Ubuntu
pam package

  1. Bug #1856703
  2. Comment #1

Comment 1 for bug 1856703

Revision history for this message
Balint Reczey (rbalint) wrote :

[ Impact ]

 * In highly unlikely non-default configuration pam_motd may be configured to influence PAM's authentication and reporting PAM_SUCCESS may let users in the system.
 * The fix is returning only PAM_IGNORE and error values.

[ Test Case ]

  * Configure PAM to deny access when pam_motd returns PAM_SUCCESS:
  $ cat /etc/pam.d/login

...
session [success=die ignore=ignore] pam_motd.so motd=/run/motd.dynamic
...

 * Try to log in:
   # login ubuntu

 * Observe being able to log in due to pam_motd not returning PAM_SUCCESS

[Regression Potential]

  * Minimal this is a fix partially reverting the behaviour change that was found undesired in LP: #1855092 . The return value of pam_motd is ignored in real-world configurations, thus it does not matter.