NOPASSWD sudo and PAM

Hi Todd,

   is there a difference w.r.t. PAM stack interaction for NOPASSWD vs 
PASSWD sudoers entries?

I was investigating why pam_time isn't working with sudo and found out 
that it was because the NOPASSWD flag.

It caused sudo to skip the PAM account phase and therefore skipping the 
pam_time module which is used like this:


/etc/pam.d/sudo:

   account required pam_time.so


/etc/security/time.conf:

   sudo;*;*;!Al0000-24000


That should cause pam_time to deny any attempt but in case of a NOPASSWD 
entry it is ignored.

Is this expected behavior or a bug?


Regards,

Daniel

____________________________________________________________
sudo-workers mailing list <[email protected]>
For list information, options, or to unsubscribe, visit:
https://www.sudo.ws/mailman/listinfo/sudo-workers