diff options
| author | Joseph Reynolds <joseph-reynolds@charter.net> | 2019-12-05 17:53:35 -0600 |
|---|---|---|
| committer | Joseph Reynolds <joseph-reynolds@charter.net> | 2019-12-11 21:00:05 +0000 |
| commit | 96b39e02ba160cda74b70b4cd9bac34c760e1701 (patch) | |
| tree | 5ee68f2c8869c7aaa88de81eb833bbdbecfe1944 | |
| parent | 7166bf0fd7453f2b5d6bfb3afbdad5eb00f74990 (diff) | |
| download | bmcweb-96b39e02ba160cda74b70b4cd9bac34c760e1701.tar.gz bmcweb-96b39e02ba160cda74b70b4cd9bac34c760e1701.zip | |
Change PAM service_name for password changes
BMCWeb was using the "passwd" command PAM configuration settings when changing
the password. This changes it to use PAM service_name="webserver", the same
name it already uses for PAM authentication and account management functions.
Doing so allows the BMC system administrator to provide separate PAM config
files for the "passwd" command and BMCWeb's password changing function, and
for these activities to be correctly identified in the system logs.
Here is a sample incorrect log message (truncated & wrapped):
bmcweb[353]: pam_warn(passwd:chauthtok): function=[pam_sm_chauthtok]
flags=0xc000 service=[passwd] terminal=[<unknown>] user=[testuser]
ruser=[<unknown>] rhost=[<unknown>]
The "service" should be "webserver".
Tested: yes, password change successful
Change-Id: I593f42c8f0494df967fb498fb4dd66fa4168596b
Signed-off-by: Joseph Reynolds <joseph-reynolds@charter.net>
| -rw-r--r-- | include/pam_authenticate.hpp | 2 | ||||
| -rw-r--r-- | pam-webserver | 1 |
2 files changed, 2 insertions, 1 deletions
diff --git a/include/pam_authenticate.hpp b/include/pam_authenticate.hpp index 5d78efc..234246d 100644 --- a/include/pam_authenticate.hpp +++ b/include/pam_authenticate.hpp @@ -93,7 +93,7 @@ inline int pamUpdatePassword(const std::string& username, pamFunctionConversation, const_cast<char*>(password.c_str())}; pam_handle_t* localAuthHandle = nullptr; // this gets set by pam_start - int retval = pam_start("passwd", username.c_str(), &localConversation, + int retval = pam_start("webserver", username.c_str(), &localConversation, &localAuthHandle); if (retval != PAM_SUCCESS) diff --git a/pam-webserver b/pam-webserver index 47e787f..473b922 100644 --- a/pam-webserver +++ b/pam-webserver @@ -2,3 +2,4 @@ auth include common-auth account include common-account +password include common-password |
