CVS log for src/usr.bin/passwd/pam_passwd.c

Up to [cvs.NetBSD.org] / src / usr.bin / passwd

Request diff between arbitrary revisions

Keyword substitution: kv
Default branch: MAIN

usr.bin: remove unnecessary lint comment CONSTCOND

Since 2021-01-31, lint no longer warns about 'do ... while (0)'.

No functional change.

Pull up following revision(s) (requested by gdt in ticket #1360):
	usr.bin/passwd/pam_passwd.c: revision 1.5
	usr.bin/passwd/local_passwd.c: revision 1.34
Log successful and unsuccessful attempts to change passwords, via -l
or pam, to ease IT audit guideline compliance.  Patch from Richard
Hansen of BBN in private mail.
Proposed on tech-kern with positive comments, except a suggestion I
didn't implement:
A possible future enhancement is refraining from logging if the old
password is empty, as some people abort password changing that way.
However, it's not clear if this complies with most guidelines that
require password change logging, and at first glance that appears to
be a fairly difficult change.

sync to netbsd-5

Pull up following revision(s) (requested by joerg in ticket #1333):
	usr.bin/passwd/pam_passwd.c: revision 1.6
Do not call pam_end with an invalid handle if pam_start failed.
From Richard Hansen.

Do not call pam_end with an invalid handle if pam_start failed.
From Richard Hansen.

Log successful and unsuccessful attempts to change passwords, via -l
or pam, to ease IT audit guideline compliance.  Patch from Richard
Hansen of BBN in private mail.

Proposed on tech-kern with positive comments, except a suggestion I
didn't implement:

A possible future enhancement is refraining from logging if the old
password is empty, as some people abort password changing that way.
However, it's not clear if this complies with most guidelines that
require password change logging, and at first glance that appears to
be a fairly difficult change.

Pull up following revision(s) (requested by jnemeth in ticket #1776):
	usr.bin/passwd/pam_passwd.c: revision 1.4
Display a message indicating who's password is being changed, as per
Jeremy Reed on tech-userlevel.

Pull up following revision(s) (requested by jnemeth in ticket #1776):
	usr.bin/passwd/pam_passwd.c: revision 1.4
Display a message indicating who's password is being changed, as per
Jeremy Reed on tech-userlevel.

Pull up following revision(s) (requested by jnemeth in ticket #1776):
	usr.bin/passwd/pam_passwd.c: revision 1.4
Display a message indicating who's password is being changed, as per
Jeremy Reed on tech-userlevel.

Pull up following revision(s) (requested by jnemeth in ticket #626):
	usr.bin/passwd/pam_passwd.c: revision 1.4
Display a message indicating who's password is being changed, as per
Jeremy Reed on tech-userlevel.

Display a message indicating who's password is being changed, as per
Jeremy Reed on tech-userlevel.

Magor rework of passwd(1) for the PAM case.  Add "-d <database>" option,
similar to Solaris's "-r <repository" or Mac OS X's "-i <infosystem>",
to select the password database (files, nis, krb5).  Otherwise, we default
to using whatever PAM decides.

Add missing RCS ID.

Add a PAM passwd module.
XXX: This avoids the issue of supporting separate -l -y -k, but is the behavior
correct? Should passwd -p disable all other passwd methods? Should it become
the default if compiled in?