xref: /freebsd/contrib/pam-krb5/NEWS (revision bf6873c5786e333d679a7838d28812febf479a8a)

                      User-Visible pam-krb5 Changes

pam-krb5 4.11 (2021-10-17)

    Properly support calling pam_end with PAM_DATA_SILENT by not deleting
    the underlying ticket cache.  This flag is used when the application
    is closing the PAM session after a fork to free memory resources, but
    doesn't intend to free resources external to the process because
    another process may still depend on them.  Thanks to Andrew G. Morgan
    for the report.  (GitHub #21)

    Stop attempting to guess the correct PAM module installation path on
    Linux systems when --prefix is set to /usr and instead document that
    --libdir will probably need to be set explicitly.  The previous logic
    is now broken on Debian usrmerge systems and the guesswork seems too
    fragile to maintain.

    Update to rra-c-util 10.0:

    * Support Autoconf 2.71 without warnings.
    * Tests written in Perl now require Perl 5.10 or later.

pam-krb5 4.10 (2021-03-20)

    When re-retrieving the authenticated principal from the current cache,
    ensure the stored principal in the authentication context is always
    either valid or NULL.  Otherwise, a failure of krb5_cc_get_principal
    could result in a double free.  Thanks to Michael Muehle for the
    report.

    Update to rra-c-util 9.0:

    * Check that at least one Kerberos header file was found and works.
    * Use AS_ECHO in all Autoconf macros in preference to echo.
    * Fix portability of reallocarray on NetBSD systems.
    * Stop providing a replacement for a broken snprintf.

    Update to C TAP Harness 4.7:

    * Fix warnings with GCC 10.

pam-krb5 4.9 (2020-03-30)

    SECURITY: All previous versions of this module could overflow the
    buffer provided by the underlying Kerberos library for the response to
    a prompt by writing a single nul character past the end of the buffer.
    (CVE-2020-10595)

    Support use_pkinit with MIT Kerberos.  (Debian Bug#871699)

    Reject passwords as long or longer than PAM_MAX_RESP_SIZE (normally
    512 octets), since extremely long passwords can be used for a denial
    of service attack via the Kerberos string to key function.  Thanks to
    Florian Best for pointing out this issue and suggesting a good fix.

    Use explicit_bzero instead of memset, where available, to overwrite
    the memory used by PAM responses before freeing.  This reduces the
    lifetime of passwords and other secrets in memory.

    Return more accurate errors from the Kerberos prompter function if it
    was unable to prompt for the password.  This may translate into better
    debug log messages and, in some situations, returning the slightly
    more accurate PAM_AUTHINFO_UNAVAIL instead of PAM_AUTH_ERR.

    Fix an edge-case memory leak in pam_chauthtok when prompting for a new
    password for an ignored user.

    Ensure the module/basic test will run properly when the system
    krb5.conf file does not specify a default realm.  Reported by TBK.

    Update to rra-c-util 8.2:

    * Fix support for configuring the test suite with a krb5.conf file.
    * Drop support for Perl 5.6.
    * Reformat all C source using clang-format 10.
    * Remove bogus snprintf tests.
    * Fix misplaced va_end in the pam-util putil_log_failure function.
    * Skip checking for krb5-config on the path if a prefix was given.
    * Add SPDX-License-Identifier headers to all substantial source files.

    Update to C TAP Harness 4.6:

    * Fixed malloc error checking in bstrndup.
    * Fix (harmless) allocation error in runtests driver.
    * Add support for valgrind testing via test list options.
    * Report test failures as left and right, not wanted and seen.
    * Fix is_string comparisons involving NULL pointers and "(null)".
    * Add SPDX-License-Identifier headers to all substantial source files.

pam-krb5 4.8 (2017-12-30)

    When verifying that an expired password can still be used to get
    kadmin/changepw credentials, correctly set the credential options for
    getting password change credentials, not for getting initial
    credentials.  This should fix password change issues when, for
    example, krb5.conf requests that all tickets be proxiable but
    kadmin/changepw doesn't allow proxiable credentials.  Thanks to
    Florian Best for the bug report.

    When built against recent versions of Heimdal with richer status codes
    from PKINIT attempts, report to the user the reason for a PKINIT
    failure.  Based on work by Henry Jacques.

    Document the test suite configuration files required to run the PKINIT
    tests.

    Fix expired password tests to work with Heimdal 7.0.1 and later.

    Better document that the default Kerberos library ticket cache
    location is not used (and why), and how to set configuration
    parameters in krb5.conf.  Thanks, Matthew Gabeler-Lee.  (Debian
    Bug#872943)

    Compile cleanly under GCC 7 and Clang warnings and Clang's static
    analyzer.

    Rename the script to bootstrap from a Git checkout to bootstrap,
    matching the emerging consensus in the Autoconf world.

    Update to rra-c-util 7.0:

    * Fix new warnings in GCC 7.
    * Support a warning build under Clang.
    * Avoid zero-length allocations in reallocarray and vector.
    * Probe for warning flags instead of hard-coding a list.
    * New test for obsolete URLs and email addresses.
    * Remove unused portable replacements for strlcpy and strlcat.
    * Use C_TAP_SOURCE and C_TAP_BUILD environment variables in tests.
    * Fix portability defines for anonymous principal strings.
    * Clear errno on pam_modutil_getpwnam to improve other testing.
    * Add portability defines for macOS's PAM implementation.
    * Add new Autoconf macro to probe for pam_strerror const usage.
    * Support Solaris 10's included Kerberos.

    Update to C TAP Harness 4.2:

    * Avoid zero-length allocations in breallocarray.
    * Add is_blob and is_bool functions.
    * Use C_TAP_SOURCE and C_TAP_BUILD environment variables in tests.
    * Fix segfault in runtests with an empty test list.
    * Display verbose test results with -v or C_TAP_VERBOSE.
    * Test infrastructure builds cleanly with Clang warnings.

pam-krb5 4.7 (2014-12-25)

    Add a no_update_user option that disables the normal update of the
    PAM_USER PAM variable after canonicalization of the username.  When
    this is set, pam-krb5 will not convert full principal names to local
    usernames where possible for the rest of the PAM stack.

