Re: PAM authentication patch - v2

Mark D. Baushke wrote:

>You may need to consider the folks that have enabled the SETXID_SUPPORT
>option when building their cvs executables. I have not looked at that
>code in some time, but if you choose to add PAM support, you must also
>consider these kinds of odd configurations and how they impact your
>security model.
>  
>
What does this do?

>...unless you can somehow find a way to have cvs elevate your privilege
>level for you... possibly due to odd configuration or installation
>choices on the part of the admin installing cvs.
>  
>
One can always make any program installed by root give anyone root 
access. You
can't legislate for stupidity.

>There has been some discussion of PAM service names on the
>openssh-unix-dev list. There was a big stink about "ssh" as used by
>a debian patch and "sshd" as used by other folks.
>  
>
Had a look at this and it doesn't look like they have any serious problems.

>Granted this is using a long running root daemon, but it would seem
>to be a parallel to the :pserver: method and learning from those who
>have been thru this particular nightmare may be useful.
>  
>
Doesn't seem to be too nightmarish to me, just bugs and fixes like any
software.

>It may also be possible to look at the PAM code in openssh 3.6p1 and see
>how they are doing things in a 'portable' manner to a number of
>different systems.
>
>  
>
Looks like what I do, all very standard - the ssh code is much more complex
though.

>All that said, I am concerned that addin PAM support is likley to be
>more trouble than it is worth.
>  
>
To whom?

>I am pragmatic enough to not be willing to yank :pserver: mode which
>should only be used in a secure intranet. Cleaning up problems in the
>password code the pserver path takes is a fine idea.
>
>The idea that someone might be having a trivially hashed copy of their
>real login password stored into ~/.cvspass strikes me as an extremely
>bad idea. If a user only gets their 'cvs password' compromised it is not
>necessarily as bad as losing the 'login password' used for other purposes
>on their network.
>  
>
Most people probably have a non-password protected private ssh key in 
their ~/.ssh
directory too. The cvs passwords are stored so that only the user can 
read/write them.

/Brian