pam-mysql-general — A general list for PAM-MYSQL, subscribe if you want to ask anything :)

Re: [Pam-mysql-general] I can't figure out pam_mysql setting.

[Oded A. <ode...@ty...>]

On Wed, 2006-05-31 at 16:04 +0900, shi...@u-... wrote:

> I have successfully installed mysqlclient-*.rpm and pam_mysql-*.rpm on FC3
> and I configured /etc/pam.d/sshd as:
> 
> #auth       sufficient     pam_stack.so service=system-auth
> auth   optional        pam_mysql.so user=root passwd=password
> host=localhost db=vpn table=account usercolumn=user passwdcolumn=password
> auth       required     pam_nologin.so


I think you should have auth as at least sufficient, otherwise anybody
not mentioned in nologin can access the computer. I've set it to
"required".


> but it's not working.

Can't say why, except as above. Need more info.


> I don't get any log in /var/log/messages either.
> Why?

Because that's not where Fedora Core logs authentication and login
messages. try /var/log/secure - that's how it works on FC5. Also check
that the passwords are stored correctly in the database - IIRC if you
don't set "crypt", then the default is plain text passwords - probably
not what you want.

--

Oded

::..
"He was a modest, good-humored boy.  It was Oxford that made him
insufferable."

[Pam-mysql-general] I can't figure out pam_mysql setting.

[<shi...@u-...>]

Hi,

I have successfully installed mysqlclient-*.rpm and pam_mysql-*.rpm on FC=
3
and I configured /etc/pam.d/sshd as:

#auth       sufficient     pam_stack.so service=3Dsystem-auth
auth   optional        pam_mysql.so user=3Droot passwd=3Dpassword
host=3Dlocalhost db=3Dvpn table=3Daccount usercolumn=3Duser passwdcolumn=3D=
password
auth       required     pam_nologin.so
#account    sufficient     pam_stack.so service=3Dsystem-auth
account        required        pam_mysql.so user=3Droot passwd=3Dpassword
host=3Dlocalhost:3306 db=3Dvpn table=3Daccount usercolumn=3Duser
passwdcolumn=3Dpassword verbose=3D1 crypt=3D0
password   required     pam_stack.so service=3Dsystem-auth
session    required     pam_stack.so service=3Dsystem-auth

but it's not working.
I don't get any log in /var/log/messages either.
Why? Please help me!!

Shin



--=20
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

[Pam-mysql-general] try all of it there HYWI.PK see it happen

[Bridgette <kou...@ho...>]

Mutual benefit by reliable stokc information


Get HYWI First Thing on MOnday, This sotck Going To Explode for at least 30%

Check out for Hot News!

Hollywood Inetrmediate, Inc.

Symbol: H Y W I  - H Y W I - H Y W I- H Y W I- H Y W I- H Y W I

Current prise: $1.28 , but will increase at least 30-50 % on Monday!

About the company:

Hollwyood Intemrediate proivdes a porprietary technloogy of Digtial Intemrediate services to feature filmmakers for post-production for film mastering and restoration. This technology gives the filmmakers total creative control over the look of their productions. Whether shooting on film or acquiring in HD or SD video, Hollwyood Intermeidate puts a powerful cluster of digital tools at the director's disposal to achieve stunning results on the big screen. Matchframe Digital Intermediate, a division of Hollwyood Inetrmediate, Inc., packages a full array of post-production services with negative handling expertise and cost-effective 2K digital intermediate and 35mm film out systems. Unbiased stokc strategies and information from experts Radar for helping you make stokc market decisions The Digital Intermediate process eliminates current post-production redundancies by creating a single high-resolution master file from which all versions can be made, including all theatrical and High Definition formats. By creating a single master file with resolution higher than the current High Definition broadcast standards, the DI master file enables cinema and television distributors to extract and archive all current and future cinema and television formats including Digital Cinema, Television and High Definition.Brokerage info and insider data to boost stokc profits Professional stokc advice that drives up the profits

Don't forget to include this sotck to you bag!