    Suppress spurious password prompt from Heimdal when authenticating
    with PKINIT.

    Map unknown realm errors from the Kerberos libraries to the PAM error
    code PAM_AUTHINFO_UNAVAIL instead of PAM_AUTH_ERR.

    Treat an KRB5_GET_IN_TKT_LOOP error as an incorrect password.  Heimdal
    KDCs sometimes return it, and Heimdal kinit treats it this way.
    Similarly, treat a KRB5_BAD_ENCTYPE error as an incorrect password,
    since this error is returned by a Heimdal 1.6-rc2 KDC for incorrect
    preauth from a MIT Kerberos 1.12.1 client.

    Add the version number at which each module option was added with its
    current meaning to the documentatation.

    Update to rra-c-util 5.6:

    * Suppress warnings from Kerberos headers in non-system paths.
    * Fix probing for Heimdal's libroken to work with older versions.
    * Fix Kerberos header detection if root or include paths are given.
    * Pass --deps to krb5-config in the non-reduced-dependencies case.
    * Provide a reallocarray replacement for platforms without it.
    * Use reallocarray where appropriate.
    * Drop checks for NULL before freeing pointers.
    * Drop explicit pointer initialization to NULL and rely on calloc.
    * Check the return status of snprintf and vsnprintf properly.
    * Preserve errno if snprintf fails in vasprintf replacement.
    * Suppress a dummy symbol in the client library that could leak.
    * Fix syntax errors when building with a C++ compiler.
    * Avoid test suite failures where tested functions are macros.

    Update to C TAP Harness 3.2:

    * Reopen standard input to /dev/null when running a test list.
    * Don't leak extraneous file descriptors to tests.
    * Suppress lazy plans and test summaries if the test failed with bail.
    * bail and sysbail now exit with status 255 to match Test::More.
    * runtests now treats the command line as a list of tests by default.
    * The full test executable path can now be passed to runtests -o.
    * Improved harness output for tests with lazy plans.
    * Improved harness output to a terminal for some abort cases.
    * Flush harness output after each test even when not on a terminal.

pam-krb5 4.6 (2012-06-02)

    Add an anon_fast option that attempts anonymous authentication
    (generally implemented via anonymous PKINIT inside the Kerberos
    library) and then, if successful, uses those credentials for FAST
    armor.  If fast_ccache and anon_fast are both specified, anonymous
    authentication will be used as a fallback if the specified FAST ticket
    cache doesn't exist.  Based on patches from Yair Yarom.

    Add a user_realm option to only set the realm for unqualified user
    principals.  This differs from the existing realm option in that realm
    also changes the default realm for authorization decisions and for
    verification of credentials.  Update the realm option documentation to
    clarify the differences and remove incorrect information.  Patch from
    Roland C. Dowdeswell.

    Add a no_prompt option to suppress the PAM module's prompt for the
    user's password and defer all prompting to the Kerberos library.  This
    allows the Kerberos library to have complete control of the prompting
    process, which may be desirable if authentication mechanisms other
    than password are in use.  Be aware that, with this option set, the
    PAM module has no control over the contents of the prompt and cannot
    store the user's password in the PAM data.  Based on a patch by Yair
    Yarom.

    Add a silent option to force the module to behave as if the
    application had passed in PAM_SILENT and suppress text messages and
    errors from the Kerberos library.  Patch from Yair Yarom.

    Add preliminary support for Kerberos trace logging via a trace option
    that enables trace logging if supported by the underlying Kerberos
    library.  The option takes as an argument the file name to which to
    log trace output.  This option does not yet work with any released
    version of Kerberos, but may work with the next release of MIT
    Kerberos.

    MIT Kerberos does not add a colon and space to its password prompts,
    but Heimdal does.  pam-krb5 previously unconditionally added a colon
    and space, resulting in doubled colons with Heimdal.  Work around this
    inconsistency by not adding the colon and space if already present.

    Fix alt_auth_map support to preserve the realm of the authentication
    identity when forming the alternate authentication principal, matching
    the documentation.

    Document that the alt_auth_map format may contain a realm to force all
    mapped principals to be in that realm.  In that case, don't add the
    realm of the authentication identity.  Note that this can be used as a
    simple way to attempt authentication in an alternate realm first and
    then fall back to the local realm, although any complex attempt at
    authentication in multiple realms should instead run the module
    multiple times with different realm settings.

    Avoid a NULL pointer dereference if krb5_init_context fails.

    Fix initialization of time values in the module configuration on
    platforms (like S/390X) where krb5_deltat is not equivalent to long.

    Close a memory leak when search_k5login is set but the user has no
    .k5login file.

    Close several memory leaks in alt_auth_map support.

    Suppress bogus error messages about unknown option for the realm
    option.  The option was being parsed and honored despite the error.

    Retry authentication under try_first_pass on several other errors in
    addition to decrypt integrity check errors to handle a wider array of
    possible "password incorrect" error messages from the KDC.

    Update to rra-c-util 4.4:

    * Replacement strndup now works with non-nul-terminated strings.
    * New Kerberos test setup that simplifies writing tests.
    * Add -D_FORTIFY_SOURCE=2 to the make warnings flags.
    * Use --deps flag to krb5-config by default.
    * Suppress __alloc_size__ attribute with older versions of gcc.
    * Suppress attribute warnings for non-gcc compilers.

    Update to C TAP Harness 1.12:

    * Add bstrndup to the basic C TAP library.
    * Only use feature-test macros when requested or built with gcc -ansi.
    * New tests/tap/macros.h header with some common definitions.
    * Drop is_double from the C TAP library to avoid requiring -lm.
    * Avoid using local in the shell libtap.sh library.

pam-krb5 4.5 (2011-12-24)

    Suppress the notice that the password is being changed because it's
    expired if force_first_pass or use_first_pass is set in the password
    stack, indicating that it's stacked with another module that's also
    doing password changes.  This is arguable, but without this change the
    notification message of why the password is being changed shows up
    confusingly in the middle of the password change interaction.  Based
    on a patch by William Yang.

