Re: PAM access policy may be circumvented

[Steve McIntyre]

On Sun, Oct 12, 2003 at 06:18:55PM +0200, Brian Murphy wrote:
>Marc Singer wrote:
>>
>>When the check_pam_password () call fails, CVS will then call
>>check_password ().  check_password () is the non-PAM call to verify a
>>user's identity.  Thus, when PAM fails, CVS does a fall-back to the
>>non-PAM authentication.  My change was simply to #ifndef HAVE_PAM on
>>the check_password () call.
>>
>Sorry, but you must be using another patch than the one in the official 
>cvs  source repository.
>The official 1.11.x branch has no PAM support. The new PAM support in 
>the 1.12 branch was
>written by me and has nothing that looks like the lines above in it. 
>Please check out/download
>the official releases to see for yourself. In fact no official release 
>has been made with PAM
>support as the changes are after the unstable branches' last release.
>
>I know for instance that debian patches CVS for PAM support - perhaps 
>you use debian and
>have looked at their patched source?

That's the problem, yes. Sorry for not jumping in earlier... Marc, I'm
about to upload a new version of the Debian package tonight that
should fix this.

-- 
Steve McIntyre, Cambridge, UK.                                steve@einval.com
Into the distance, a ribbon of black
Stretched to the point of no turning back

signature.asc
Description: Digital signature