Complete stokc research information and recommendations

Read great new on this sotck






Nothing is interesting if you are not interested  God help the poor, for the rich can help themselves  A new broom sweeps clean, but the old brush knows all the corners.  Water that has been begged for does not quench the thirst You cannot sell the cow and sup the milk Never say die 

All work and no play makes Jack a dull boy. Never stand on the tail of a hedgehog after midnight

If you believe everything you read, you better not read Man who wants pretty nurse, must be patient Think Much, Speak Little and Write Less Laughter is the best medicine. Never too old to learn

 Corporations have neither bodies to be punished nor souls to be damned  No pain, no gain  Nothing seems expensive on credit If you get it overnight, you can lose it just as quick  Faint heart never won fair lady Laugh and the whole world laughs with you, cry and.. you have to blow your nose. Go to heaven for the climate and hell for the company 

Re: [Pam-mysql-general] /etc/shadow -> mysql-pam Migration

[Oded A. <ode...@ty...>]

On Sunday, 2 =D7=91April 2006 21:43, Gary W. Smith wrote:
> Bad boy...  But that's about how we had to do it as well.  There is
> still a problem with users that infrequently log into the system.  We
> have some users that have multiple accounts and rarely use their
> secondary accounts (which are critical to their configuration).

Yes, a problem. I will solve this by simply ignoring the problem until=20
someone fails to use their account and call me. I can do this because I=20
have just a few users (or anyway - a few infrequent users), they can=20
easily call me or one of the other admins and nothing on that setup is=20
mission critical (AFAIK).=20
With most other setups, this is probably the wrong approach. I haven't=20
yet disabled old passwords (though I intend to do it soon), so I can't=20
vouch for how well my solution works ;-)

> Something we did for those users that had the problem with messed up
> passwords is to create a web page for them to go to that just
> validates their password.  That is, it would ask them for their login
> and password.=20

This is OK if your users won't mind getting a "please validate your=20
password" notices. Most of my users will freak out if they get=20
something like that - these kind of scams are very frequent on the=20
internet :-(

If its manageable, then I suggest setting up a "change my password" web=20
page which uses PAM (or any other method) to validate the old password=20
and set a new one, and then manually emailing, calling or walking over=20
to each user and ask them to use that - or your standard password=20
change interface - to change the password.

=2D-=20
Oded

::..
"The reasonable man adapts himself to the world; the unreasonable one=20
persists in trying to adapt the world to himself.  Therefore all=20
progress depends on the unreasonable man."
	-- George Bernard Shaw

RE: [Pam-mysql-general] /etc/shadow -> mysql-pam Migration

[Gary W. S. <ga...@pr...>]

Bad boy...  But that's about how we had to do it as well.  There is
still a problem with users that infrequently log into the system.  We
have some users that have multiple accounts and rarely use their
secondary accounts (which are critical to their configuration).

Something we did for those users that had the problem with messed up
passwords is to create a web page for them to go to that just validates
their password.  That is, it would ask them for their login and
password.  It would encrypt their passwords using the different
algorithms, test it against the source and if valid re-encrypt the
password using the new method.  We did this at one site as they have
about 10,000 users that they had infrequent contact with. =20


> -----Original Message-----
> From: pam...@li... [mailto:pam-mysql-
> gen...@li...] On Behalf Of Oded Arbel
> Sent: Sunday, April 02, 2006 9:41 AM
> To: pam...@li...
> Cc: Georg Wicherski; Alexander Schroer
> Subject: Re: [Pam-mysql-general] /etc/shadow -> mysql-pam Migration
>=20
> For extra credit, I hacked pam-mysql to log the logged-in cleartext
> password into a database table, and a scheduled background job uses
the
> clear text to create a new sha1 hashed password - so that over time
all
> the users will migrate to the sha1 storage even if they don't change
> their passwords regularly, and it will allow you to dispose of the
> duplicate auth setup at a later date. On the face of it, not that
> secure, but with proper permissions and frequent runs of the rehasher
> job the risk can be controlled.
>=20

Re: [Pam-mysql-general] /etc/shadow -> mysql-pam Migration

[Oded A. <ode...@ty...>]

On Sunday, 2 =D7=91April 2006 19:59, Georg Wicherski wrote:
> we want to migrate the authentification mechanism in our organization
> from one central /etc/shadow file to pam-mysql. The problem I see
> here is that we use all different kind of hashes mixed in /etc/shadow
> (grown structures and such) ranging from DES to MD5. We would like to
> avoid forcing all users to retype their passwords.
>
> Is it possible to just copy the hash fields from /etc/shadow in the
> respective MySQL columns, set crypt=3DY and continue using it that way?
> How could we then enforce new / changed passwords would use SHA1?

I had a similar problem where I want to migrate from old mysql hashed=20
passwords to new mysql hashed passwords and then to sha1. My solution=20
was to setup, for each pam service, multiple auth handlers (with=20
use_first_pass) where the first auth handler was "required" and all=20
others where "sufficient". I don't know why, but for some reason it=20
works - it tries to auth with each handler and if one succeeds then you=20
can login but if all fail then you are locked out.

You then setup your password changing interface to use only sha1 for=20
setting the passwords - for this I used the pam passwd service which is=20
setup only for sha1.

=46or extra credit, I hacked pam-mysql to log the logged-in cleartext=20
password into a database table, and a scheduled background job uses the=20
clear text to create a new sha1 hashed password - so that over time all=20
the users will migrate to the sha1 storage even if they don't change=20
their passwords regularly, and it will allow you to dispose of the=20
duplicate auth setup at a later date. On the face of it, not that=20
secure, but with proper permissions and frequent runs of the rehasher=20
job the risk can be controlled.

=2D-=20
Oded

::..
"To sit alone with my conscience will be judgment enough for me."=20
	-- Charles William Stubbs

[Pam-mysql-general] /etc/shadow -> mysql-pam Migration

[Georg W. <geo...@pi...>]

Dear List,

we want to migrate the authentification mechanism in our organization
from one central /etc/shadow file to pam-mysql. The problem I see here
is that we use all different kind of hashes mixed in /etc/shadow (grown
structures and such) ranging from DES to MD5. We would like to avoid
forcing all users to retype their passwords.

Is it possible to just copy the hash fields from /etc/shadow in the
respective MySQL columns, set crypt=Y and continue using it that way?
How could we then enforce new / changed passwords would use SHA1?

Sorry if this is documented somewhere, but I found it pretty hard to get
documentation for pam-mysql from the pam-mysl homepage.


Kind Regards,
Georg 'oxff' Wicherski

Re: [Pam-mysql-general] Crypt Question

[<lst...@kw...>]

Zitat von Henri Cook <he...@or...>:

> Hi there,
>
> I've sorted my earlier problem, crypt=1 - DUH!

In only half an hour ...
It took me more than a half day to get it working ;-)

Andi

[Pam-mysql-general] Crypt Question

[Henri C. <he...@or...>]

Hi there,

I've sorted my earlier problem, crypt=3D1 - DUH!

Thanks anyway,

Henri

[Pam-mysql-general] Authentication Issues

[Henri C. <he...@or...>]

Hi there,

I've just started using pam_mysql.so - I'm hoping to authenticate against
a table of usernames and ENCRYPT()'ed passwords, it doesn't seem to be
working at the minute - is there some way to tell pam_mysql that the
passwords are ENCRYPT()'ed?

plaintext passwords are probably being passed to it for comparison

RE: [Pam-mysql-general] problem with pam_mysql and SSH

[Gary W. S. <ga...@pr...>]

Firewall maybe?  What does iptables-save look like?  Did it work before
0.5?  Has it ever worked?

I am using 0.4 on a couple boxes and it seems to be working great for
external authentication for SSH.

Gary Wayne Smith

> -----Original Message-----
> From: pam...@li... [mailto:pam-mysql-
> gen...@li...] On Behalf Of Artin H.
> Sent: Sunday, March 05, 2006 1:24 PM
> To: pam...@li...
> Subject: [Pam-mysql-general] problem with pam_mysql and SSH
>=20
> Hi
>=20
> i was testing pam_mysql for sshd authorizing
>=20
> the problem is when i am connecting TO 127.0.0.1 it working but when
> connecting to other ips( like local network ip 192.168.0.1 ) its not
> working !
>=20
>=20
> see this :
> [root@localhost ~]# ssh google@127.0.0.1
> google@127.0.0.1's password: <-- IT CHECKING PASSWORD FROM MYSQL ITS
> WORKING WITH ANY PROBLEM !
> Last login: Fri Mar 3 12:21:56 2006 from localhost.localdomain
>=20
>=20
>=20
> [root@localhost ~]# ssh google@192.168.0.1
> google@192.168.0.1's password: <-- WITH ANY ENTRY
> Connection closed by 192.168.0.1 < IMMEDIATELY CLOSING CONNECTION !!
> WITHOUT ANY LOG !
>=20
> i dont know why pam_mysql only working for 127.0.0.1 not other ips !
>=20
> OS : Centos 4.2 32bit
> Pam_Mysql : pam_mysql-0.5-0.src.rpm