    Some old versions of Heimdal (0.7.2 in OpenBSD 4.9, specifically)
    reportedly return KRB5KDC_ERR_KEY_EXP for accounts with expired
    keys even if the supplied password is wrong.  Work around this by
    confirming that the PAM module can obtain tickets for kadmin/changepw
    before returning a password expiration error instead of an invalid
    password error.  Based on a patch by William Yang.

    The location of the temporary root-owned ticket cache created during
    the authentication process is now also controlled by the ccache_dir
    option (but not the ccache option) rather than forced to be in /tmp.
    This will allow system administrators to configure an alternative
    cache directory so that pam-krb5 can continue working when /tmp is
    full.

    Report more specific errors in syslog if authorization checks (such as
    .k5login checks) fail.

    Pass a NULL principal to krb5_set_password with MIT client libraries
    to prefer the older change password protocol for compatibility with
    older KDCs.  This is not necessary on Heimdal since Heimdal's
    krb5_set_password tries both protocols.

    Improve logging and authorization checks when defer_pwchange is set
    and a user authenticates with an expired password.

    When probing for Kerberos libraries, always add any supplemental
    libraries found to that point to the link command.  This will fix
    configure failures on platforms without working transitive shared
    library dependencies.

    Close some memory leaks where unparsed Kerberos principal names were
    never freed.

    Restructure the code to work with OpenPAM's default PAM build
    machinery, which exports a struct containing module entry points
    rather than public pam_sm_* functions.  Thanks to Fredrik Pettai for
    the information.

    In debug logging, report symbolic names for PAM flags on PAM function
    entry rather than the numeric PAM flags.  This helps with automated
    testing and with debugging PAM problems on different operating
    systems.

    Include <krb5/krb5.h> if <krb5.h> is missing, which permits finding
    the header file on NetBSD systems.  Thanks to Fredrik Pettai for the
    report.

    Replace the Kerberos compatibility layer with equivalent but
    better-structured code from rra-c-util 4.0.

    Avoid krb5-config and use manual library probing if --with-krb5-lib or
    --with-krb5-include were given to configure.  This avoids having to
    point configure at a nonexistent krb5-config to override its results.

    Use PATH_KRB5_CONFIG instead of KRB5_CONFIG to locate krb5-config in
    configure, to avoid a conflict with the variable used by the Kerberos
    libraries to find krb5.conf.

    Change references to Kerberos v5 to just Kerberos in the
    documentation.  Kerberos v5 has been the default version of Kerberos
    for over ten years now.

    Update to rra-c-util 4.0:

    * Add notices to all files copied over from rra-c-util.
    * Include strings.h for additional POSIX functions where found.
    * Fix detection of whether PAM uses const on FreeBSD.
    * Update warning flags for make warnings for GCC 4.6.1.
    * Limit symbol exports even on systems without GNU ld.
    * Fix replacement mkstemp to use long long where available.
    * Improve stripping of /usr/include from krb5-config results.
    * Use issetugid where available, not the misnamed issetuidgid.

    Update to C TAP Harness 1.9:

    * Add bmalloc, bcalloc, brealloc, and bstrdup TAP library functions.
    * Fix runtests to honor -s even if BUILD and -b aren't given.
    * Add test_tmpdir and test_tmpdir_free to TAP library.
    * runtests now frees all allocated resources on exit.

pam-krb5 4.4 (2010-12-31)

    Do not prompt for a password when try_pkinit is set and the module is
    built against MIT Kerberos.  This fixes a spurious password prompt
    introduced in 4.1, but partly reintroduces the bug fixed in 4.1 where
    the user's password is not saved in the PAM data if the authentication
    falls back to password when PKINIT fails.  This requires more work
    to fix and will be addressed in a subsequent release.  Thanks to
    Бранко Мајић (Branko Majic) for the report.

    Reorganize the configuration section of the pam_krb5 man page to
    divide the many PAM module options into sections.

    When probing for <ibm_svc/krb5_svc.h> (part of AIX's bundled Kerberos
    implementation), include <krb5.h> before attempting to include that
    header to quiet confusing Autoconf warnings.  Reported by Wilfried
    Weiss.

    Update to rra-c-util 3.0:

    * Fix compilation of the replacement snprintf for old systems.
    * Look for krb5-config in /usr/kerberos/bin for Red Hat systems.
    * Fix compilation with OpenBSD's Heimdal without separate libroken.

pam-krb5 4.3 (2010-06-09)

    Add a fast_ccache option that, if set, points to a Kerberos ticket
    cache used for Flexible Authentication Secure Tunneling (FAST) to
    protect the authentication.  FAST is a mechanism to protect Kerberos
    against password guessing attacks and provide other security
    improvements.  This option is only available when built against
    Kerberos libraries with FAST support (currently only MIT Kerberos 1.7
    or later).  Patch from Sam Hartman.

    Fix error in freeing a previous alt_auth_map setting when parsing
    configuration options.  Patch from Sam Hartman.

    Fix the linker flags for Solaris with the native compiler.  Thanks,
    Kevin Sumner.

pam-krb5 4.2 (2009-11-25)

    Add a new fail_pwchange option, which suppresses password changes for
    expired passwords and treats expired passwords the same as incorrect
    passwords.

    Include all the new header files from the portability code so that
    it will actually compile on non-Linux platforms.

pam-krb5 4.1 (2009-11-20)

    Return PAM_SUCCESS, not PAM_USER_UNKNOWN, for ignored users in
    pam_setcred.  It's safe to return success when doing nothing in
    pam_setcred because the stack has already been frozen after the
    authentication step, and returning an error causes the stack to fail
    on some other Linux PAM implementations.  Thanks, Ian Ward Comfort.

    In the second pass through the password group, prompt for the new
    password and store it in the PAM data even if the user is being
    ignored.  This is required to allow this module to be stacked with
    another module that uses use_authtok.  Without this behavior, the
    second module won't be able to work for any ignored user since it will
    see no saved password and use_authtok will reject the password change.

    Fix return status from pam_sm_acct_mgmt if we were unable to retrieve
    PAM_USER.

    Log successful authentications to syslog with priority LOG_INFO,
    including the Kerberos principal used for authentication.

    Log failed authentication to syslog with priority LOG_NOTICE,
    including roughly the same additional information that the Linux PAM
    pam_unix logs by default.

