VesperOS/shadow
6
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Revert pam_securetty to "requisite"

Browse Source
This commit is contained in:
bubulle
2010-03-16 06:59:46 +00:00
parent da9a0615de
commit f5e0895b3a
2 changed files with 11 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
debian/changelog
Vendored
+4
View File
@@ -17,6 +17,10 @@ shadow (1:4.1.4.3-1) UNRELEASED; urgency=low
* debian/login.defs: Improve documentation of USERGROUPS_ENAB.
Closes: #572687
* debian/rules: Added DEB_AUTO_UPDATE_LIBTOOL = pre. Closes: #560633
* debian/login.pam: return back to "requisite" for the pam_securetty
PAM module. It's more important to avoid root logins over insecure
terminals than having a very hypothetical attack based on sniffing
incorrect usernames, followed by a brute force attack.
-- Nicolas FRANCOIS (Nekral) <nicolas.francois@centraliens.net> Sun, 24 Jan 2010 18:28:33 +0100
debian/login.pam
Vendored
+7 -5
View File
@@ -14,11 +14,13 @@ auth optional pam_faildelay.so delay=3000000
# Disallows root logins except on tty's listed in /etc/securetty
# (Replaces the `CONSOLE' setting from login.defs)
# Note that it is included as a "required" module. root will be
# prompted for a password on insecure ttys.
# If you change it to a "requisite" module, make sure this does not leak
# user name information.
auth required pam_securetty.so
# Note that it is included as a "requisite" module. No password prompts will
# be displayed if this module fails to avoid having the root password
# transmitted on unsecure ttys.
# You can change it to a "required" module if you think it permits to
# guess valid user names of your system (invalid user names are considered
# as possibly being root).
auth requisite pam_securetty.so
# Disallows other than root logins when /etc/nologin exists
# (Replaces the `NOLOGINS_FILE' option from login.defs)