[Pam-mysql-general] problem with pam_mysql and SSH

[Artin H. <ad...@ar...>]

Hi

i was testing pam_mysql for sshd authorizing

the problem is when i am connecting TO 127.0.0.1 it working but when  
connecting to other ips( like local network ip 192.168.0.1 ) its not  
working !


see this :
[root@localhost ~]# ssh google@127.0.0.1
google@127.0.0.1's password: <-- IT CHECKING PASSWORD FROM MYSQL ITS  
WORKING WITH ANY PROBLEM !
Last login: Fri Mar 3 12:21:56 2006 from localhost.localdomain



[root@localhost ~]# ssh google@192.168.0.1
google@192.168.0.1's password: <-- WITH ANY ENTRY
Connection closed by 192.168.0.1 < IMMEDIATELY CLOSING CONNECTION !!  
WITHOUT ANY LOG !

i dont know why pam_mysql only working for 127.0.0.1 not other ips !

OS : Centos 4.2 32bit
Pam_Mysql : pam_mysql-0.5-0.src.rpm


PAM CONFIGURATION :
*****************************************
#%PAM-1.0

auth required pam_mysql.so user=sony passwd= host=192.168.0.1 db=logindb  
table=main usercolumn=username
passwdcolumn=password crypt=0

account required pam_mysql.so user=sony passwd= host=192.168.0.1  
db=logindb table=main usercolumn=username
passwdcolumn=password crypt=0

#auth required pam_stack.so service=system-auth
auth required pam_nologin.so
#account required pam_stack.so service=system-auth
password required pam_stack.so service=system-auth
session required pam_stack.so service=system-auth
session required pam_loginuid.so
*****************************************



THANKS !!!

Re: [Pam-mysql-general] About NSS

[Oded A. <od...@ge...>]

On Tuesday, 24 =D7=91January 2006 18:38, Gary W. Smith wrote:
> I can't really say it's dead.  I've had 3 emails to/from the author
> in the last week.  For the most part I believe that he mentioned it's
> stable and no need to develop it any more.

Thanks, that's good to know, though I'm not sure what project are we=20
talking about. I was (mistakenly) referring to=20
http://www.nongnu.org/nss-mysql/ which I'm not sure how is related to=20
http://libnss-mysql.sourceforge.net/ which is the project I was looking=20
for, which had a release last september.

I personally don't believe in the "its stable so I didn't have to change=20
anything in the last 3 years" approach - software rot, and especially=20
software that depends on connectivity with other software that=20
advances.

> But what is the specific compile issue you are having?  I'm not
> familiar with Mandriva but I have a SRPM I made for RHEL 4 that is
> working fine.

Some auto-tools bootstrapping issue, which is probably just bad blood=20
between the source RPM I downloaded which was for PLD and Mandriva's=20
RPM conventions. I don't care anymore really, because that was a=20
mistake - I really wanted libnss-mysql.

Thanks.

=2D-=20
Oded

::..
Linux: If you're not careful, you might actually learn something.
	-- Allen Wong

Re: [Pam-mysql-general] About NSS

[Gary W. S. <ga...@pr...>]

I can't really say it's dead.  I've had 3 emails to/from the author in the
last week.  For the most part I believe that he mentioned it's stable and no
need to develop it any more.

But what is the specific compile issue you are having?  I'm not familiar
with Mandriva but I have a SRPM I made for RHEL 4 that is working fine.

Gary Wayne Smith


On 1/24/06 8:34 AM, "Oded Arbel" <od...@ge...> wrote:

> 
> Hi list - a not really pam-mysql question if you please?
> 
> The pam-mysql README specifically mentions nss-mysql, and I've used
> nss-mysql in the past to support nss using the mysql user database, but
> it seems that the nss-mysql project is dead (last update was 2002),
> most distros have dropped what little support they had for it and I
> can't manage to compile it from source RPM on my Mandriva 2006 server.
> 
> Is there any alternative to nss-mysql that I can use instead, and will
> work with pam-mysql ?
> 
> TIA

[Pam-mysql-general] About NSS

[Oded A. <od...@ge...>]

Hi list - a not really pam-mysql question if you please?

The pam-mysql README specifically mentions nss-mysql, and I've used 
nss-mysql in the past to support nss using the mysql user database, but 
it seems that the nss-mysql project is dead (last update was 2002), 
most distros have dropped what little support they had for it and I 
can't manage to compile it from source RPM on my Mandriva 2006 server. 

Is there any alternative to nss-mysql that I can use instead, and will 
work with pam-mysql ?

TIA
-- 
Oded

::..
Reasons to Run Away 25-"You mean to tell me that I just pushed this guy 
off a cliff, jumped off and landed on him impaling him on my sword of 
Soul sucking and he's about to do WHAT???"

RE: [Pam-mysql-general] PAM order question

[Moriyoshi K. <mor...@at...>]

Hi,

> How do I identify what the hostname is in the SQL statement without
> having to custom write a SQL statement for each server?

Then, USER() MySQL function is what you need. Currently pam-mysql
does not provide something like variable substitution in the
parameters.

Moriyoshi

RE: [Pam-mysql-general] PAM order question

[Gary W. S. <ga...@pr...>]

Moriyoshi,=20

Thanks for the information on the config items.  As for the other item,
active server, what I should have said was how can I limit a login to a
certain set of servers.  In LDAP I can enforce host checking to ensure
that the hose they are trying to log into is in the list of authorized
hosts for that user.

I can conceivable create a table for hosts and a table for host users,
populate them the way I want and assign certain servers to certain
users.  But the general question is how would I get the active hostname
into the SQL statement for pam_mysql.

Specifically, how do I use this section of the README file?

table

    The name of table that maps unique login names to the passwords.
    This can be a combination of tables with full JOIN syntax if you
    need more control.  For example:

        [table=3DHost LEFT JOIN HostUser ON HostUser.host_id=3DHost.id \
                    LEFT JOIN User ON HostUser.user_id=3DUser.id]

How do I identify what the hostname is in the SQL statement without
having to custom write a SQL statement for each server?

Gary Smith

> -----Original Message-----
> From: Moriyoshi Koizumi [mailto:mor...@at...]
> Sent: Saturday, January 07, 2006 1:10 AM
> To: Gary W. Smith
> Cc: pam...@li...
> Subject: Re: [Pam-mysql-general] PAM order question
>=20
> I'm not sure about what you meant by the "active server", but probably
> that
> can be achieved by the account management function.
>=20
> To use the function, specify an expression to the "statcolumn"
argument
> that indicates the status of the account with the following bitmasks:
>=20
> - PAM_MYSQL_USER_STAT_EXPIRED (0x0001):
>    Indicates that the account is expired.
>=20
> - PAM_MYSQL_USER_STAT_AUTHTOK_EXPIRED (0x0002):
>    Indicates that the authentication token (password) for the account
>    needs to be updated. The user will be prompted to supply a new
> password
>    by the application that makes use of the PAM facility.
>=20
> example:
>=20
> auth    sufficient  pam_mysql.so [statcolumn=3Dif(exp_time >=3D =
now(),1,0)
> + if(passwd_exp_time >=3D now(),2,0)]
>=20
> Regards,
> Moriyoshi
>=20

Re: [Pam-mysql-general] PAM order question

[Moriyoshi K. <mor...@at...>]

Hello,

On 2006/01/07, at 14:41, Gary W. Smith wrote:

> Can the optional pam line parameters be stored in the conf file?

use_first_pass / try_first_pass cannot be set in the configuration file.

> And the final question is how can I limit the users to only the active 
> server automatically (assuming I create a field in the database and 
> put a proper where clause in)?

