- (stevesk) ~/.hushlogin shouldn't cause required password change to

    be bypassed.

diff --git a/ChangeLog b/ChangeLog
index e8b64b6e7080e506cb8db7abbb164d97ae9a91ae..561d4d07686194f2541e34bdac55a868adf6d703 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -83,6 +83,8 @@
  - (stevesk) Include config.h in rijndael.c so we define intXX_t and
    u_intXX_t types on all platforms.
  - (stevesk) rijndael.c: cleanup missing declaration warnings.
+ - (stevesk) ~/.hushlogin shouldn't cause required password change to
+   be bypassed.
 
 20001007
  - (stevesk) Print PAM return value in PAM log messages to aid

diff --git a/auth-pam.c b/auth-pam.c
index 99eab1e396520a0ad2216ec4099e61ea7b75f93f..4b772c9cdff7e1a1aebf1ea30a2b5380071e6a93 100644 (file)
--- a/auth-pam.c
+++ b/auth-pam.c
@@ -261,6 +261,12 @@ void do_pam_setcred()
        }
 }
 
+/* accessor function for file scope static variable */
+int pam_password_change_required(void)
+{
+       return password_change_required;
+}
+
 /* 
  * Have user change authentication token if pam_acct_mgmt() indicated
  * it was expired.  This needs to be called after an interactive

diff --git a/auth-pam.h b/auth-pam.h
index f537fe7ba27016467728608f1589e1b4ec0a8703..7f230463610f203e6ad2e6bfbf4f8a5fc2757a27 100644 (file)
--- a/auth-pam.h
+++ b/auth-pam.h
@@ -11,6 +11,7 @@ int do_pam_account(char *username, char *remote_user);
 void do_pam_session(char *username, const char *ttyname);
 void do_pam_setcred();
 void print_pam_messages(void);
+int pam_password_change_required(void);
 void do_pam_chauthtok();
 
 #endif /* USE_PAM */

diff --git a/session.c b/session.c
index dacb6a099db4d278776feaad665ea5ab6f0c5501..fc56c273244b32b3e40be7a4274f1be47eb7c3ea 100644 (file)
--- a/session.c
+++ b/session.c
@@ -720,6 +720,17 @@ do_login(Session *s)
        record_login(pid, s->tty, pw->pw_name, pw->pw_uid,
            get_remote_name_or_ip(), (struct sockaddr *)&from);
 
+#ifdef USE_PAM
+       /*
+        * If password change is needed, do it now.
+        * This needs to occur before the ~/.hushlogin check.
+        */
+       if (pam_password_change_required()) {
+               print_pam_messages();
+               do_pam_chauthtok();
+       }
+#endif
+
        /* Done if .hushlogin exists. */
        snprintf(buf, sizeof(buf), "%.200s/.hushlogin", pw->pw_dir);
 #ifdef HAVE_LOGIN_CAP
@@ -730,9 +741,8 @@ do_login(Session *s)
                return;
 
 #ifdef USE_PAM
-       print_pam_messages();
-       /* If password change is needed, do it now. */
-       do_pam_chauthtok();
+       if (!pam_password_change_required())
+               print_pam_messages();
 #endif /* USE_PAM */
 #ifdef WITH_AIXAUTHENTICATE
        if (aixloginmsg && *aixloginmsg)