Bug 197442 – sys-apps/shadow-4.0.18.1-r1 uses outdated pam.d rules

• Status: RESOLVED FIXED
• Product: Gentoo Linux

[Description Pacho Ramos 2007-10-29 17:45:20 UTC]

After updating to pam-0.99 I get this warning at /var/log/messages:
Oct 29 18:42:39 localhost login[5217]: pam_tally(login:auth): unknown option: no_magic_root
Oct 29 18:42:42 localhost login[5217]: pam_tally(login:account): option deny=0 allowed in auth phase only
Oct 29 18:42:42 localhost login[5217]: pam_tally(login:account): unknown option: no_magic_root
Oct 29 18:42:42 localhost login[5217]: pam_tally(login:setcred): unknown option: no_magic_root
Oct 29 18:42:42 localhost login[5217]: pam_unix(login:session): session opened for user pacho by LOGIN(uid=0)

Seems that no_magic_root option is no longer needed as this is the default option now, the affected file is:
/etc/pam.d/login

Thanks a lot

Portage 2.1.3.16 (default-linux/amd64/2007.0, gcc-4.1.2, glibc-2.6.1-r0, 2.6.22-gentoo-r9 x86_64)
=================================================================
System uname: 2.6.22-gentoo-r9 x86_64 AMD Athlon(tm) 64 Processor 3200+
Timestamp of tree: Mon, 29 Oct 2007 17:00:01 +0000
ccache version 2.4 [enabled]
app-shells/bash:     3.2_p17
dev-java/java-config: 1.3.7, 2.0.33-r1
dev-lang/python:     2.4.4-r6
dev-python/pycrypto: 2.0.1-r6
dev-util/ccache:     2.4-r7
sys-apps/baselayout: 1.12.9-r2
sys-apps/sandbox:    1.2.18.1-r2
sys-devel/autoconf:  2.13, 2.61-r1
sys-devel/automake:  1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6-r2, 1.10
sys-devel/binutils:  2.18-r1
sys-devel/gcc-config: 1.3.16
sys-devel/libtool:   1.5.24
virtual/os-headers:  2.6.22-r2
ACCEPT_KEYWORDS="amd64"
CBUILD="x86_64-pc-linux-gnu"
CFLAGS="-march=k8 -O2 -pipe -msse3"
CHOST="x86_64-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/kde/3.5/env /usr/kde/3.5/share/config /usr/kde/3.5/shutdown /usr/share/X11/xkb /usr/share/config"
CONFIG_PROTECT_MASK="/etc/env.d /etc/env.d/java/ /etc/gconf /etc/revdep-rebuild /etc/splash /etc/terminfo /etc/texmf/web2c /etc/udev/rules.d"
CXXFLAGS="-march=k8 -O2 -pipe -msse3"
DISTDIR="/usr/distfiles"
FEATURES="autoaddcvs ccache collision-protect cvs distlocks metadata-transfer multilib-strict parallel-fetch sandbox sfperms strict unmerge-orphans userfetch"
GENTOO_MIRRORS="http://ftp.belnet.be/mirror/rsync.gentoo.org/gentoo/"
LANG="es_ES.UTF-8"
LC_ALL="es_ES.UTF-8"
LINGUAS="es en_US"
MAKEOPTS="-j2"
PKGDIR="/usr/portage/packages"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --delete-after --stats --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages --filter=H_**/files/digest-*"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
PORTDIR_OVERLAY="/usr/portage/local/layman/musicbrainz /usr/portage/local/layman/sunrise /usr/local/portage"
SYNC="rsync://rsync.gentoo.org/gentoo-portage"
USE="3dnow 3dnowext X a52 aac acpi alsa amd64 arts asf audiofile avahi bash-completion beagle bitmap-fonts bzip2 bzlib cairo caps cdb cdda cddb cdparanoia cdr cli cpdflib cpudetection cracklib cross crypt cups curl daap dbus dga divx4linux dlloader dri dts dvb dvd dvdr dvdread eds encode erandom escreen esd evo evolution exif fam fbcon ffmpeg flac foomaticdb fortran ftp galago gb gcj ggi gif gimp gimpprint glitz glut glx gnome gnome-print gphoto2 gpm gstreamer gtk gtk2 gtkhtml hal hddtemp iconv idn imagemagick imlib isdnlog ithreads jabber java jpeg kde kdeenablefinal kdehiddenvisibility latex lcms libnotify lm_sensors logrotate mad madwifi midi mikmod mime mmx mmxext mng mono motif mp3 mpeg mpi mplayer mudflap musepack musicbrainz nas nautilus ncurses nethack network nls nocardbus nptl nptlonly nvidia ogg oggvorbis openal opengl openmp pam pcre pdf perl pic plotutils png posix ppds pppd python qt3 qt4 quicktime readline reflection rtc ruby scanner sdl seamonkey session slang slp sockets spell spl sse sse2 sse3 ssl startup-notification svg sysvipc tcltk tcpd tetex theora threads tiff timidity tk totem trayicon truetype truetype-fonts type1-fonts unicode usb v4l v4l2 vcd videos vim vorbis wma wmf xcomposite xine xml xml2 xorg xpm xv xvid zlib" ALSA_CARDS="ali5451 als4000 atiixp atiixp-modem bt87x ca0106 cmipci emu10k1x ens1370 ens1371 es1938 es1968 fm801 hda-intel intel8x0 intel8x0m maestro3 trident usb-audio via82xx via82xx-modem ymfpci" ALSA_PCM_PLUGINS="adpcm alaw asym copy dmix dshare dsnoop empty extplug file hooks iec958 ioplug ladspa lfloat linear meter mulaw multi null plug rate route share shm softvol" ELIBC="glibc" INPUT_DEVICES="keyboard mouse" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LINGUAS="es en_US" USERLAND="GNU" VIDEO_CARDS="nvidia nv vesa fbdev vga"
Unset:  CPPFLAGS, CTARGET, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LDFLAGS, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS


