Note: This is a beta release of Red Hat Bugzilla 5.0. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Also email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback here.
Bug 179009 - KRB5 auth should include minimum_uid?
Summary: KRB5 auth should include minimum_uid?
Alias: None
Product: Fedora
Classification: Fedora
Component: authconfig
Version: rawhide
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Tomas Mraz
QA Contact: Brian Brock
Depends On:
Blocks: FC5Target
TreeView+ depends on / blocked
Reported: 2006-01-26 14:38 UTC by Brian Wheeler
Modified: 2007-11-30 22:11 UTC (History)
0 users

Fixed In Version: authconfig-5.2.0-1
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2006-02-06 17:31:19 UTC

Attachments (Terms of Use)

Description Brian Wheeler 2006-01-26 14:38:08 UTC
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.12) Gecko/20050922 Fedora/1.0.7-1.1.fc4 Firefox/1.0.7

Description of problem:
System accounts shouldn't be authenticating against a kerberos server by default.  I run in a university setting and I'd like to authenticate my users against the campus kerberos server.  Since I have no control over the kerberos server itself, I cannot know whether or not there are entries for root, apache, squid, etc. on the kerberos server which may be used to authenticate against my system.

It seems that putting the "minimum_uid=500" argument to when writing the pam authorization files would be a good thing to limit any bad surprises.  It would still be possible to try to log in via 'nobody', but since that's a limited access account anyway, the damage would be minimal.

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1. run ethereal and watch for krb5 packets
2. su -


Actual Results:  pam_krb5 tries to auth root against krb server.

Expected Results:  only local authentication for system accounts, unless overridden by administrator.

Additional info:

Comment 1 Tomas Mraz 2006-02-06 17:31:19 UTC
Fixed in a slightly different and more universal way.

authconfig now adds:

auth        requisite uid >= 500 quiet

line to /etc/pam.d/system-auth-ac by default. Also there is a new option which
reverts to the old behaviour of allowing that.

Note You need to log in before you can comment on or make changes to this bug.