    Use pam_syslog for logging where available.  This means pam-krb5 log
    messages will look like all other log messages for Linux PAM modules
    on Linux.  Change the format of log messages on all platforms to
    hopefully be somewhat clearer.

    Rationalize logging.  The module should now follow the recommendations
    of the Linux PAM Module Writers' Guide for log levels.  More errors
    are logged at LOG_ERR instead of LOG_DEBUG, and system resource errors
    are now logged at LOG_CRIT instead of LOG_ERR.

    Add additional error and debug logging in places where significant
    actions or failures may happen without previously being logged.  Also
    add failure information from PAM or Kerberos libraries to messages
    where appropriate.

    Add replacement snprintf, vsnprintf, and mkstemp functions for
    pointless portability to ancient systems.

pam-krb5 4.0 (2009-11-13)

    UPGRADE WARNING: If you were using pam_krb5 with the use_authtok
    parameter in the password group, you will need to add use_first_pass
    to your configuration to keep the same behavior.  See below for
    details.

    UPGRADE WARNING: If you used the use_authtok parameter in the
    authentication group, you should change it to force_first_pass.

    Previous versions of this module incorrectly implemented the standard
    use_authtok parameter.  use_authtok applies only to the password group
    and says to use the new password stored in the PAM data rather than
    prompting for a new password.  It doesn't imply anything about where
    to obtain the old password, but it was implemented as requiring both
    the old and new password be in the PAM stack already.  This doesn't
    work when stacked with pam_cracklib.  Change use_authtok to have the
    correct meaning, which means that password group configurations may
    need to add use_first_pass to use_authtok to get the desired behavior.

    use_first_pass and try_first_pass no longer affect how the new
    password is obtained during password changes.  To use a password
    obtained by a previous module, use use_authtok instead.

    A new option, force_first_pass, is now supported for both the
    authentication and password groups.  It tells the module to always get
    the user's current password from the PAM data and fail without
    prompting if it isn't already set.  This is the meaning that
    use_authtok previously had for the current password.

    use_authtok no longer has any meaning for the authentication stack.
    Use force_first_pass instead, which does the same as use_authtok used
    to do.  use_authtok will be temporarily converted to force_first_pass
    in the authentication group and log a diagnostic, but this will be
    removed in the future.

    Stop returning PAM_IGNORE from pam_setcred if the user is ignored or
    didn't log in via Kerberos and instead return PAM_USER_UNKNOWN.  This
    fixes problems with the Linux PAM library where returning PAM_IGNORE
    would cause pam_setcred to fail even if other modules succeeded.
    Since pam_authenticate never returned PAM_IGNORE, this change should
    not cause any differences in behavior.

    Do not use issetugid on Solaris to determine when to avoid refreshing
    the ticket cache named in KRB5CCNAME during pam_setcred.  Instead,
    compare effective and real UID and GID and permit KRB5CCNAME to be
    trusted if they match.  This allows setuid screensavers on Solaris to
    refresh ticket caches and makes behavior on Solaris match other
    platforms.  Using issetugid is arguably safer since it protects
    programs that switch users via setuid to a user other than the calling
    user but still should not trust the original environment, but such
    programs are rare in the PAM context and should not be calling
    pam_setcred anyway unless the calling user is permitted to generally
    act as the target user.  Thanks, William Yang.

    Do the same logging in pam_sm_open_session and pam_sm_close_session as
    we do with the other functions.  This will mean pam_sm_open_session
    calls will be logged as pam_sm_open_session, not as pam_sm_setcred as
    before.

    pam-krb5 is now built using Automake and Libtool to bring it more in
    line with other software packages.  This means that it now relies on
    Libtool to know how to generate a loadable module rather than
    hand-configured linker rules.  This may improve portability on some
    platforms and may hurt it on other platforms.

    If configured with a prefix of /usr on Linux, use /lib, /lib32, or
    /lib64 as an installation path based on the size of an integer in the
    compilation environment rather than based on known 64-bit Linux
    variants.

    Update to rra-c-util 2.0:

    * Sanity-check the results of krb5-config before proceeding.
    * Fall back on manual probing if krb5-config results don't work.
    * Don't break if the user clobbers CPPFLAGS at build time.

pam-krb5 3.15 (2009-07-21)

    Fix a segfault (null pointer dereference) if pam-krb5 is configured
    with use_first_pass or use_authtok and there is no password stored in
    the PAM stack.  Thanks to Jonathan Guthrie for the bug report.

pam-krb5 3.14 (2009-07-18)

    Return PAM_IGNORE instead of PAM_PERM_DENIED from pam_chauthtok for
    ignored users.  This allows making the Kerberos PAM module mandatory
    for password changes and still falling back to other PAM modules for
    ignored users.  Thanks, Steve Langasek.

    Always treat the empty password as an authentication failure rather
    than passing it to the Kerberos libraries.  The Kerberos libraries
    may treat it as equivalent to no password and prompt for a password
    without our knowledge, leading to the user authenticating with a
    different password than the one stored in the PAM stack.  This could
    cause unexpected problems with some PAM configurations.  It's safer
    to make the assumption that the empty password is always invalid and
    reject it outside of the Kerberos libraries.  Thanks, Sanjay Sha.

    Fix error handling if ticket cache initialization fails.
    Authentication will still fail, but this avoids a segfault from a
    double-free of the ticket cache structure.  The most common cause of
    this problem was having the attempt to initialize the ticket cache
    be blocked by AppArmor.  Thanks to Alex Mauer for the report.

    Call krb5_free_error_string correctly, fixing a portability issue
    when building against Heimdal.  Thanks, Andrew Drake.

    Work around a deficiency in pam_putenv on FreeBSD 7.2 that doesn't
    allow deleting environment variables, only setting them to empty
    values.  Thanks, Andrew Elble.

pam-krb5 3.13 (2009-02-11)

    SECURITY: When built against MIT Kerberos, if pam_krb5 is called in a
    setuid context (effective UID or GID doesn't match the real UID or
    GID), use krb5_init_secure_context instead of krb5_init_context.  This
    ignores environment variable settings for the local Kerberos
    configuration and keytab.  Previous versions could allow a local
    attacker to point a setuid program that used PAM authentication at a
    different Kerberos configuration under the attacker's control,
    possibly resulting in privilege escalation.  Heimdal handles this
    logic within the Kerberos libraries and therefore was not affected.
    (CVE-2009-0360)

    SECURITY: Disable pam_setcred(PAM_REINITIALIZE_CREDS) for setuid
    applications.  If pam_krb5 detects this call in a setuid context, it
    now logs an error and returns success without doing anything.  Solaris
    su calls pam_setcred with that option rather than PAM_ESTABLISH_CREDS
    after authentication and without wiping the environment, leading
    previous versions of pam_krb5 to trust the KRB5CCNAME environment
    variable for the ticket cache location.  This permitted an attacker to
    use previous versions of pam_krb5 to overwrite arbitrary files with
    Kerberos credential caches that were left owned by the attacker.
    Setuid screen lock programs may also be affected.  Discovered by Derek
    Chan and reported by Steven Luo.  Thanks to Sam Hartman and Jeffrey
    Hutzelman for additional analysis.  (CVE-2009-0361)

    If a prefix of /usr is requested at configure time, install the PAM
    module into /lib/security or /lib64/security on Linux, matching the
    standard Linux-PAM module location.  Use lib64 instead of lib on
    64-bit SPARC, PowerPC, and S390 Linux as well as x86_64.  Patch from
    Peter Breitenlohner.

    Fix a build problem when builddir != srcdir introduced in 3.11.  Patch
    from Peter Breitenlohner.

    Add support for the old Heimdal krb5_get_error_string interface.
    Thanks, Chaskiel Grundman.

    Add --with-krb5-include and --with-krb5-lib configure options to allow
    more specific setting of paths if necessary.

    If krb5-config isn't available, attempt to determine if the library
    directory for the Kerberos libraries is lib32 or lib64 instead of lib
    and set LDFLAGS accordingly.  Based on an idea from the CMU Autoconf
    macros.

pam-krb5 3.12 (2008-11-13)

    Add alt_auth_map configuration option, which allows mapping of
    usernames to alternative Kerberos principals, useful primarily for
    using particular instances for access to a given PAM-authenticated
    service.  Also added force_alt_auth and only_alt_auth options to
    control when alternative Kerberos principals are used.  Patch from
    Booker Bense.

    Fix incorrect error handling for bad .k5login ownership when
    search_k5login is set, leading to a NULL pointer dereference and a
    segfault.  Thanks, Andrew Deason.

    Fix double-free of the ticket cache structure if creation of the
    ticket cache in the session module fails.  Thanks, Jens Jorgensen.

    Log all syslog messages to LOG_AUTHPRIV, or LOG_AUTH if the system
    doesn't define LOG_AUTHPRIV.  Thanks, Mark Painter.

    Fix portability to AIX's bundled Kerberos.  Thanks, Markus Moeller.

    When debugging is enabled, log an exit status of PAM_IGNORE as ignore
    rather than failure.

    Document that pam-krb5 must be listed in the session group as well as
    the auth group for interactive logins or OpenSSH won't set up the
    user's credential cache properly.

    Document adding ignore=ignore to complex [] action configuration for
    the session and account groups since the module now returns PAM_IGNORE
    instead of PAM_SUCCESS for accounts that didn't use Kerberos.

pam-krb5 3.11 (2008-07-10)

    pam_setcred, pam_open_session, and pam_acct_mgmt now return PAM_IGNORE
    for ignored users or non-Kerberos logins rather than PAM_SUCCESS.
    This return code tells the PAM library to continue as if the module
    were not present in the configuration and allows sufficient to be
    meaningful for pam-krb5 in account and session groups.
    pam_authenticate continues to return failure for ignored users;
    PAM_IGNORE would arguably be more correct, but increases the risk of
    security holes through incorrect configuration.

    Support correct password expiration handling according to the PAM
    standard (returning success from pam_authenticate and an error from
    pam_acct_mgmt and completing the authentication after pam_chauthotk).
    This is not the default since it opens security holes with broken
    applications that don't call pam_acct_mgmt or ignore its exit status.
    To enable it, set the PAM option defer_pwchange for applications known
    to make the correct PAM calls and check return codes.

    Add a new option to attempt change of expired passwords during
    pam_authenticate if Kerberos authentication returns a password expired
    error.  Normally, the Kerberos library will do this for you, but some
    Kerberos libraries (notably Solaris) disable that code.  This option
    allows simulation of the normal Kerberos library behavior on those
    platforms.

    Work around an apparent Heimdal bug when krb5_free_cred_contents is
    called on an all-zero credential structure.  It's not clear what's
    going on here and the Heimdal code looks correct, but avoiding the
    call fixes the problem.

    Warn if more than one of use_authtok, use_first_pass, and
    try_first_pass is set and use the strongest of the one set.

    Remove the workaround for versions of MIT Kerberos that didn't
    initialize a krb5_get_init_creds_opt structure on opt_alloc.  This bug
    was only present in early versions of 1.6; the correct fix is to
    upgrade.

    Add an additional header check for AIX's bundled Kerberos.

    If KRB5_CONFIG was explicitly set in the environment, don't use a
    different krb5-config based on --with-krb5.  If krb5-config isn't
    executable, don't use it.  This allows one to force library probing by
    setting KRB5_CONFIG to point to a nonexistent file.

    Sanity-check the results of krb5-config before proceeding and error
    out in configure if they don't work.

    For Kerberos libraries without krb5-config, also check for networking
    libraries (-lsocket and friends) before checking for Kerberos
    libraries in case shared library dependencies are broken.

    Fix Autoconf syntax error when probing for libkrb5support.  Thanks,
    Mike Garrison.

    Set an explicit visibility of hidden for all internal functions at
    compile time if gcc is used to permit better optimization.  Hide all
    functions except the official interfaces using a version script on
    Linux.  This protects against leaking symbols into the application
    namespace and provides some mild optimization benefit.

