Your message dated Tue, 27 Aug 2013 19:04:17 +0000 with message-id <[email protected]> and subject line Bug#706913: fixed in nss-pam-ldapd 0.9.1-1 has caused the Debian Bug report #706913, regarding nslcd breaks PAM authentication from non-root processes to be marked as done.
This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact [email protected] immediately.) -- 706913: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=706913 Debian Bug Tracking System Contact [email protected] with problems
--- Begin Message ---Package: nslcd Version: 0.8.12-1 Severity: normal nslcd only allows processes with UID==0 (as determined by credentials passed over its UNIX domain socket) to query the shadow database. This check is enforced by lines 449-452 of nslcd/nslcd.c: case NSLCD_ACTION_SHADOW_BYNAME: if (uid==0) (void)nslcd_shadow_byname(fp,session); else log_log(LOG_DEBUG,"denied shadow request by non-root user"); break; case NSLCD_ACTION_SHADOW_ALL: if (uid==0) (void)nslcd_shadow_all(fp,session); else log_log(LOG_DEBUG,"denied shadow request by non-root user"); break; This is a problem because it means non-root processes, in particular processes with GID shadow, are unable to authenticate against LDAP via PAM. Although pam_authenticate() succeeds (since it works by attempting an LDAP bind with the user's password), pam_acct_mgmt(), which needs to consult the shadow database for the password expiration fields, fails. This breaks a popular paradigm in Debian, which is to use a setgid-shadow binary to allow non-root services to authenticate with PAM (since the shadow group has read access to /etc/shadow). For example, the pwauth package installs the pwauth binary setgid-shadow, and ejabberd's README.Debian file advises administrators to use dpkg-statoverride to make ejabberd's epam binary setgid-shadow. (Actually, ejabberd's README.Debian erroneously states that if you're using PAM+LDAP, no elevation of privileges is needed at all.) It's understandable why nslcd would want to restrict access to the shadow database, but in many LDAP environments this is an unnecessary restriction: if the LDAP server doesn't allow the userPassword attribute to be read, any user (root or otherwise) who queries the shadow database would see only '*' for the password hash. This behavior also makes libnss-ldapd inconsistent with libnss-ldap. With libnss-ldap, any user is allowed to query the shadow database (but of course sees only '*' for the password if the LDAP server is properly configured). It would therefore be nice if this restriction were configurable, or if the restriction could be loosened to also permit processes with GID shadow (making it analogous to the permissions on /etc/shadow). Note that the versions of nslcd in squeeze and wheezy are also affected by this.
--- End Message ---
--- Begin Message ---Source: nss-pam-ldapd Source-Version: 0.9.1-1 We believe that the bug you reported is fixed in the latest version of nss-pam-ldapd, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to [email protected], and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Arthur de Jong <[email protected]> (supplier of updated nss-pam-ldapd package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing [email protected]) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Format: 1.8 Date: Tue, 27 Aug 2013 20:00:00 +0200 Source: nss-pam-ldapd Binary: nslcd pynslcd libnss-ldapd libpam-ldapd nslcd-utils Architecture: source i386 all Version: 0.9.1-1 Distribution: experimental Urgency: low Maintainer: Arthur de Jong <[email protected]> Changed-By: Arthur de Jong <[email protected]> Description: libnss-ldapd - NSS module for using LDAP as a naming service libpam-ldapd - PAM module for using LDAP as an authentication service nslcd - daemon for NSS and PAM lookups using LDAP nslcd-utils - utilities for querying LDAP via nslcd pynslcd - daemon for NSS and PAM lookups via LDAP - Python version Closes: 706913 717063 Changes: nss-pam-ldapd (0.9.1-1) experimental; urgency=low . * new upstream