Control: reassign -1 libpam-ldap/184-8.7+b1
Hi,
On Mon, Jul 20, 2015 at 03:36:42PM -0500, William Thomas wrote:
After various testing, I have determined the issue is with libldap.
If a wheezy system is upgraded to the backports version
2.4.31+really2.4.40+dfsg-1~bpo70+1 it starts to exhibit the behaviour.
And if a jessie system is downgraded to 2.4.31-2 it stops exhibiting
the issue.
I expect that what you are seeing is a result of fixing bug #368297.
pam_ldap quite explicitly tries to bind with the rootbinddn first, and
only falls back to binding as the user if that fails:
https://github.com/PADL/pam_ldap/blob/master/pam_ldap.c#L3097
However, the specific combination of a setuid-root program (such as
passwd) and TLS provided by GnuTLS linked against gcrypt is known to be
troublesome (#368297 and many others), because gcrypt unconditionally
drops root privileges if it has them.
This has been fixed in 2.4.40 (jessie and wheezy-backports) by using a
newer gnutls that links nettle instead of gcrypt; however, you're now
exposed to that choice by pam_ldap to prefer to bind as root when
changing passwords.
I'm reassigning this back to libpam-ldap since IMO the correct fix is to
have it prefer to bind as the user when changing its own password.
I would note, though, that lib{pam,nss}-ldap are not really maintained
any more, and it would be a good idea to investigate alternatives such
as lib{pam,nss}-ldapd or sssd.
Hope that helps,
Ryan
--
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
