Re: pam module to set cifs credentials in key store

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Wed, 13 Nov 2013 13:59:33 -0700
Orion Poplawski <orion@xxxxxxxxxxxxx> wrote:

> On 11/12/2013 07:25 PM, Jeff Layton wrote:
> > On Tue, 12 Nov 2013 23:22:57 +0000 (UTC)
> > Orion Poplawski <orion@xxxxxxxxxxxxx> wrote:
> >
> >> Has anyone started work on a pam module to set the cifs keys on login?  Is
> >> this sensible?
> >>
> >> - Orion
> >>
> >
> > Quite sensible. No one is working on it that I know of...
> >
> 
> How does this seem?
> 
> - I pulled a couple shared routines out of cifscreds.c into cifskey.[hc].
> - We build the pam_cifscreds.so directly from all of the source to get -fpic.
> 
> I've tested with:
> 
> /etc/pam.d/login
> #%PAM-1.0
> auth [user_unknown=ignore success=ok ignore=ignore default=bad] pam_securetty.so
> auth       substack     system-auth
> auth       optional     pam_cifscreds.so
> auth       include      postlogin
> account    required     pam_nologin.so
> account    include      system-auth
> password   include      system-auth
> # pam_selinux.so close should be the first session rule
> session    required     pam_selinux.so close
> session    required     pam_loginuid.so
> session    optional     pam_console.so
> # pam_selinux.so open should only be followed by sessions to be executed in 
> the user context
> session    required     pam_selinux.so open
> session    required     pam_namespace.so
> session    optional     pam_keyinit.so force revoke
> session    include      system-auth
> session    optional     pam_cifscreds.so domain=CO-RA
> session    include      postlogin
> -session   optional     pam_ck_connector.so
> 
> and it seems to work.
> 
> I tried putting it into system-auth but no luck.  Not sure what is up there.
> 

Nice! Looks like a good start, but I'm no PAM expert. Maybe we can get
someone else to help review it.

-- 
Jeff Layton <jlayton@xxxxxxxxxx>
--
To unsubscribe from this list: send the line "unsubscribe linux-cifs" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html




[Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux