MFH (r325010): don't bother verifying a password that we know is too long.

Reported by: jkim@
Security: CVE-2016-6210

MFC r299948

Set retval in the empty password case to avoid a path through the
code that fails to set retval before falling through to the final
return().

Reported by: emaste
Reported by: Coverity
CID: 1018711

MFC r299926

Hoist the getpwnam() call outside the first if/else block in
pam_sm_chauthtok(). Set user = getlogin() inside the true
branch so that it is initialized for the following PAM_LOG()
call. This is how it is done in pam_sm_authenticate().

Reported by: Coverity
CID: 272498

Copy head (r256279) to stable/10 as part of the 10.0-RELEASE cycle.

Approved by: re (implicit)
Sponsored by: The FreeBSD Foundation

Fix declaration vs. definition inconsistency. No functional change.

Fix an instance in pam_krb5(8), where the variable 'user' could be used
uninitialized.

Found by: clang 3.2
Reviewed by: des
MFC after: 1 week

Remove an unused variable from pam_unix.

This variable was added in r82352 back in 2001, but even then it didn't
have any use. Because it's not marked static, the C compiler won't
complain about it.

Discussed with: des

Add <time.h> for ctime(), which we accidentally picked up through
<sys/time.h>.

Submitted by: Garrett Cooper <yanegomi@gmail.com>
MFC after: 3 days

Respect passwordtime from login.conf if set.

PR: bin/93473
Submitted by: Björn König <bkoenig@cs.tu-berlin.de>
MFC after: 1 week

Adjust for OpenPAM Hydrangea.

In account management, verify whether the account has been locked
with `pw lock', so that it's impossible to log into a locked account
using an alternative authentication mechanism, such as an ssh key.
This change affects only accounts locked with pw(8), i.e., having a
`*LOCKED*' prefix in their password hash field, so people still can
use a different pattern to disable password authentication only.

Mention all account management criteria in the manpage.

Approved by: maintainer (timeout)
PR: bin/71147
MFC after: 1 month

Use the correct login class when setting a new password.

PR: 65557, 72949
Submitted by: Stephen P. Cravey <clists@gotbrains.org>
Approved by: re (scottl)
MFC after: 2 weeks

NI_WITHSCOPEID cleanup

Reviewed by: des

Fix numerous constness and aliasing issues.

Fix strict aliasing breakage in PAM modules (except pam_krb5, which needs
more work than the others). This should make most modules build with -O2.

Fix the master yppasswd routines, so they really work
for root on ypmaster. yppasswd_local() did use YPPASSWDPROG
instead of MASTER_YPPASSWDPROG, and the domain was not set,
resulting in a coredump during xdr-encode.

Reviewed by: des

Update copyright dates.

Remove all instances of pam_std_option()

Make sure rhostip is always initialized.

PR: bin/51508
Submitted by: Peter Grimshaw <peter@tesseract.demon.co.uk>

Treat an empty PAM_RHOST the same as a NULL one.

PR: bin/51508

Forced commit to note that the previous commit was made in response to

PR: bin/51245

Remove a bogus null password check which assumed that a user with an empty
password must necessarily have an empty pwd->pw_passwd. Also add a check
that prevents users from setting a blank password unless the nullok option
was specified. Root is still allowed to give anyone a blank password.

Free old_pwd only in the code path where it has been allocated.

Reviewed by: des

Use libutil and libypclnt for all passwd manipulation and NIS needs.

Sponsored by: DARPA, NAI Labs

Don't ask root for the old password, except in the NIS case.

Sponsored by: DARPA, NAI Labs

Fix a really dumb bug (missing curly braces around the body of an if
statement) that caused pam_sm_chauthtok() to always fail silently.

Revert previous commit, it is incorrect.

Properly spell rpcsvc/ypclnt.h and fix the build.

Prompt for new password during update phase, not during preliminary phase.

Sponsored by: DARPA, NAI Labs

Dike out most of the NIS code and replace it with calls to libypclnt.
Rework pam_sm_chauthtok() so it (mostly?) works.
The standard pw stuff still needs to move into a library somewhere.

Sponsored by: DARPA, NAI Labs

Major cleanup:

- add __unused where appropriate
- PAM_RETURN -> return since OpenPAM already logs the return value.
- make PAM_LOG use openpam_log()
- make PAM_VERBOSE_ERROR use openpam_get_option() and check flags
for PAM_SILENT
- remove dummy functions since OpenPAM handles missing service
functions
- fix various warnings

Sponsored by: DARPA, NAI Labs

Align for const poisoning in -lutil.

Reorganize pam_sm_authenticate() to reduce code duplication.