    Fix the probing of PAM headers for const on Mac OS X.  This will
    suppress some harmless compiler warnings there.  Thanks, Markus
    Moeller.

pam-krb5 3.10 (2007-12-28)

    The workaround for krb5_get_init_creds_opt_alloc problems in MIT
    Kerberos 1.6 broke PKINIT support with Heimdal.  Only apply that
    workaround when building against the MIT Kerberos libraries.  Thanks
    to Jaakko Pero for the detailed report.

    If no_ccache is set, always exit successfully from pam_setcred or
    pam_open_session, even if we couldn't retrieve module data.  Thanks,
    Markus Moeller.

    When keytab is set, properly handle failure to create a keytab cursor
    and don't assume that the cursor is valid.  Thanks, Markus Moeller.

    Define _ALL_SOURCE on AIX to get prototypes for snprintf.

    Add additional portability glue and Autoconf probes to support
    building against the version of Kerberos bundled with AIX.  Support
    for this should be considered alpha in this release.  Thanks to Markus
    Moeller for the initial patch.

pam-krb5 3.9 (2007-11-12)

    If use_authtok is set, fail even if we can retrieve the stored PAM
    password if that password is set to NULL.  Apparently that can happen
    in some cases, such as with pam_cracklib.  Thanks to Christian Holler
    for the diagnosis and a patch.

    Add a new clear_on_fail option for the password group.  If set, when a
    password change fails, set PAM_AUTHTOK to NULL so that subsequent
    modules in the PAM stack with use_authtok set will also fail.  Just
    returning failure doesn't abort the stack on the second pass when
    actual password changes are made.  This is not the default since it
    interferes with other desirable PAM configurations.  It's useful
    primarily when using the PAM stack to synchronize passwords between
    multiple environments.  Thanks to Christian Holler and Tomas Mraz for
    the analysis.

    Fix portability issues with Heimdal, versions of PAM that don't
    provide pam_modutil_getpwnam, and compiler warnings when building
    PKINIT support.  Thanks, Martin von Gagern.

    Fix parsing of the keytab PAM option.  Thanks, Markus Moeller.

    Return PAM_AUTHINFO_UNAVAIL instead of PAM_AUTH_ERR when unable to
    resolve the Kerberos realm.  Thanks, Frank Cornelissen.

    Add a new debugging section to the README.

pam-krb5 3.8 (2007-09-30)

    krb5_get_init_creds_opt_alloc doesn't initialize the returned
    structure with the default flags in MIT Kerberos 1.6, which meant that
    users with expired passwords were not being prompted to change their
    password but just rejected.  Fixed by always calling _init before
    setting the credential flags, regardless of the provenance of the opt
    structure.  Thanks, Michael Richters.

    Fix configure and Makefile glue so that Mac OS X and HP-UX have a
    chance of working (still untested).

    Add a make warnings target with aggressive gcc warning options.  Treat
    negative minimum UIDs as zero so that UID comparisons can always be
    done unsigned.  Add casts and unused attributes as needed.

pam-krb5 3.7 (2007-09-29)

    If given an explicit keytab path to use for credential verification,
    use the first principal found in that keytab as the principal for
    verification rather than the library default (which is normally the
    host/* principal for the local system and may not be found in that
    keytab).

    When authenticating, don't store our context data until after
    authentication has succeeded.  Otherwise, we may destroy the ticket
    cache of a previous successful authentication.  This bug would only
    affect configurations where pam_krb5 was run multiple times with
    different settings, such as multiple realms.  Thanks to Dave Botsch
    for the report.

    Use pam_modutil_getpwnam instead of getpwnam if available for better
    thread safety.

    Don't store PAM data unless we're saving a ticket cache.  All other
    calls use it for is to find the ticket cache, so without a cache it's
    pointless and means we run the risk of stomping on ourselves in
    multithreaded programs.

    Still canonicalize the PAM user before returning when not saving a
    ticket cache.

    Fix determination of linker flags on non-x86_64 Linux.  Always link
    with -fPIC when using GCC, just in case.

    Add compilation options for Mac OS X and HP-UX (untested).

    Use pam_krb5 instead of ctx for our PAM data name to reduce the
    chances of collision.

pam-krb5 3.6 (2007-09-18)

    When the local user doesn't exist and search_k5login is enabled, fall
    back to simple Kerberos authentication just as if the account existed
    with no .k5login file.  This avoids trying to verify an all-zero
    credentials structure, leading to non-expoloitable segfaults on x86_64
    systems.  Be more careful in general about setting error codes in the
    search_k5login implementation.

    Explicitly clear the forwardable and proxiable options and don't ask
    for renewable tickets when getting a ticket for the password changing
    service.  Otherwise, system-wide defaults and PAM configuration will
    apply to those tickets as well and the resulting ticket request may be
    rejected based on KDC configuration.  Based on a patch by Sergio
    Gelato.

    Do username canonicalization earlier so that .k5login checking and
    similar work uses the correct username but only change the PAM
    username if authentication succeeds.  Document that username
    canonicalization won't work with unmodified OpenSSH and with several
    common PAM modules.  Thanks to R. Scott Bailey for the bug report and
    analysis.

    Add a prompt_principal option which, if set, causes the PAM module to
    prompt the user for the Kerberos principal to use for authentication
    before prompting for the password.

    Try to determine whether the PAM headers use const in the prototypes
    of such things as pam_get_item and adjust accordingly.  This should
    address most compiler warnings on Solaris.  Thanks, Markus Moeller.

    Change lib to lib64 on x86_64 Linux to allow for the magical $ISA
    parameter in Red Hat's PAM configuration.  Hopefully this won't cause
    problems elsewhere.

    Support DESTDIR for make install.

pam-krb5 3.5 (2007-04-10)

    Don't try to chown non-FILE ticket caches, which among other things
    breaks using pam-krb5 with Heimdal KCM caches.  Thanks, Jeremy
    Jackson.

    When logging session deletion via pam_setcred or pam_close_session,
    don't look for the username in the PAM context after it's been freed.
    Thanks, Markus Moeller.

    Map more Kerberos status codes to PAM status codes for authentication
    errors.

pam-krb5 3.4 (2007-01-28)

    More compilation fixes for Heimdal 0.7, which has a pkinit function
    but takes a different number of arguments.  Thanks, Morgan LEFIEUX.

    Never call error_message directly on Heimdal.  krb5_get_err_text can
    cope with a NULL context and krb5-config on Heimdal doesn't include
    -lcom_err.

    Handle a NULL return from krb5_get_error_message, since that seems
    possible in some edge cases.

    Call krb5_get_error_message on Heimdal as well if it's available,
    since it's supported by the 0.8 release candidates.

pam-krb5 3.3 (2007-01-24)

    Support the new MIT Kerberos error message functions.

    Fix compilation errors in the Heimdal PKINIT support and don't be
    confused by a similar function in the MIT Kerberos PKINIT branch.
    Thanks to Douglas E. Engert for the testing and patch.

    Fix compilation errors with Heimdal 0.7, which has some of the PKINIT
    functions but doesn't define the same error codes.  Thanks, Morgan
    LEFIEUX.

    Initial support for the MIT Kerberos PKINIT branch, which uses a
    different mechanism for configuring PKINIT support than Heimdal.  Also
    support configuration of general preauth parameters for the MIT
    preauth plugin system via the preauth_opt option.  Thanks to Douglas
    E. Engert for the initial patch.

    If use_pkinit is set in the PAM configuration and PKINIT isn't
    available or cannot be forced, always fail authentication.

pam-krb5 3.2 (2007-01-16)

    This release fixes numerous bugs all identified by Douglas E. Engert
    while testing with Heimdal and PKINIT support.  Thank you!

    Rewrite the code to drop the credlist data structure since we only
    ever have one set of credentials, allocate new krb5_creds objects, and
    do proper memory management, which should plug some memory leaks of
    the contents of krb5_creds objects.

    Probe for the correct Heimdal function to set default initial
    credential options.

    Prefix the default cache path with "FILE:" to make the cache type
    explicit.

    Fix installation of the manual page when building from a different
    directory than the source directory.

    Fix several compilation errors with the PKINIT support with Heimdal
    0.8rc1 or later.  This code should still be considered alpha-quality.

pam-krb5 3.1 (2007-01-03)

    Fix an infinite loop with failed Kerberos authentication and a doubled
    colon that causes a syntax error with some compilers.  Thanks, Markus
    Moeller.

    Move the check for users we should ignore to pam_sm_authenticate
    from pamk5_password_auth so that it's consistently done in the API
    function.  This also avoids bogus log messages when authenticating as
    an ignored user with debug enabled.

pam-krb5 3.0 (2006-12-18)

    Add preliminary PKINIT support, contributed by Douglas E. Engert.
    I reorganized and refactored the code extensively and it therefore may
    not compile; until it has received more testing, it should be
    considered alpha-quality.  Currently, PKINIT support requires Heimdal
    0.8rc1 or later.

    Add a keytab configuration option to use a different keytab for
    initial credential validation.

    Add a ticket_lifetime configuration option to set the lifetime of
    obtained credentials.

    Add the banner and expose_account configuration options, which control
    the prompts for authentication and password changing.  Provide more
    informative prompts when changing passwords.

    Work around a bug in MIT Kerberos prior to 1.4 causing the library to
    cache the default realm and assume a particular realm even if the
    default realm is later changed.  This bug prevented running two
    instances of pam-krb5 with different realm settings in the same PAM
    stack.  Thanks, Dave Botsch.

    Honor PAM_SILENT when the Kerberos library prompts for more
    information, passing to the application only prompts.

    If PAM_USER is set to a fully-qualified principal that the Kerberos
    library can map to a local account name, reset PAM_USER to that local
    account name after authentication.

    Avoid memory leaks in the Kerberos prompter by freeing the PAM
    response strings.  We were already doing this elsewhere and the world
    didn't end, so assume that it's safe for the PAM module to do this.
    Also avoid memory leaks in some unusual error conditions.

    Return unknown user rather than internal error when attempting
    authentication of a user we're supposed to ignore.

    When debug is enabled, report the principal for which we're attempting
    authentication to help catch realm configuration errors.

    Document the broken behavior of old versions of OpenSSH, which tell
    PAM to refresh credentials rather than opening a session.  Thanks,
    Michael C. Garrison.

    Add a link to the distribution page to the pam-krb5 man page.

    Extensive refactoring and reorganization of the code.

pam-krb5 2.6 (2006-11-28)

    Don't assume the pointer set by pam_get_user is usable over the life
    of the PAM module; instead, save a local copy.

    Avoid a use of already freed memory when debugging is enabled.

    Use __func__ instead of __FUNCTION__ and provide a fallback for older
    versions of gcc and for systems that support neither.  Should fix
    compilation issues with Sun's C compiler.

    On platforms where we know the appropriate compiler flags, try to
    build the module so that symbols are resolved within the module in
    preference to any externally available symbols.  Also add the
    hopefully correct compiler flags for Sun's C compiler.

pam-krb5 2.5 (2006-11-03)

    Don't free the results of pam_get_item(PAM_AUTHTOK) when changing
    passwords.  Thanks, Arne Nordmark.

    Be a bit more thorough when checking authorization in
    pam_sm_acct_mgmt.  Re-retrieve the value of user in case the
    application changed it, and if we have a ticket cache (we may not even
    after a successful authentication if no_ccache was specified),
    retrieve the principal from it rather than using the principal from
    the context.

    Overwrite passwords with 0 before freeing them, just out of paranoia
    (and because PAM also does this internally).

pam-krb5 2.4 (2006-10-05)

    Fix compilation problems with Heimdal.  Thanks, Matthijs Mohlmann and
    Douglas Engert.

    Check for memory allocation failures when parsing PAM options rather
    than segfaulting.

    Fix several places where an uninitialized context could have been
    passed into the argument parsing function.

    Refactor the code to read configuration from krb5.conf to be easier
    to read and understand.  Parse renew_lifetime immediately and always
    report an error rather than deferring time parsing until acquiring
    tickets.

    Log errors (not just authentication failures) at the LOG_ERR level
    to match (some of) the recommendations of the Linux PAM documentation.

