Group :: System/Base
RPM: pam_krb5
Navigation
Main Changelog Spec Patches Sources Download Gear Bugs and FR Repocop
30 october 2006 Michail Yakushin <silicium at altlinux.ru> 2.2.9-alt1
- package from fc5
- return PAM_IGNORE instead of PAM_SERVICE_ERR when we're called in
an unsafe situation and told to refresh credentials (#197428) - drop from setuid to "normal" before calling our storetmp helper, so that
it doesn't freak out except when *it* is setuid (#190159) - fix handling of "external" cases where the forwarded creds don't belong to
the principal name we guessed for the user (#182239,#197660)
- rebuild
- rebuild
- don't try to validate creds in a password-changing situation, because the
attempt will always fail unless the matching key is in the keytab, which
should never be the case for the password-changing service (#187303, rbasch) - if v4 has been disabled completely, go ahead and try to set 2b tokens
because we're going to end up having to do that anyway (#182378)
- fixup man page conflicts in %install
- don't use paths in man pages - avoids multilib conflicts
- add v4 credential conversion for "use_shmem" and "external" cases (though
it should be redundant with "use_shmem") (#182239)
- rebuild
- add a "krb4_use_as_req" option so that obtaining v4 creds kinit-style can
be disabled completely (Hugo Meiland)
- don't log debug messages that we're skipping session setup/teardown unless
debugging is enabled (#179037) - try to build the module with -Bsymbolic if we can figure out how to do that
- include the NEWS file as documentation
- fix reporting of the exact reason why a password change failed
- fix a compile problem caused by a missing #include (Jesse Keating)
- rebuilt
- don't leak the keytab descriptor during validation (#173681)
- update to 2.2.1
- rebuild
- update to 2.2.0
- update to 2.1.95
- update to 2.1.2
- update to 2.1.1
- update to 2.1.0
- update to 2.0.11
- update to 2.0.9
- update to 2.0.8
- update to 2.0.10
- update to 2.0.7
- update to 2.0.6
- rebuilt
- actually changelog the update to 2.0.5
- update to 2.0.5
- update to 2.0.4
- update to 2.0.3
- update to 2.0.2
- update to 2.0.1
- update to 2.0
- fix uninitialized pointer crash reading cached return values
- fix crash with per-user stashes and return values
- fix configure to not link with both libk5crypto and libcrypto
- force -fPIC
- add --with-moduledir, --with-krb5-libs, --with-krbafs-libs to configure
- add per-user stashes and return values
- guess a default cell name
- fix what's hopefully the last parser bug
- rebuild in new environment
- handle account management for expired accounts correctly
- reorder configuration checks so that setting afs_cells will properly
force krb4_convert on
- fix what's hopefully the last parser bug
- apply patch from David Howells to add retain_tokens option
- fix what's hopefully the last parser bug
- rebuild
- rebuild in new environment
- documentation updates (no code changes)
- set PAM_USER using the user's parsed name, converted back to a local name
- add account management service (checks for key expiration and krb5_kuserok())
- handle account expiration errors
- autoconf fixes
- bump release number and rebuild to link with new version of krbafs
- fix parsing of options which have multiple whitespace-separated values,
like afs_cells
- link with libresolv to get res_search, tip from Justin McNutt, who
built it statically - explicitly link with libdes425
- handle cases where getpwnam_r fails but still sets the result pointer
- if use_authtok is given and there is no authtok, error out
- set the default realm when a default realm is specified
- only use Kerberos error codes when there is no PAM error yet
- add minimum UID support (#52358)
- don't link pam_krb5 with libkrbafs
- make all options in krb5.conf available as PAM config arguments
- merge patch from Chris Chiappa for building with Heimdal
- note that we had to prepend the current directory to a given path in
dlopen.c when we had to (noted by Onime Clement)
- return PAM_NEW_AUTHTOK_REQD when attempts to get initial credentials
fail with KRB5KDC_ERR_KEY_EXP (noted by Onime Clement)
- add info about accessing the CVS repository to the README
- parser cleanups (thanks to Dane Skow for a more complicated sample)
- buildprereq the krbafs-devel package
- don't set forwardable and assorted other flags when getting password-
changing service ticket (noted, and fix supplied, by Onime Clement) - try __posix_getpwnam_r on Solaris before we try getpwnam_r, which may
or may not be expecting the same number/type of arguments (noted by
