|
 |
0ca79db |
--- a/src/vlock/auth.c
|
|
|
0ca79db |
+++ b/src/vlock/auth.c
|
|
|
0ca79db |
@@ -4,7 +4,7 @@
|
|
|
0ca79db |
PAM authentication routine for vlock, the VT locking program for linux.
|
|
|
0ca79db |
|
|
|
0ca79db |
Copyright (C) 1994-1998 Michael K. Johnson <johnsonm@redhat.com>
|
|
|
0ca79db |
- Copyright (C) 2002, 2005 Dmitry V. Levin <ldv@altlinux.org>
|
|
|
0ca79db |
+ Copyright (C) 2002, 2005, 2013 Dmitry V. Levin <ldv@altlinux.org>
|
|
|
0ca79db |
|
|
|
0ca79db |
This program is free software; you can redistribute it and/or modify
|
|
|
0ca79db |
it under the terms of the GNU General Public License as published by
|
|
|
0ca79db |
@@ -36,6 +36,25 @@
|
|
|
0ca79db |
/* Unrecognized PAM error timeout. */
|
|
|
0ca79db |
#define ERROR_TIMEOUT 10
|
|
|
0ca79db |
|
|
|
0ca79db |
+static int
|
|
|
0ca79db |
+do_account_password_management (pam_handle_t *pamh)
|
|
|
0ca79db |
+{
|
|
|
0ca79db |
+ int rc;
|
|
|
0ca79db |
+
|
|
|
0ca79db |
+ /* Whether the authenticated user is allowed to log in? */
|
|
|
0ca79db |
+ rc = pam_acct_mgmt (pamh, 0);
|
|
|
0ca79db |
+
|
|
|
0ca79db |
+ /* Do we need to prompt the user for a new password? */
|
|
|
0ca79db |
+ if (rc == PAM_NEW_AUTHTOK_REQD)
|
|
|
0ca79db |
+ rc = pam_chauthtok (pamh, PAM_CHANGE_EXPIRED_AUTHTOK);
|
|
|
0ca79db |
+
|
|
|
0ca79db |
+ /* Extend the lifetime of the existing credentials. */
|
|
|
0ca79db |
+ if (rc == PAM_SUCCESS)
|
|
|
0ca79db |
+ rc = pam_setcred (pamh, PAM_REFRESH_CRED);
|
|
|
0ca79db |
+
|
|
|
0ca79db |
+ return rc;
|
|
|
0ca79db |
+}
|
|
|
0ca79db |
+
|
|
|
0ca79db |
int
|
|
|
0ca79db |
get_password (pam_handle_t * pamh, const char *username, const char *tty)
|
|
|
0ca79db |
{
|
|
|
0ca79db |
@@ -84,6 +103,23 @@ get_password (pam_handle_t * pamh, const char *username, const char *tty)
|
|
|
0ca79db |
switch (rc)
|
|
|
0ca79db |
{
|
|
|
0ca79db |
case PAM_SUCCESS:
|
|
|
0ca79db |
+ rc = do_account_password_management (pamh);
|
|
|
0ca79db |
+
|
|
|
0ca79db |
+ if (rc != PAM_SUCCESS)
|
|
|
0ca79db |
+ {
|
|
|
0ca79db |
+ /*
|
|
|
0ca79db |
+ * The user was authenticated but
|
|
|
0ca79db |
+ * either account or password management
|
|
|
0ca79db |
+ * returned an error.
|
|
|
0ca79db |
+ */
|
|
|
0ca79db |
+ printf ("%s.\n\n\n",
|
|
|
0ca79db |
+ pam_strerror (pamh, rc));
|
|
|
0ca79db |
+ fflush (stdout);
|
|
|
0ca79db |
+ pam_end (pamh, rc);
|
|
|
0ca79db |
+ pamh = 0;
|
|
|
0ca79db |
+ break;
|
|
|
0ca79db |
+ }
|
|
|
0ca79db |
+
|
|
|
0ca79db |
pam_end (pamh, rc);
|
|
|
0ca79db |
/* Log the fact of console unlocking. */
|
|
|
0ca79db |
syslog (LOG_NOTICE,
|