dropbear and PAM_NEW_AUTHTOK_REQ ?

Joakim Tjernlund Joakim.Tjernlund at infinera.com
Tue Apr 19 18:59:50 AWST 2016


Just had a look at adding support for PAM_NEW_AUTHTOK_REQ in dropbear like so:
--- a/svr-authpam.c
+++ b/svr-authpam.c
-       if ((rc = pam_acct_mgmt(pamHandlep, 0)) != PAM_SUCCESS) {
+       rc = pam_acct_mgmt(pamHandlep, 0);
+       if (rc == PAM_NEW_AUTHTOK_REQD) {
+               rc = pam_chauthtok(pamHandlep, PAM_CHANGE_EXPIRED_AUTHTOK);
+       }
+       if (rc != PAM_SUCCESS) {

This is of course not enough and I wonder if upstream dropbear would be
interested in adding support for PAM_NEW_AUTHTOK_REQ?

 Jocke


More information about the Dropbear mailing list