I'm not sure about what you meant by the "active server", but probably 
that
can be achieved by the account management function.

To use the function, specify an expression to the "statcolumn" argument
that indicates the status of the account with the following bitmasks:

- PAM_MYSQL_USER_STAT_EXPIRED (0x0001):
   Indicates that the account is expired.

- PAM_MYSQL_USER_STAT_AUTHTOK_EXPIRED (0x0002):
   Indicates that the authentication token (password) for the account
   needs to be updated. The user will be prompted to supply a new 
password
   by the application that makes use of the PAM facility.

example:

auth    sufficient  pam_mysql.so [statcolumn=if(exp_time >= now(),1,0) 
+ if(passwd_exp_time >= now(),2,0)]

Regards,
Moriyoshi

[Pam-mysql-general] PAM order question

[Gary W. S. <ga...@pr...>]

I've trying to get shadow, ldap and mysql working in that order.  So far
I think I have it.  But I was wondering if I can get some comments from
people on the list if this is the best approach or not.  I also has a
question about configuration options.  Can the optional pam line
parameters be stored in the conf file?  And the final question is how
can I limit the users to only the active server automatically (assuming
I create a field in the database and put a proper where clause in)?

Below is the conf and pam setups. =20

-rw-------  1 root root 452 Jan  6 20:41 /etc/pam-mysql.conf

users.host =3D xxx;
users.database =3D xxx;
users.db_user =3D xxx;
users.db_passwd =3D xxx;
users.table =3D user;
users.user_column =3D user.user_name;
users.password_column =3D user.password;
users.status_column =3D user.status;
users.password_crypt =3D false;
users.use_323_password =3D false;
users.use_md5 =3D false;
users.update_table =3D false;
users.where_clause =3D ;
verbose =3D 1;
crypt =3D 2;
use_first_pass =3D true;
try_first_pass =3D false;
debug =3D true;

#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth        required      /lib/security/$ISA/pam_env.so
auth        sufficient    /lib/security/$ISA/pam_unix.so likeauth nullok
auth        sufficient    /lib/security/$ISA/pam_ldap.so use_first_pass
auth        sufficient    /lib/security/$ISA/pam_mysql.so use_first_pass
config_file=3D/etc/pam-mysql.conf
auth        required      /lib/security/$ISA/pam_deny.so

account     required      /lib/security/$ISA/pam_unix.so broken_shadow
account     sufficient    /lib/security/$ISA/pam_succeed_if.so uid < 100
quiet
account     [default=3Dbad success=3Dok user_unknown=3Dignore]
/lib/security/$ISA/pam_ldap.so
account     [default=3Dbad success=3Dok user_unknown=3Dignore]
/lib/security/$ISA/pam_mysql.so debug=3Dtrue
config_file=3D/etc/pam-mysql.conf
account     required      /lib/security/$ISA/pam_permit.so

password    requisite     /lib/security/$ISA/pam_cracklib.so retry=3D3
password    sufficient    /lib/security/$ISA/pam_unix.so nullok
use_authtok md5 shadow
password    sufficient    /lib/security/$ISA/pam_ldap.so use_authtok
password    sufficient    /lib/security/$ISA/pam_mysql.so debug=3Dtrue
use_first_pass config_file=3D/etc/pam-mysql.conf
password    required      /lib/security/$ISA/pam_deny.so

session     required      /lib/security/$ISA/pam_limits.so
session     required      /lib/security/$ISA/pam_unix.so
session     optional      /lib/security/$ISA/pam_ldap.so
session     optional      /lib/security/$ISA/pam_mysql.so
config_file=3D/etc/pam-mysql.conf
session   required   pam_mkhomedir.so   skel=3D/etc/skel   umask=3D0077

Any feedback would be greatly appreciated.

Gary Smith

[Pam-mysql-general] Compiling pam-mysql on Solaris

[<je...@bc...>]

I'm trying to compile the latest release of pam-mysql on a Solaris 9 box,
but I'm having some problems.  The configure script keeps failing with:

configure: error: Cannot find pam headers. Please check if your system is
ready for pam module development

I understand what this means, what I don't know is

1. What pam headers it is looking for?  I've found pam_appl.h and
pam_modules.h on the system, but either those aren't the header files it'=
s
looking for or I'm incorrectly pointing the configure script at their
location.