release: - rename the nscd_invalidate option to reconnect_invalidate and allow flushing the nfsidmap cache with the new option (perhaps a fix for #500778) - implement an -n switch to not daemonise (by Caleb Callaway) - nslcd will now return partial shadow information to non-root users to avoid authorisation problems with setgid shadow authentication helpers with some PAM stacks (closes: #706913) - nslcd will now retry failing LDAP connections after receiving SIGUSR1 - the code for the nslcd utilities (getent.ldap and chsh.ldap) is now installed in /usr/share/nslcd-utils - improve error and help output of the getent.ldap command - documentation updates - fix for a potential, small memory leak in PAM module regarding temporary saving of old password - a large number of bug fixes and improvements in pynslcd - hide passwords from the pynslcd debug output - support start_tls, pam_password_prohibit_message, nss_min_uid and nss_initgroups_ignoreusers in pynslcd - fix rootpwmodpw handling in pynslcd - complete a basic PAM implementation in pynslcd (some things such as shadow attribute checking remain to be implemented) * drop 02-fix-missing-self.patch which is part of 0.9.1 * install the same documentation in pynslcd as with nslcd * debian/nslcd.config: properly handle preseeding and reading values from the configuration file by forcefully overwriting debconf values from nslcd.conf and not overwriting debconf values when reading other configuration files (closes: #717063) * fix the tests by adding python-daemon and python-ldap to Build-Depends and fixing the permissions of the test configuration file * install an if-up scripts for nslcd that sends SIGUSR1 to the daemon to re-check LDAP server availability Checksums-Sha1: eadec8f7b0eba24372cb61798821075c28f1e90f 1603 nss-pam-ldapd_0.9.1-1.dsc 456fb57bc1860ebd3d4305e0a32df2aaf9d34aff 573640 nss-pam-ldapd_0.9.1.orig.tar.gz e933a6f77b1e8f2b636509b2c32cbe2e94bb05d4 101481 nss-pam-ldapd_0.9.1-1.debian.tar.gz 1bf8e71706befdf372037c0adb5fbc1b0f53b719 169838 nslcd_0.9.1-1_i386.deb e8824402b10e22d14c39cb8517dbfd2af062652c 140250 pynslcd_0.9.1-1_all.deb 8cdc66b24548d52cc7da269cde9c10e293fdf0c3 61654 libnss-ldapd_0.9.1-1_i386.deb db928d4032010e28da33fdd1401d1ac2c6711122 49796 libpam-ldapd_0.9.1-1_i386.deb f56bd14ca46443ea22fa37d0977053e0370c662c 46936 nslcd-utils_0.9.1-1_all.deb Checksums-Sha256: c98a6e962325dfd9cf239f5e871088a76ae554801dd3ec5965414383e82d6cdf 1603 nss-pam-ldapd_0.9.1-1.dsc fd21b0648f6b621ff4869e9e0306722d8fce04313323ab281387dd70302dbd98 573640 nss-pam-ldapd_0.9.1.orig.tar.gz 770ef105fe90caddb0b48b9fa7d653eb1073b9d10cad376c94ca16cc331db7f6 101481 nss-pam-ldapd_0.9.1-1.debian.tar.gz 0a656936c3a514284c892cbc198285436e1868afe52d9dd8179e3a84b95b037d 169838 nslcd_0.9.1-1_i386.deb f37ce93dd64c8e69fc225a5d568f2b9d056c5da9cf578f55100a3379903cfcef 140250 pynslcd_0.9.1-1_all.deb a2bec83ec60dd013eac586e5655dcd71540c35bcdc43cff97574999ece7554ce 61654 libnss-ldapd_0.9.1-1_i386.deb 37a273ca0b2616297b5cfd57570172232cbfc13d1fb10a3782fe801850c2c2dc 49796 libpam-ldapd_0.9.1-1_i386.deb b29727272cac9cbf724833e8c799818f9230cac04dea30e5b0e5e8b533fedb80 46936 nslcd-utils_0.9.1-1_all.deb Files: ab3444507b9fb31e791ec31bd2b944dc 1603 admin extra nss-pam-ldapd_0.9.1-1.dsc b741b93046efabe4db8548955477ce99 573640 admin extra nss-pam-ldapd_0.9.1.orig.tar.gz 27921ed2ad78e670c7305dd74970eecf 101481 admin extra nss-pam-ldapd_0.9.1-1.debian.tar.gz 70cf5b6e7be34d06736575f0f562971b 169838 admin extra nslcd_0.9.1-1_i386.deb c59682b7aa5eb57bc624eb7445b458ee 140250 admin extra pynslcd_0.9.1-1_all.deb b19a2eb66f76af65bd00e7fa7cfda1df 61654 admin extra libnss-ldapd_0.9.1-1_i386.deb ba942a2372039acd36cbc30d5313bb4c 49796 admin extra libpam-ldapd_0.9.1-1_i386.deb 37e9fbb1db7ed53407065ddefd60120d 46936 admin extra nslcd-utils_0.9.1-1_all.deb -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (GNU/Linux) iEYEARECAAYFAlIc7ssACgkQVYan35+NCKdKjACglZibFkzeCEdUiskFeAwpX62c H9wAnAvWvUwJdfadPKBvfyCU+x5ggnmD =ludQ -----END PGP SIGNATURE-----
--- End Message ---
