| Summary: | pam-0.77-r1 and XAUTHORITY trouble | ||
|---|---|---|---|
| Product: | Gentoo Linux | Reporter: | Martin Gramatke <xmit> |
| Component: | [OLD] Core system | Assignee: | PAM Gentoo Team (OBSOLETE) <pam-bugs+disabled> |
| Status: | RESOLVED NEEDINFO | ||
| Severity: | major | CC: | converter42, krinpaus |
| Priority: | High | ||
| Version: | unspecified | ||
| Hardware: | x86 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Package list: | Runtime testing required: | --- | |
|
Description
Martin Gramatke
2004-11-13 14:50:38 UTC
This is not a security issue, re-assigning to pam herd. try with 0.77-r3 Same problem with 0.77-r3. Sorry. I fear the core problem and scope of the issue is missing from the description here. Thankfully, I've started using dispatch-conf on one of my systems and it told the whole story. The issue _is_ with the upgrade to pam. In the previous file /etc/security/pam_env.conf, there was a whole bunch of comments and examples but no actual code. In the upgraded config, there's three lines setting DISPLAY, REMOTEHOST and XAUTHORITY variables. I can't work out what they're for or why they're needed, but KDM for one cannot log-in on anything but screen :0.0 when these options are set. Put simply, these config options bork having >1 graphical VT, as well as the famous VNC terminal server for the forum's howto (both are features which I personally use extensively on 4 machines). They may well bork other things as well, but it's fairly clear that it's just not a good thing. When I was testing, xdm didn't have the problem, but then I could only log-in as root (the LDAP login's weren't working - does xdm use pam? side issue, I'm not really interested). I didn't test gdm as I've found a full workaround. Since the original file had these lines commented, I'm guessing there's no side effects to just commenting them out again. Cheers. i have those log entries on all of my gentoo boxes at this point. they happen whenever i su i think. This bug is due to changes made for bug 69925 in pam_env.conf. The changes were incorrect because 1) XAUTHORITY is not recognized as a PAM variable by PAM_ENV (look at the pam_env.c code if you don't believe me), and 2) REMOTEHOST DEFAULT= OVERRIDE=@{PAM_RHOST} should be REMOTEHOST DEFAULT=localhost OVERRIDE=@{PAM_RHOST} Otherwise, the line DISPLAY DEFAULT=${REMOTEHOST}:0.0 OVERRIDE=${DISPLAY} will produce an error saying REMOTEHOST is an invalid variable. Unfortunately, both this bug and bug 69925 should be reopened, because the fix is incorrect and does not even resolve the problem stated in 69925. |
