https://bugzilla.novell.com/show_bug.cgi?id=414783 Thomas Biege changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |security-team@suse.de AssignedTo|security-team@suse.de |mc@novell.com -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=414783 User admin@dmarkey.com added comment https://bugzilla.novell.com/show_bug.cgi?id=414783#c2 --- Comment #2 from David Markey 2008-08-11 07:28:03 MDT --- Created an attachment (id=232712) --> (https://bugzilla.novell.com/attachment.cgi?id=232712) Files requested. Beware about the symbolic links in this file. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=414783 User admin@dmarkey.com added comment https://bugzilla.novell.com/show_bug.cgi?id=414783#c4 --- Comment #4 from David Markey 2008-08-11 08:07:46 MDT --- The local password is different from the kerberos expired password. I followed your instructions and set the local password in /etc/shadow to * and the exact same behavior was observed. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=414783 User mc@novell.com added comment https://bugzilla.novell.com/show_bug.cgi?id=414783#c6 Michael Calmer changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |RESOLVED Info Provider|admin@dmarkey.com | Resolution| |FIXED --- Comment #6 from Michael Calmer 2008-08-11 09:35:27 MDT --- Maybe I tested only with "passwd" command but not with an expired account. Thanks for your report. The problem is not the pam_krb5 package, the bug is in pam_unix2 (pam-modules package). It returns too early with a success. I have submitted a fix for the next openSUSE version (FACTORY). I updated also the buildservice project Linux-PAM. If you download the package pam-modules-11.0-34.1.i586.rpm (or higher version) the fix should be included. We will not make a official maintenance update. krb5 is not in main focus of openSUSE 11.0 and it is not security relevant, because you need to know the old password. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=414783 User lnussel@novell.com added comment https://bugzilla.novell.com/show_bug.cgi?id=414783#c16 Ludwig Nussel changed: What |Removed |Added ---------------------------------------------------------------------------- Status|REOPENED |RESOLVED Resolution| |FIXED --- Comment #16 from Ludwig Nussel 2008-08-19 05:43:37 MDT --- After a talk with Michael we agreed to not handle this issue as security problem. After all the authentication is performed properly. Only the account expiration is not enforced in this special case. The configuration of having a local user in combination with kerberos is considered rather unusual and the behavior more or less undefined. Password expiration should work correctly if you do not store the account data locally but get it via e.g. ldap or nis. Thanks Michael for the explanation! David: the workaround for you is to either not have the user in /etc/passwd or to use the packages from the build service. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.