    Log an error when an unknown option is passed via the PAM
    configuration.

pam-krb5 2.3 (2006-09-03)

    Fix the interface between the Kerberos prompting function and the
    PAM conversation function on Linux.  Prior to this fix, the PAM module
    would only work on Solaris if Kerberos passed multiple prompts, which
    happens when an account requires a password change.  Solaris and Linux
    PAM implementations expect a different structure of pam_message
    structs in the conversation function; use a workaround to cater to
    both of them.  Based on a patch by Joachim Keltsch.

    Implement retain_after_close, which specifies that the PAM module
    should never destroy the user's ticket cache, even on session end.

    Adjust for the differences in Solaris's PAM libraries:  Include
    pam_appl.h everywhere for structure and type definitions, and add
    portability workarounds for the return statuses missing from the
    Solaris implementation.

pam-krb5 2.2 (2006-08-28)

    Allow the default realm to be overridden in the PAM options.

    Use the realm, default or otherwise, when reading options from
    krb5.conf so that realm-specific sections in [appdefaults] work
    correctly.

    Update the build and installation documentation for the new
    Autoconf-based build system.  This should have been in the last
    release but was missed.

    Initialize ticket options correctly when built with Heimdal.

    Fix a typo that caused the Heimdal support not to compile.  Thanks,
    Matthijs Mohlmann.

pam-krb5 2.1 (2006-08-26)

    Strip off a FILE: prefix from the cache path before creating it in
    case the user set ccache or ccache_dir with a cache type prefix.
    Thanks to Björn Torkelsson for the patch.

    Added an Autoconf script to distinguish between Heimdal and MIT
    Kerberos and take care of other portability issues.  Rewrote the
    Makefile accordingly.

    Added portability and error reporting fixes for Heimdal, thanks to
    Matthijs Mohlmann.

pam-krb5 2.0 (2006-08-11)

    Always use a disk cache for temporary storage of credentials between
    authentication and setcred or session initialization.  This allows the
    module to work correctly with OpenSSH ChallengeResponseAuthentication.

    Add support for some PAM options that were supported by the
    Sourceforge K5 PAM module, most notably minimum_uid and
    renew_lifetime.

    Support setting many PAM options from krb5.conf as well as on the PAM
    command line, using the same application section as the Sourceforge
    PAM module.  Use the profile reading functions provided by the
    Kerberos libraries.

    Add support for use_authtok, which is like use_first_pass except that
    it will never prompt even if no password is currently set.

    Add a search_k5login option to check the user's password against every
    principal listed in .k5login, to support use of this module to
    authenticate user access to shared accounts.

    Add an ignore_k5login option that bypasses all checks of .k5login
    files entirely and relies solely on krb5_aname_to_localname checks.

    Re-add the ccache option to specify the exact file name of the ticket
    cache, and allow for randomization using mkstemp even when this option
    is used.

    Only call krb5_kuserok (the .k5login check) when the account to which
    the user is authenticating is a local account.  It's up to the
    application to handle authorization checks for non-local accounts.

    Support preliminary checks for password changing by using that to
    obtain the user's current credentials.  Correctly handle saved
    passwords from previous authentications or password changes when
    changing passwords, and correctly set the saved passwords for
    subsequent password changes in the PAM stack.

    Only initialize the ticket cache once, no matter how many times
    setcred is called.  This saves duplicate work and works around a bug
    in X.org xdm that otherwise causes it to lose the PAM environment.

    When reinitializing a ticket cache, never reinitialize the temporary
    cache created by the authentication call.  Instead, fall back to the
    default ticket cache name if KRB5CCNAME isn't set.

    Improve support for no_ccache.  Now, it doesn't even generate a
    temporary ticket cache during authentication but only uses an
    in-memory credential list.

    Do user ticket validation using the standard Kerberos library call
    rather than rolling our own code.  This means that the user can now
    set options in krb5.conf to control whether that call should fail if
    the local keytab isn't readable or contains no usable keys.

    Completely rewrite the man page.  Clean it up and make it more
    readable and fully document all of the options.  Also rewrite the
    README file and clean up the rest of the package documentation.

    Don't create a ticket cache until after successful authentication.

    Understand the FILE: prefix to Kerberos ticket cache names and compare
    and chown ticket caches properly with that prefix.

    Add a trailing nul to the password in the Kerberos prompter function,
    since some code relies on it being there.

    Review the return status of each PAM function and ensure that we only
    return failure statuses that are supported for that function.

    Rename all internal functions with a pamk5_* prefix to avoid
    conflicting with any application or system library functions.

    Eliminate global variables in the PAM module and do a better job at
    cleaning up memory usage.  There are still a few places where the PAM
    conversation functions may leak memory due to an incomplete
    specification in the PAM API on who should free what memory.

    The logging messages produced when debug is set should now be more
    consistent and more complete.

pam-krb5 1.2 (2005-09-27)

    Don't reinitialize the ticket cache if the old and new cache have the
    same name, since otherwise we end up destroying it.

    Always set KRB5CCNAME, even when reinitializing.

    When reinitializing, look for the ticket cache in the saved context
    even if KRB5CCNAME isn't set.  OpenSSH calls it this way.

    Drop the ccache option and add ccache_dir instead, which only
    specifies the directory for ticket caches and is therefore easier to
    implement.

pam-krb5 1.1 (2005-08-31)

    Add support for reinitialization/refreshing of credentials in
    pam_sm_setcred.

    Set PAM_AUTHTOK and PAM_OLDAUTHTOK when authenticating to better
    support stacking this module with others.

    Add an ignore_root option to not do anything when the account to which
    the user is authenticating is root.  This allows one to log in via
    console as root even when the network is down (thereby breaking the
    PAM module in ways that login doesn't like due to timeouts in the
    Kerberos libraries).

    Store the entire context structure in PAM's memory rather than just
    the name of the ticket cache so that we can pass around more data to
    ourself.

    Bring errors more in line with the official PAM specification.

    Move prompt generation into the PAM module rather than letting the
    Kerberos library generate the prompt.  This way we don't leak
    principal information to the caller, and the non-standard prompt also
    broke some applications like gksudo.

    Support session management and destruction of the ticket cache on
    close of session.

    Don't require that the user have a local account on the system.

    Include the user UID in the default ticket cache name so that rpc.gssd
    and similar programs can find it.