2. Assuming that additional header files are needed does anybody know
where I can get those for Solaris?  I've scoured the web, but haven't bee=
n
able to find anything.

3. Is it even possible to compile pam-mysql with Solaris's implementation
of pam or do I need to compile Linux-PAM on this box, and if so, will tha=
t
break all of the Solaris pam modules already on the system?

Thanks,

-Jesse

Re: [Pam-mysql-general] Pam-MySQL 0.7pre2 won't find md5.h

[Craig W. <cr...@xe...>]

On 28 Sep 2005, at 17:33, Craig Webster wrote:
>> Try /usr/local and /usr/local/ssl eitherway.
>
> Thanks. Will try these locations tonight when the machine is a little
> quieter.

Okay, I tried these locations. They're just symlinks to the locations  
I tried before and have the same results... any more ideas?



> Is the only indicator of it working with md5.h from OpenSSL the
> lack of error messages in the log file then, or is there another  
> way to
> find out if it's picked up this file?


Yours,
Craig
--
Craig Webster | t: +44 (0)131 516 8595 | e: cr...@xe...
Xeriom.NET    | f: +44 (0)709 287 1902 | w: http://xeriom.net

Re: [Pam-mysql-general] Pam-MySQL 0.7pre2 won't find md5.h

[Moriyoshi K. <mor...@at...>]

On 2005/09/29, at 2:32, Ignacio Vazquez-Abrams wrote:

> On Thu, 2005-09-29 at 02:18 +0900, Moriyoshi Koizumi wrote:
>> On 2005/09/29, at 1:46, Ignacio Vazquez-Abrams wrote:
>>> On Wed, 2005-09-28 at 16:31 +0100, Craig Webster wrote:
>>>> checking if md5.h is derived from Cyrus SASL Version 1... no
>>>> checking for md5.h usability... no
>>>> checking md5.h presence... no
>>>> checking for md5.h... no
>>>
>>> This is *STILL* not fixed?! It was reported in 0.6 by two people
>>> independently 3 months ago and it's still a problem? Why hasn't this
>>> issue been dealt with yet?
>>
>> Because I didn't reproduce the exact problem they were experiencing
>> and I thought the cause would most likely be some oddities in each
>> environment.
>>
>> I've been testing on the 7 major different platforms / distributions
>> (MacOSX, Debian GNU/Linux, Fedora Core, NetBSD, FreeBSD, OpenBSD and
>> Solaris) with different configurations, and they just worked fine.
>
> Did you remember to remove the cyrus-sasl-devel package so that you
> don't get a false negative?

If you don't specify --with-cyrus-sasl, the packages are basically
ignored. The outputs are a bit confusing though.

Moriyoshi

[Pam-mysql-general] [RESEND] [ANNOUNCEMENT] pam-mysql 0.6.2 and 0.7pre3 released (security update)

[Moriyoshi K. <mor...@at...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hello,

The previous mail is accidentially posted to the list with
the wrong mail address I usually use for my work, so I'd like to
send the same again. Please don't reply to the previous one.
Sorry for cluttering.
- -----------------------------------------------------------------------

The PAM-MySQL project has announced the newest versions of the
product are now available for downloads.

The new releases include a couple of crucial security fixes.
Users are strongly encouraged to upgrade to either version immediately.

We apologise for the inconvenience caused by these issues.


Addressed security concerns:

* Possible segmentation fault in the SQL logging facility, which can
cause Denial-of-Service (DoS).

* Flaws in the authentication and authentication token alteration code
   where incorrect treatment of the pointer returned by pam_get_item()
   were spotted. They can most likely induce DoS or possibly lead to
   more severe problems.