Sponsored by: DARPA, NAI Labs

Fix bug in previous commit that passed the wrong default value to
login_getcapstr(3). Also fix a longer-standing bug (login_close(3)
frees the string returned by login_getcapstr(3)) by reorganizing the
code a little, and use login_getpwclass(3) instead of login_getclass(3)
if we already have a struct pwd.

Sponsored by: DARPA, NAI Labs

Aggressive cleanup of warnings + authtok-related code in preparation for
PAMifying passwd(1).

Sponsored by: DARPA, NAI Labs.

Fix some style issues, a const warning, and abuse of PAM_ABORT.

Sponsored by: DARPA, NAI Labs

Fix world breakage introduced by my recent modifications to
chpass(8). The relations between libc, libpam, chpass, passwd, and
vipw are a mess and probably should be cleaned up.

Submitted by: Peter Pentchev <roam@ringlet.net>

NAI DBA update.

Remove the use of random(3), and encapsulate the salt-generation in
its own function. The use of arc4random(3) is hopeless overkill here,
but that does not hurt anything.

Requested by: ache

Switch to OpenPAM. Bump library version. Modules are now versioned, so
applications linked with Linux-PAM will still work.
Remove pam_get_pass(); OpenPAM has pam_get_authtok().
Remove pam_prompt(); OpenPAM has pam_{,v}{error,info,prompt}().
Remove pam_set_item(3) man page as OpenPAM has its own.

Sponsored by: DARPA, NAI Labs

This file needs <syslog.h>.

Sponsored by: DARPA, NAI Labs

#include cleanup.

Sponsored by: DARPA, NAI Labs

Add the other half of the salt-generating code. No functional
difference except that the salt is slightly harder to build
dictionaries against, and the code does not use srandom[dev]().

Forced commit.

Previous commit included a large improvement to the salt generation to
help obfuscate information that is otherwise leaked. No real risks
involved, but this feels better, and does not use srandom[dev]().

WARNS=n fixes (and some stylistic issues).

With asbestos longjohns on, integrate most of the checks normally done by
login(1) (password & account expiry, hosts.access etc.) into pam_unix(8).

Sponsored by: DARPA, NAI Labs

Really back out ache's commits. These files are now precisely as they were
twentyfour hours ago, except for RCS ids.

Back out recent changes

Back out second right-now-expired password check in pam_sm_chauthtok,
old expired password assumed there

Add yet one expired-right-now password check, in pam_sm_chauthtok

srandomdev() can't be used in libraries, replace srandomdev()+random()
by arc4random()

Add missing check for right-now-expired password

Don't put an extra space after password prompts, because it violates POLA,
makes FreeBSD inconsistent with previous releases and "other unices" as well
as with some internal password-asking services (e.g. ftp) within the same
release.

Add __FBSDID()s to libpam

Forced commit.

Previous commit improved use of login_cap database. This can probably
be further improved.

Big module makeover; improve logging, standardise variable names,
introduce ability to change passwords for both "usual" Unix methods
and NIS.

Clean up (and in some cases write) the PAM mudules, using
o The new options-processing API
o The new DEBUG-logging API

Add man(1) pages for ALL modules. MDOC-Police welcome
to check this.

Audit, clean up while I'm here.

Add the "nullok" option that causes this module to succeed if the Unix
password is empty/null.

Add the "auth_as_self" option to the pam_unix module (there is no
reason not to add it to others later). This causes the pam_unix
module to check the user's _own_ password, not the password of the
account that the user is authenticating into. This will allow eg:
WHEELSU type behaviour from su(1).

Revive the pam_deny and pam_permit modules from Linux-PAM. They are
simple enough to be trusted.

Add account management functionality to the pam_unix module.

These changes should make it possible to use PAM in some ports.

Submitted by: Max Khon <fjoe@iclub.nsu.ru>

Fix bug that prevented accounts with empty passwords from logging
in.

Submitted by: Paul Traina <pst@juniper.net>

Make it possible to use PAM in statically-linked applications.

This commit was generated by cvs2svn to compensate for changes in r41227,
which included commits to RCS files with non-trunk default branches.

Build structure for contribified Linux-PAM, plus some home-grown
modules for FreeBSD's standard authentication methods. Although
the Linux-PAM modules are present in the contrib tree, we don't
use any of them.

The main library "libpam" is composed of sources taken from three
places. First are the standard Linux-PAM libpam sources from the
contrib tree. Second are the Linux-PAM "libpam_misc" sources, also
from the contrib tree. In Linux these form a separate library.
But as Mike Smith pointed out to me, that seems pointless, so I
have combined them into the libpam library. Third are some additional
sources from the "src/lib/libpam" tree with some common functions
that make it easier to write modules. Those I wrote myself.

This work has been donated to FreeBSD by Juniper Networks, Inc.