From 1a58cb23467508001dc179e2eef2d2a53dd54c77 Mon Sep 17 00:00:00 2001 From: nekral-guest Date: Thu, 23 Jul 2009 20:56:32 +0000 Subject: [PATCH] * debian/login.pam: pam_securetty included as a required module instead of requisite to avoid leak of user name information. Closes: #531341 --- debian/changelog | 4 +++- debian/login.pam | 12 +++++------- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/debian/changelog b/debian/changelog index 139a3730..1b70655c 100644 --- a/debian/changelog +++ b/debian/changelog @@ -15,8 +15,10 @@ shadow (1:4.1.4.2-1) unstable; urgency=low for regular expressions. Closes: #534244 * debian/patches/506_relaxed_usernames: Fixed typo. groupadd(8) should document the restriction on groupnames, not usernames. + * debian/login.pam: pam_securetty included as a required module instead of + requisite to avoid leak of user name information. Closes: #531341 - -- Nicolas FRANCOIS (Nekral) Sat, 18 Jul 2009 19:20:30 +0200 + -- Nicolas FRANCOIS (Nekral) Thu, 23 Jul 2009 22:55:12 +0200 shadow (1:4.1.4.1-1) unstable; urgency=low diff --git a/debian/login.pam b/debian/login.pam index 33e48a76..65f07d8c 100644 --- a/debian/login.pam +++ b/debian/login.pam @@ -14,13 +14,11 @@ auth optional pam_faildelay.so delay=3000000 # Disallows root logins except on tty's listed in /etc/securetty # (Replaces the `CONSOLE' setting from login.defs) -# Note that it is included as a "requisite" module. No password prompts will -# be displayed if this module fails to avoid having the root password -# transmitted on unsecure ttys. -# You can change it to a "required" module if you think it permits to -# guess valid user names of your system (invalid user names are considered -# as possibly being root). -auth requisite pam_securetty.so +# Note that it is included as a "required" module. root will be +# prompted for a password on insecure ttys. +# If you change it to a "requisite" module, make sure this does not leak +# user name information. +auth required pam_securetty.so # Disallows other than root logins when /etc/nologin exists # (Replaces the `NOLOGINS_FILE' option from login.defs)