From nobody@FreeBSD.org  Wed Nov 30 19:15:31 2005
Return-Path: <nobody@FreeBSD.org>
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 5499E16A41F
	for <freebsd-gnats-submit@FreeBSD.org>; Wed, 30 Nov 2005 19:15:31 +0000 (GMT)
	(envelope-from nobody@FreeBSD.org)
Received: from www.freebsd.org (www.freebsd.org [216.136.204.117])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 0182343D5C
	for <freebsd-gnats-submit@FreeBSD.org>; Wed, 30 Nov 2005 19:15:31 +0000 (GMT)
	(envelope-from nobody@FreeBSD.org)
Received: from www.freebsd.org (localhost [127.0.0.1])
	by www.freebsd.org (8.13.1/8.13.1) with ESMTP id jAUJFUgt081688
	for <freebsd-gnats-submit@FreeBSD.org>; Wed, 30 Nov 2005 19:15:30 GMT
	(envelope-from nobody@www.freebsd.org)
Received: (from nobody@localhost)
	by www.freebsd.org (8.13.1/8.13.1/Submit) id jAUJFUw2081687;
	Wed, 30 Nov 2005 19:15:30 GMT
	(envelope-from nobody)
Message-Id: <200511301915.jAUJFUw2081687@www.freebsd.org>
Date: Wed, 30 Nov 2005 19:15:30 GMT
From: Toby Karyadi <toby@simplecubes.com>
To: freebsd-gnats-submit@FreeBSD.org
Subject: pam_krb5 'authentication token failure' in passwd and a patch for it
X-Send-Pr-Version: www-2.3

>Number:         89770
>Category:       bin
>Synopsis:       [patch] pam_krb5 'authentication token failure' in passwd
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    des
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Wed Nov 30 19:20:02 GMT 2005
>Closed-Date:    
>Last-Modified:  Wed Nov 30 22:46:01 GMT 2005
>Originator:     Toby Karyadi
>Release:        6.0-RELEASE
>Organization:
>Environment:
FreeBSD myhost 6.0-RELEASE FreeBSD 6.0-RELEASE #0: Thu Nov  3 09:36:13 UTC 2005
     root@x64.samsco.home:/usr/obj/usr/src/sys/GENERIC  i386              
>Description:
/usr/bin/passwd spits out the following error message:

myhost% passwd
Changing local password for moi
Old password: 
passwd: pam_chauthtok(): authentication token failure

This only happens when the pam configuration is specified to use pam_krb5.so, for example like in the following /etc/pam.d/passwd file:

#
# PAM configuration for the "passwd" service
#

# passwd(1) does not use the auth, account or session services.

# password
password        required        pam_unix.so             no_warn try_first_pass
password        required        pam_krb5.so             try_first_pass              
>How-To-Repeat:
Please read problem description for repro steps. Note, I assume that kerberos, (Heimdal, to be specific) has been setup properly, i.e. all of the k* tools works right and that kdc, kadmindd, kpasswdd all are up and running.
>Fix:
The problem is because the function pam_sm_chauthtok() in src/lib/libpam/modules/pam_krb5/pam_krb5.c does not handle the case where the PAM_PRELIM_CHECK is set. In comparison, pam_unix.c handles it by asking for the old password and return PAM_SUCCESS only if the old password is correct. The fix is simply to return PAM_SUCCESS when the PAM_PRELIM_CHECK is set above the code that checks if the PAM_UPDATE_AUTHTOK is set.

Also look at src/contrib/openpam/lib/pam_chauthtok.c to see the calling sequence into pam_sm_chauthtok() of the pam modules.

Below is the patch. 

For those who're not familier with patching (otherwise skip this section):
1. Copy the text from --- until the end of this message into a file, call it pam_krb5.c.patch
2. Put the file in /usr/src/lib/libpam/modules/pam_krb5/ and cd into that dir.
3. yourhost% patch < pam_krb5.c.patch
4. make clean
5. make
6. make install

Enjoy,
Toby


--- pam_krb5.c.orig     Thu Jul  7 14:16:38 2005
+++ pam_krb5.c  Tue Nov 29 16:12:41 2005
@@ -666,6 +666,9 @@
        const void *user;
        char *princ_name, *passdup;

+       if (flags & PAM_PRELIM_CHECK)
+               return PAM_SUCCESS;
+
        if (!(flags & PAM_UPDATE_AUTHTOK))
                return (PAM_AUTHTOK_ERR);


>Release-Note:
>Audit-Trail:
Responsible-Changed-From-To: freebsd-bugs->des 
Responsible-Changed-By: linimon 
Responsible-Changed-When: Wed Nov 30 22:45:37 GMT 2005 
Responsible-Changed-Why:  
Perhaps des is the right person to look at this. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=89770 
>Unformatted:
