("PAM: sshpam_authctxt not initialized");
+       if (setreuid(sshpam_authctxt->pw->pw_uid, -1) == -1)
+               fatal("%s: setreuid failed: %s", __func__, strerror(errno));
+       result = pam_chauthtok(pamh, flags);
+       if (setreuid(0, -1) == -1)
+               fatal("%s: setreuid failed: %s", __func__, strerror(errno));
+       return result;
+}
+# define pam_chauthtok(a,b)    (sshpam_chauthtok_ruid((a), (b)))
+#endif
+
 void
 sshpam_password_change_required(int reqd)
 {

diff --git a/configure.ac b/configure.ac
index b24f8e90ceb546c84fb42e16f7097c733f585f0b..b1b33fdbf643300355ab22859828982e50134665 100644 (file)
--- a/configure.ac
+++ b/configure.ac
@@ -298,6 +298,7 @@ mips-sony-bsd|mips-sony-newsos4)
        AC_DEFINE(LOGIN_NEEDS_UTMPX)
        AC_DEFINE(LOGIN_NEEDS_TERM)
        AC_DEFINE(PAM_TTY_KLUDGE)
+       AC_DEFINE(SSHPAM_CHAUTHTOK_NEEDS_RUID)
        AC_DEFINE(LOCKED_PASSWD_STRING, "*LK*")
        # Pushing STREAMS modules will cause sshd to acquire a controlling tty.
        AC_DEFINE(SSHD_ACQUIRES_CTTY)