(Report imported from Bugzilla #177)

Status CLOSED, severity normal, in component Daemon.
Reported in version 21 on platform All.
Assigned to: Virtual ngIRCd Bug Manager.

On 2014-05-01 00:58:57 +0200, Kevin Fenzi wrote:

Downstream bug report:

https://bugzilla.redhat.com/show_bug.cgi?id=1092706

Basically if we compile with pam support:

PAM = no
PAMIsOptional = yes

Doesn't seem to disable pam, it's always active. :(

I can setup a test server here, or ask downstream reporter to test or add information if needed.

thanks

On 2014-05-01 01:34:48 +0200, Alexander Barton wrote:

(In reply to comment # 0)

PAM = no
PAMIsOptional = yes

Doesn't seem to disable pam, it's always active. :(

How does your ngircd.conf look like?
"ngircd --configtest" validates the configuration without errors?

"PAM=no" in an "[options]" section should disable PAM altogether … and at least it seems to work for me.

Thanks
Alex

On 2014-05-01 18:54:17 +0200, Kevin Fenzi wrote:

Turns out they had an older config file that didn't have an [options] section. :)

So, sorry for the false alarm here...

On 2014-05-02 17:03:42 +0200, Kevin Fenzi wrote:

I have a related query here...

Right now, if you build with pam support, ngircd assumes you want it on.
(ie, if there's no PAM= directive in the config, it assumes 'yes')

Is there any way to default this to 'no'?

The use case is this:

Fedora/EPEL packages ship their ngircd.conf as '%config noreplace' which means if the package gets a new config and the user has edited their local copy, it just goes in as ngircd.conf.rpmnew. So, if we start shipping a pam enabled ngircd all the users who have current installs and upgrade will suddenly be using pam when they aren't expecting it.

If however, we could compile in support, but default it to 'no' if there's no PAM= directive we could push this pam enabled version.

Thoughts?

On 2014-05-10 16:11:12 +0200, Alexander Barton wrote:

(In reply to comment # 3)

I have a related query here...

Right now, if you build with pam support, ngircd assumes you want it on.
(ie, if there's no PAM= directive in the config, it assumes 'yes')

Is there any way to default this to 'no'?

No.

The use case is this:

Fedora/EPEL packages ship their ngircd.conf as '%config noreplace' which means
if the package gets a new config and the user has edited their local copy, it
just goes in as ngircd.conf.rpmnew. So, if we start shipping a pam enabled
ngircd all the users who have current installs and upgrade will suddenly be
using pam when they aren't expecting it.

If however, we could compile in support, but default it to 'no' if there's no
PAM= directive we could push this pam enabled version.

Thoughts?

You could deploy a /etc/pam.d/ngircd conf file with "auth required pam_permit.so" or something like this as default.

On 2014-05-17 19:49:52 +0200, Kevin Fenzi wrote:

(In reply to comment # 4)

You could deploy a /etc/pam.d/ngircd conf file with "auth required
pam_permit.so" or something like this as default.

Ah, thats a good thought. Will try that out. Thanks!

On 2014-06-04 11:58:56 +0200, Alexander Barton wrote:

Ok, so closing this bug again – ok?

On 2014-06-04 17:15:47 +0200, Kevin Fenzi wrote:

Yep. Thanks much!

On 2014-10-16 13:19:04 +0200, Alexander Barton wrote:

Finally closing this bug, thanks.