diff --git a/debian/NEWS b/debian/NEWS index 28071546..d25c7ebb 100644 --- a/debian/NEWS +++ b/debian/NEWS @@ -1,3 +1,10 @@ +shadow (1:4.6-1) unstable; urgency=medium + + * /etc/securetty is not shipped and it is honored in login's PAM + configuration anymore by default. Please see #731656 for details. + + -- Balint Reczey Thu, 20 Jun 2019 13:46:52 +0200 + shadow (1:4.0.15-5) unstable; urgency=low * commands passed in argument to su must use su's -c option and must quote diff --git a/debian/login.pam b/debian/login.pam index 07ff9540..3226fe2d 100644 --- a/debian/login.pam +++ b/debian/login.pam @@ -12,25 +12,6 @@ auth optional pam_faildelay.so delay=3000000 # ISSUE_FILE option from login.defs). Uncomment for use # auth required pam_issue.so issue=/etc/issue -# Disallows root logins except on tty's listed in /etc/securetty -# (Replaces the `CONSOLE' setting from login.defs) -# -# With the default control of this module: -# [success=ok new_authtok_reqd=ok ignore=ignore user_unknown=bad default=die] -# root will not be prompted for a password on insecure lines. -# if an invalid username is entered, a password is prompted (but login -# will eventually be rejected) -# -# You can change it to a "requisite" module if you think root may mis-type -# her login and should not be prompted for a password in that case. But -# this will leave the system as vulnerable to user enumeration attacks. -# -# You can change it to a "required" module if you think it permits to -# guess valid user names of your system (invalid user names are considered -# as possibly being root on insecure lines), but root passwords may be -# communicated over insecure lines. -auth [success=ok new_authtok_reqd=ok ignore=ignore user_unknown=bad default=die] pam_securetty.so - # Disallows other than root logins when /etc/nologin exists # (Replaces the `NOLOGINS_FILE' option from login.defs) auth requisite pam_nologin.so diff --git a/debian/rules b/debian/rules index c651b585..c61e6234 100755 --- a/debian/rules +++ b/debian/rules @@ -51,7 +51,6 @@ ifneq ($(DEB_HOST_ARCH_OS),linux) endif dh_installpam -p login install -c -m 444 debian/login.defs debian/login/etc/login.defs - install -c -m 444 debian/securetty.$(DEB_HOST_ARCH_OS) debian/login/etc/securetty dh_lintian -p login binary-install/passwd:: diff --git a/debian/securetty.hurd b/debian/securetty.hurd deleted file mode 100644 index 7b9e4187..00000000 --- a/debian/securetty.hurd +++ /dev/null @@ -1,71 +0,0 @@ -# /etc/securetty: list of terminals on which root is allowed to login. -# See securetty(5) and login(1). -console - -# for people with serial port consoles -com0 - -# Standard consoles -tty1 -tty2 -tty3 -tty4 -tty5 -tty6 -tty7 -tty8 -tty9 -tty10 -tty11 -tty12 -tty13 -tty14 -tty15 -tty16 -tty17 -tty18 -tty19 -tty20 -tty21 -tty22 -tty23 -tty24 -tty25 -tty26 -tty27 -tty28 -tty29 -tty30 -tty31 -tty32 -tty33 -tty34 -tty35 -tty36 -tty37 -tty38 -tty39 -tty40 -tty41 -tty42 -tty43 -tty44 -tty45 -tty46 -tty47 -tty48 -tty49 -tty50 -tty51 -tty52 -tty53 -tty54 -tty55 -tty56 -tty57 -tty58 -tty59 -tty60 -tty61 -tty62 -tty63 diff --git a/debian/securetty.kfreebsd b/debian/securetty.kfreebsd deleted file mode 100644 index 1e35e464..00000000 --- a/debian/securetty.kfreebsd +++ /dev/null @@ -1,24 +0,0 @@ -# /etc/securetty: list of terminals on which root is allowed to login. -# See securetty(5) and login(1). -console - -# for people with serial port consoles -ttyd0 -ttyd1 - -# Standard consoles -ttyv0 -ttyv1 -ttyv2 -ttyv3 -ttyv4 -ttyv5 -ttyv6 -ttyv7 -ttyva -ttyvb -ttyvc -ttyvd -ttyve -ttyvf - diff --git a/debian/securetty.knetbsd b/debian/securetty.knetbsd deleted file mode 100644 index d8fba693..00000000 --- a/debian/securetty.knetbsd +++ /dev/null @@ -1,12 +0,0 @@ -# /etc/securetty: list of terminals on which root is allowed to login. -# See securetty(5) and login(1). -console - -# for people with serial port consoles -tty00 - -# Standard consoles -ttyE0 -ttyE1 -ttyE2 -ttyE3 diff --git a/debian/securetty.linux b/debian/securetty.linux deleted file mode 100644 index 2e346381..00000000 --- a/debian/securetty.linux +++ /dev/null @@ -1,412 +0,0 @@ -# /etc/securetty: list of terminals on which root is allowed to login. -# See securetty(5) and login(1). - -console - -# Local X displays (allows empty passwords with pam_unix's nullok_secure) -:0 -:0.0 -:0.1 -:1 -:1.0 -:1.1 -:2 -:2.0 -:2.1 -:3 -:3.0 -:3.1 -#... - - -# ========================================================== -# -# TTYs sorted by major number according to Documentation/devices.txt -# -# ========================================================== - -# Virtual consoles -tty1 -tty2 -tty3 -tty4 -tty5 -tty6 -tty7 -tty8 -tty9 -tty10 -tty11 -tty12 -tty13 -tty14 -tty15 -tty16 -tty17 -tty18 -tty19 -tty20 -tty21 -tty22 -tty23 -tty24 -tty25 -tty26 -tty27 -tty28 -tty29 -tty30 -tty31 -tty32 -tty33 -tty34 -tty35 -tty36 -tty37 -tty38 -tty39 -tty40 -tty41 -tty42 -tty43 -tty44 -tty45 -tty46 -tty47 -tty48 -tty49 -tty50 -tty51 -tty52 -tty53 -tty54 -tty55 -tty56 -tty57 -tty58 -tty59 -tty60 -tty61 -tty62 -tty63 - -# UART serial ports -ttyS0 -ttyS1 -ttyS2 -ttyS3 -ttyS4 -ttyS5 -#...ttyS191 - -# Serial Mux devices (Linux/PA-RISC only) -ttyB0 -ttyB1 -#... - -# Chase serial card -ttyH0 -ttyH1 -#... - -# Cyclades serial cards -ttyC0 -ttyC1 -#...ttyC31 - -# Digiboard serial cards -ttyD0 -ttyD1 -#... - -# Stallion serial cards -ttyE0 -ttyE1 -#...ttyE255 - -# Specialix serial cards -ttyX0 -ttyX1 -#... - -# Comtrol Rocketport serial cards -ttyR0 -ttyR1 -#... - -# SDL RISCom serial cards -ttyL0 -ttyL1 -#... - -# Hayes ESP serial card -ttyP0 -ttyP1 -#... - -# Computone IntelliPort II serial card -ttyF0 -ttyF1 -#...ttyF255 - -# Specialix IO8+ serial card -ttyW0 -ttyW1 -#... - -# Comtrol VS-1000 serial controller -ttyV0 -ttyV1 -#... - -# ISI serial card -ttyM0 -ttyM1 -#... - -# Technology Concepts serial card -ttyT0 -ttyT1 -#... - -# Specialix RIO serial card -ttySR0 -ttySR1 -#...ttySR511 - -# Chase Research AT/PCI-Fast serial card -ttyCH0 -ttyCH1 -#...ttyCH63 - -# Moxa Intellio serial card -ttyMX0 -ttyMX1 -#...ttyMX127 - -# SmartIO serial card -ttySI0 -ttySI1 -#... - -# USB dongles -ttyUSB0 -ttyUSB1 -ttyUSB2 -#... - -# LinkUp Systems L72xx UARTs -ttyLU0 -ttyLU1 -ttyLU2 -ttyLU3 - -# StrongARM builtin serial ports -ttySA0 -ttySA1 -ttySA2 - -# SCI serial port (SuperH) ports and SC26xx serial ports -ttySC0 -ttySC1 -ttySC2 -ttySC3 -ttySC4 -ttySC5 -ttySC6 -ttySC7 -ttySC8 -ttySC9 - -# ARM "AMBA" serial ports -ttyAM0 -ttyAM1 -ttyAM2 -ttyAM3 -ttyAM4 -ttyAM5 -ttyAM6 -ttyAM7 -ttyAM8 -ttyAM9 -ttyAM10 -ttyAM11 -ttyAM12 -ttyAM13 -ttyAM14 -ttyAM15 - -# Embedded ARM AMBA PL011 ports (e.g. emulated by QEMU) -ttyAMA0 -ttyAMA1 -ttyAMA2 -ttyAMA3 - -# DataBooster serial ports -ttyDB0 -ttyDB1 -ttyDB2 -ttyDB3 -ttyDB4 -ttyDB5 -ttyDB6 -ttyDB7 - -# SGI Altix console ports -ttySG0 - -# Motorola i.MX ports -ttySMX0 -ttySMX1 -ttySMX2 - -# Marvell MPSC ports -ttyMM0 -ttyMM1 - -# PPC CPM (SCC or SMC) ports -ttyCPM0 -ttyCPM1 -ttyCPM2 -ttyCPM3 -ttyCPM4 -ttyCPM5 - -# Altix serial cards -ttyIOC0 -ttyIOC1 -#...ttyIOC31 - -# NEC VR4100 series SIU -ttyVR0 - -# NEC VR4100 series SSIU -ttyVR1 - -# Altix ioc4 serial cards -ttyIOC84 -ttyIOC85 -#...ttyIOC115 - -# Altix ioc3 serial cards -ttySIOC0 -ttySIOC1 -#...ttySIOC31 - -# PPC PSC ports -ttyPSC0 -ttyPSC1 -ttyPSC2 -ttyPSC3 -ttyPSC4 -ttyPSC5 - -# ATMEL serial ports -ttyAT0 -ttyAT1 -#...ttyAT15 - -# Hilscher netX serial port -ttyNX0 -ttyNX1 -#...ttyNX15 - -# Xilinx uartlite - port -ttyUL0 -ttyUL1 -ttyUL2 -ttyUL3 - -# Xen virtual console - port 0 -xvc0 - -# pmac_zilog - port -ttyPZ0 -ttyPZ1 -ttyPZ2 -ttyPZ3 - -# TX39/49 serial port -ttyTX0 -ttyTX1 -ttyTX2 -ttyTX3 -ttyTX4 -ttyTX5 -ttyTX6 -ttyTX7 - -# SC26xx serial ports (see SCI serial ports (SuperH)) - -# MAX3100 serial ports -ttyMAX0 -ttyMAX1 -ttyMAX2 -ttyMAX3 - -# OMAP serial ports -ttyO0 -ttyO1 -ttyO2 -ttyO3 - -# User space serial ports -ttyU0 -ttyU1 - -# A2232 serial card -ttyY0 -ttyY1 - -# IBM 3270 terminal Unix tty access -3270/tty1 -3270/tty2 -#... - -# IBM iSeries/pSeries virtual console -hvc0 -hvc1 -#... -#IBM pSeries console ports -hvsi0 -hvsi1 -hvsi2 - -# Equinox SST multi-port serial boards -ttyEQ0 -ttyEQ1 -#...ttyEQ1027 - -# ========================================================== -# -# Not in Documentation/Devices.txt -# -# ========================================================== - -# Embedded Freescale i.MX ports -ttymxc0 -ttymxc1 -ttymxc2 -ttymxc3 -ttymxc4 -ttymxc5 - -# LXC (Linux Containers) -lxc/console -lxc/tty1 -lxc/tty2 -lxc/tty3 -lxc/tty4 - -# Serial Console for MIPS Swarm -duart0 -duart1 - -# s390 and s390x ports in LPAR mode -ttysclp0 - -# ODROID XU4 serial console -ttySAC0 -ttySAC1 -ttySAC2 -ttySAC3