Add 0.0.3 release (11 Sep 2001):

   - make sure we use the DEFAULT_KEYTAB define, since we have it available.
   - add support for min_uid option, submitted by Gordon Tetlow
     <gordont@gnf.org>

diff --git a/CHANGELOG b/CHANGELOG
index 9ce029ec4202ecbb6d3c0099f4a6c055750547fc..684c8a3208d329f0f75a5092d597f64f70337df0 100644 (file)
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,3 +1,8 @@
+version 0.0.3  11 Sep 2001
+   - make sure we use the DEFAULT_KEYTAB define, since we have it available.
+   - add support for min_uid option, submitted by Gordon Tetlow
+     <gordont@gnf.org>
+
 version 0.0.2  26 Apr 2001
    - fix bug in cleanup handling; now that we're passing in the right
      kind of void pointer, we shouldn't be leaving temp files around

diff --git a/README b/README
index ba2f44f45417d5ab074b48ad80962bde6e114976..223415517c2cffd2d4f05af58dda461fb9c79106 100644 (file)
--- a/README
+++ b/README
@@ -16,6 +16,8 @@ The following options are recognized by the module:
 debug                 turn debug logging on
 keytab=<file>         use alternate keytab for authentication
                          (default is /etc/security/pam_krb5.keytab)
+min_uid=<uid>         don't add principals for uid's lower than <uid>.
+                         (default is 100)
 principal=<name>      use the key for <name> instead of the default
                          pam_migrate/<hostname> key
 realm=<REALM>         update the database for a realm other than the

diff --git a/pam_krb5_migrate.c b/pam_krb5_migrate.c
index 6b8118bba69f2486420d49990dd99d862158637e..2c33ec68f808c9f57fea5c80792f3d444e5fb51d 100644 (file)
--- a/pam_krb5_migrate.c
+++ b/pam_krb5_migrate.c
@@ -1,10 +1,10 @@
 /*
    Kerberos 5 migration module
-   Version 0.0.1.
+   Version 0.0.3.
    PAM authentication module to transparently add passwords to a Kerberos 5
    database.
 
-   Copyright (C) Steve Langasek 2000
+   Copyright (C) Steve Langasek 2000-2001
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -33,7 +33,7 @@
 #include "pam_krb5_migrate.h"
 
 #define DEFAULT_KEYTAB "/etc/security/pam_krb5.keytab"
-
+#define MIN_UID 100
 
 /* Cleanup function for pam data. */
 static void _cleanup(pam_handle_t * pamh, void *x, int error_status)
@@ -157,6 +157,8 @@ int pam_sm_authenticate(pam_handle_t *pamh, int flags,
     kadm5_policy_ent_rec defpol;
     long mask = 0;
     void *handle = NULL;
+    uid_t min_uid = MIN_UID;
+    struct passwd *pwent = NULL;
 
 
     /* Get a few bytes so we can pass our return value to pam_sm_setcred(). */
@@ -201,6 +203,8 @@ int pam_sm_authenticate(pam_handle_t *pamh, int flags,
                 retval = PAM_BUF_ERR;
                 goto cleanup;
             }
+        } else if (!strncmp(*argv, "min_uid=", 8)) {
+            min_uid = atoi(*argv+8);
         } else {
             _log_err(LOG_ERR, pamh, "unrecognized option [%s]", *argv);
             retval = PAM_SYSTEM_ERR;
@@ -264,7 +268,7 @@ int pam_sm_authenticate(pam_handle_t *pamh, int flags,
 #ifndef KADMIN_LOCAL
     /* Get default keytab if none was provided. */
     if (!keytab_name) {
-        keytab_name = _xstrdup(pamh, "/etc/security/pam_krb5.keytab");
+        keytab_name = _xstrdup(pamh, DEFAULT_KEYTAB);
         if (keytab_name == NULL) {
             retval = PAM_BUF_ERR;
             goto cleanup;
@@ -311,6 +315,15 @@ int pam_sm_authenticate(pam_handle_t *pamh, int flags,
         _log_err(LOG_DEBUG, pamh, "username [%s] obtained", lname);
     }
 
+    pwent = getpwnam(lname);
+    if (pwent != NULL && pwent->pw_uid < min_uid) {
+       if (debug) {
+           _log_err(LOG_DEBUG, pamh, "username [%s] has uid less than %d, not creating a principal", lname, min_uid);
+       }
+       retval = PAM_IGNORE;
+       goto cleanup;
+    }
+
     name = malloc(strlen(lname) + strlen(def_realm) + 2);
     if (name == NULL) {
         _log_err(LOG_CRIT, pamh, "no memory for principal name");

diff --git a/pam_krb5_migrate.h b/pam_krb5_migrate.h
index a6a01135dbc1c3f2e25d49375c365a067c42eda5..e5b78cd5727a2b300d606f9f50265b6aa5c7f8f1 100644 (file)
--- a/pam_krb5_migrate.h
+++ b/pam_krb5_migrate.h
@@ -1,10 +1,10 @@
 /*
    Kerberos 5 migration module
-   Version 0.0.1.
+   Version 0.0.3.
    PAM authentication module to transparently add passwords to a Kerberos 5
    database.
 
-   Copyright (C) Steve Langasek 2000
+   Copyright (C) Steve Langasek 2000-2001
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -25,7 +25,9 @@
 #define _PAM_KRB5_MIGRATE_H
 
 #include <stdio.h>
+#include <stdlib.h>
 #include <string.h>
+#include <pwd.h>
 #include <krb5.h>
 #include <kadm5/admin.h>