"Andrey A. Chernov" <[EMAIL PROTECTED]> writes:
> Yes. And to allow PAM stack to make right decision, pam_opie pass special
> information to PAM stack. Look at the patch, pam_opie not breaks from the
> stack by yourself, it is /etc/pam* do that using information from
> pam_opie.

What I can't understand is why OPIE is making that decision in the
first place.  The only answer I can think of is that it was written
before the advent of PAM, and tries to be a poor man's PAM.  That is
not its place.

In any case, if I understand what you're trying to do, it can be done
by returning PAM_SUCCESS if OPIE authentication succeeded, PAM_IGNORE
if it failed but Unix authentication is still allowed, and
PAM_AUTH_ERR if OPIE failed and Unix authentication is *not* allowed.
In that case, if you mark pam_opie "sufficient", pam_unix will run
only if OPIE authentication failed but allowed Unix authentication to

Dag-Erling Smorgrav - [EMAIL PROTECTED]

To Unsubscribe: send mail to [EMAIL PROTECTED]
with "unsubscribe freebsd-current" in the body of the message

Reply via email to