Reproducible: Always

[Comment 1 Kevin Parent 2007-10-29 18:07:51 UTC]

Beat me to the punch, although I didn't know that *no_magic_root* is no longer needed.  I only found that it's not a valid option.  "man pam_tally" does list the *magic_root* option, but not the *no_magic_root* option.

So removing this invalid option is the solution?

[Comment 2 Kevin Parent 2007-10-29 18:19:24 UTC]

Additionally, this error shows up in /var/log/auth.log (using sysklogd):

Oct 29 13:11:13 tesla login[8926]: pam_tally(login:account): option deny=0 allowed in auth phase only

The rule triggering this error is /etc/pam.d/login:

account    required    pam_tally.so deny=0 file=/var/log/faillog onerr=succeed no_magic_root

So, *deny=0* should be moved to an auth rule or removed?

[Comment 3 Pacho Ramos 2007-10-29 18:45:54 UTC]

(In reply to comment #2)
> Additionally, this error shows up in /var/log/auth.log (using sysklogd):
> 
> Oct 29 13:11:13 tesla login[8926]: pam_tally(login:account): option deny=0
> allowed in auth phase only
> 
> The rule triggering this error is /etc/pam.d/login:
> 
> account    required    pam_tally.so deny=0 file=/var/log/faillog onerr=succeed
> no_magic_root
> 
> So, *deny=0* should be moved to an auth rule or removed?
> 

I removed no_magic_root and moved deny=0 to auth with no problems

[Comment 4 Kevin Parent 2007-10-29 18:59:27 UTC]

I did too.  Works fine - no more warnings.

[Comment 5 Jakub Moc (RETIRED) 2007-10-30 07:00:23 UTC]

Created attachment 134681 [details, diff]
shadow-pamd-login.patch

[Comment 6 Jakub Moc (RETIRED) 2007-10-30 07:01:31 UTC]

Noticed this quite some time ago, never got to reporting this...

[Comment 7 Diego Elio Pettenò (RETIRED) 2007-10-30 09:01:34 UTC]

Known already, just ignore it, I wanted to avoid bumps just to remove some extra warnings, so I postponed till a new release is going to be released.

[Comment 8 Diego Elio Pettenò (RETIRED) 2007-11-04 15:24:49 UTC]

Considering fixed as I committed a fixed login file for 4.0.18.2.

[Comment 9 Pacho Ramos 2007-11-04 16:06:49 UTC]

Thanks

[Comment 10 Kevin Parent 2007-11-04 17:32:57 UTC]

Ditto

[Comment 11 Jakub Moc (RETIRED) 2007-11-11 12:34:17 UTC]

*** Bug 198796 has been marked as a duplicate of this bug. ***

[Comment 12 Jakub Moc (RETIRED) 2007-11-12 10:33:49 UTC]

*** Bug 198904 has been marked as a duplicate of this bug. ***

[Comment 13 Jakub Moc (RETIRED) 2008-01-30 13:54:31 UTC]

*** Bug 208170 has been marked as a duplicate of this bug. ***