Re: Race condition on change of expired password?

Russ Allbery <[email protected]> writes:

> This looks like a race condition, although I'm not exactly sure what to do
> about it.

> windlord:~/dvl/pam-krb5> kinit [email protected]
> [email protected]'s Password: 
> Your password will expire at Wed Dec 21 17:41:10 2011

> Changing password
> New password: 
> Repeat new password: 
> Success: Password changed

> kinit: Password incorrect
> windlord:~/dvl/pam-krb5> kinit [email protected]
> [email protected]'s Password: 
> windlord:~/dvl/pam-krb5> echo $?
> 0

It doesn't seem to *just* be a race condition.  I redid this test inside
the Kerberos PAM module and added a forced five second delay in the
prompter after printing the success message, but the subsequent AS-REQ
still fails:

Dec 21 18:00:22 kerberos-dev kpasswdd[946]: Changing password for [email protected]
Dec 21 18:00:27 kerberos-dev kdc[944]: AS-REQ [email protected] from IPv4:171.67.225.134 for krbtgt/[email protected]
Dec 21 18:00:27 kerberos-dev kdc[944]: No preauth found, returning PREAUTH-REQUIRED -- [email protected]
Dec 21 18:00:27 kerberos-dev kdc[944]: sending 303 bytes to IPv4:171.67.225.134
Dec 21 18:00:27 kerberos-dev kdc[944]: AS-REQ [email protected] from IPv4:171.67.225.134 for krbtgt/[email protected]
Dec 21 18:00:27 kerberos-dev kdc[944]: Client sent patypes: encrypted-timestamp
Dec 21 18:00:27 kerberos-dev kdc[944]: Looking for PKINIT pa-data -- [email protected]
Dec 21 18:00:27 kerberos-dev kdc[944]: Looking for ENC-TS pa-data -- [email protected]
Dec 21 18:00:27 kerberos-dev kdc[944]: Failed to decrypt PA-DATA -- [email protected] (enctype aes256-cts-hmac-sha1-96) error Decrypt integrity check failed
Dec 21 18:00:27 kerberos-dev kdc[944]: Failed to decrypt PA-DATA -- [email protected]
Dec 21 18:00:27 kerberos-dev kdc[944]: sending 159 bytes to IPv4:171.67.225.134

You can see the five second delay.  So something else must be going on.

-- 
Russ Allbery ([email protected])             <http://www.eyrie.org/~eagle/>