Onime Clement) - use krb5_aname_to_localname to convert the principal to a login name
and set PAM_USER to the result when authenticating - some autoconf fixes for failure cases
- use krb5_change_password() to change passwords
- use getpwnam_r instead of getpwnam when available
- cleanup some autoconf checks
- don't call initialize_krb5_error_table() or initialize_ovk_error_table()
if they're not found at compile-time (reported for RHL 6.x by Chris Riley)
- note that [pam] is still checked in addition to [appdefaults]
- note that AFS and Kerberos IV support requires working Kerberos IV
configuration files (i.e., kinit -4 needs to work) (doc changes
suggested by Martin Schulz)
- add max_timeout, timeout_shift, initial_timeout, and addressless options
(patches from Simon Wilkinson) - fix the README to document the [appdefaults] section instead of [pam]
- change example host and cell names in the README to use example domains
- don't delete tokens unless we're also removing ticket files (report and
patch from Sean Dilda) - report initialization errors better
- treat semicolons as a comment character, like hash marks (bug reported by
Greg Francis at Gonzaga University) - use the [:blank:] equivalence class to simplify the configuration file parser
- don't mess with the real environment
- implement mostly-complete aging support
- tweak the man page (can't use italics and bold simultaneously)
- restore the default TGS value (#35015)
- fix a debug message
- fix uninitialized pointer error
- don't fail to fixup the krb5 ccache if something goes wrong obtaining
v4 credentials or creating a krb4 ticket file (#33262)
- fixup the man page
- log return code from k_setpag() when debugging
- create credentials and get tokens when setcred is called for REINITIALIZE
- don't twiddle ownerships until after we get AFS tokens
- use the current time instead of the issue time when storing v4 creds, since
we don't know the issuing host's byte order - depend on a PAM development header again instead of pam-devel
- add a separate config file parser for compatibility with settings that
predate the appdefault API - use a version script under Linux to avoid polluting the global namespace
- don't have a default for afs_cells
- need to close the file when we succeed in fixing permissions (noted by
jlkatz@eos.ncsu.edu)
- use the appdefault API to read krb5.conf if available
- create v4 tickets in such a way as to allow 1.2.2 to not think there's
something fishy going on
- don't log unknown user names to syslog -- they might be sensitive information
- handle cases where krb5_init_context() fails
- be more careful around memory allocation (fixes from David J. MacKenzie)
- no fair trying to make me authenticate '(null)'
- rebuild in new environment
- rebuild in new environment
- only try to delete ccache files once
- ignore extra data in v4 TGTs, but log that we got some
- require "validate" to be true to try validating, and fail if validation fails
- catch and ignore errors reading keys from the keytab (for xscreensaver, vlock)
- fix prompting when the module's first in the stack and the user does not have
a corresponding principal in the local realm - properly implement TGT validation
- change a few non-error status messages into debugging messages
- sync the README and the various man pages up
- fix "use_authtok" logic when password was not set by previous module
- require pam-devel to build
- fix errors with multiple addresses (#16847)
- change summary
- fix handling of null passwords
- fixes for Solaris 7 from Trevor Schroeder
- add Seth Vidal's no_user_check flag
- document no_user_check and skip_first_pass options in the man pages
- rebuild against Kerberos 5 1.2 (release 15)
- move man pages to /usr/share/man
- Make errors chown()ing ccache files non-fatal if (getuid() != 0), suggested
by Steve Langasek.
- Attempt to get initial Kerberos IV credentials when we get Kerberos 5 creds
- Chris Chiappa's modifications for customizing the ccache directory
- Mark Dawson's fix for krb4_convert not being forced on when afs_cells defined
- fix problem with leftover ticket files after multiple setcred() calls
- add proper copyright statements
- save password for modules later in the stack
- clean up prompter
- add krbafs as a requirement
- pick up non-afs PAM config files again
- autoconf and putenv() fixes for broken apps
- fix for compressed man pages
- tweak passwd, su, and vlock configuration files
- added both modules to spec file
- adapted the original spec file from pam_ldap