Changes:

* Changed handling of the "where" option to not escape meta characters
   (PR #1261484). (0.7pre3)
* Overhauled the SQL logging facility (PR #1256243). (0.6.2, 0.7pre3)
* Added logrhostcolumn (log.rhost_column) option that enables you to log
   the value of the "rhost" item specified by the application. (0.7pre3)
* Fixed possible security flaw (though not considered to be severe). 
(0.7pre3)
* Fixed memory leaks spotted when "config_file" option is used. 
(0.7pre3)
* Fixed try_first_pass behaviour. (0.7pre3)
* Changed option parsing behaviour so "=" following each option name is 
not
   needed. (0.7pre3)

You can download either one from the following URL:

http://prdownloads.sourceforge.net/pam-mysql/pam_mysql-0.6.2.tar.gz
http://prdownloads.sourceforge.net/pam-mysql/pam_mysql-0.7pre3.tar.gz

Regards,
Moriyoshi
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (Darwin)

iD8DBQFDOuOICt6YWtcDG2cRArUDAKCw7LmSwbHlusA1SEGeEzsI7YxM7QCeIHwg
yZP+HmVmCaOCo2H6MUmZpMU=
=Z1td
-----END PGP SIGNATURE-----

[Pam-mysql-general] [ANNOUNCEMENT] pam-mysql 0.6.2 and 0.7pre3 released (security update)

[Moriyoshi K. <mko...@di...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hello,

The PAM-MySQL project has announced the newest versions of the
product are now available for downloads.

The new releases include a couple of crucial security fixes.
Users are strongly encouraged to upgrade to either version immediately.

We apologise for the inconvenience caused by these issues.


Addressed security concerns:

- - Possible segmentation fault in the SQL logging facility, which can
cause Denial-of-Service (DoS).

- - Flaws in the authentication and authentication token alteration code
   where incorrect treatment of the pointer returned by pam_get_item()
   were spotted. They can most likely induce DoS or possibly lead to
   more severe problems.


Changes:

* Changed handling of the "where" option to not escape meta characters
   (PR #1261484). (0.7pre3)
* Overhauled the SQL logging facility (PR #1256243). (0.6.2, 0.7pre3)
* Added logrhostcolumn (log.rhost_column) option that enables you to log
   the value of the "rhost" item specified by the application. (0.7pre3)
* Fixed possible security flaw (though not considered to be severe). 
(0.7pre3)
* Fixed memory leaks spotted when "config_file" option is used. 
(0.7pre3)
* Fixed try_first_pass behaviour. (0.7pre3)
* Changed option parsing behaviour so "=" following each option name is 
not
   needed. (0.7pre3)

You can download either one from the following URL:

http://prdownloads.sourceforge.net/pam-mysql/pam_mysql-0.6.2.tar.gz
http://prdownloads.sourceforge.net/pam-mysql/pam_mysql-0.7pre3.tar.gz

Regards,
Moriyoshi
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (Darwin)

iD8DBQFDOuH3Ct6YWtcDG2cRAgOHAKCUhxMCJib4Fe/L/OkcrYAeuvdE4ACgn8rR
0v6Y2S3v2lOe6RmKZPKARcc=
=vigR
-----END PGP SIGNATURE-----

Re: [Pam-mysql-general] Pam-MySQL 0.7pre2 won't find md5.h

[Ignacio Vazquez-A. <iva...@iv...>]

On Thu, 2005-09-29 at 02:18 +0900, Moriyoshi Koizumi wrote:
> On 2005/09/29, at 1:46, Ignacio Vazquez-Abrams wrote:
> > On Wed, 2005-09-28 at 16:31 +0100, Craig Webster wrote:
> >> checking if md5.h is derived from Cyrus SASL Version 1... no
> >> checking for md5.h usability... no
> >> checking md5.h presence... no
> >> checking for md5.h... no
> >
> > This is *STILL* not fixed?! It was reported in 0.6 by two people
> > independently 3 months ago and it's still a problem? Why hasn't this
> > issue been dealt with yet?
>=20
> Because I didn't reproduce the exact problem they were experiencing
> and I thought the cause would most likely be some oddities in each
> environment.
>=20
> I've been testing on the 7 major different platforms / distributions
> (MacOSX, Debian GNU/Linux, Fedora Core, NetBSD, FreeBSD, OpenBSD and
> Solaris) with different configurations, and they just worked fine.

Did you remember to remove the cyrus-sasl-devel package so that you
don't get a false negative?

--=20
Ignacio Vazquez-Abrams <iva...@iv...>
http://fedora.ivazquez.net/

gpg --keyserver hkp://subkeys.pgp.net --recv-key 38028b72