FS#39083 - [pam_mysql] make_scrambled_password outdated

Attached to Project: Community Packages
Opened by Grzegorz (gregosky) - Friday, 28 February 2014, 20:06 GMT
Last edited by Sven-Hendrik Haase (Svenstaro) - Saturday, 01 March 2014, 16:37 GMT
Task Type Bug Report
Category Packages
Status Closed
Assigned To Sven-Hendrik Haase (Svenstaro)
Architecture All
Severity Critical
Priority Normal
Reported Version
Due in Version Undecided
Due Date Undecided
Percent Complete 100%
Votes 0
Private No

Details

Description:

Packages relying on pam_mysql can't authenticate since latest mariadb update. It seems make_scrambled_password was now removed (it was marked as outdated until this release of mariadb).

Additional info:
* package version(s)

pam_mysql-0.7RC1-7-x86_64.pkg.tar.xz
mariadb-5.5.36-1-x86_64.pkg.tar.xz

* config and/or log files etc.

Steps to reproduce:

Example - saslauth with pam_mysql as authentication backend.

* Install saslauth
* configure /etc/pam.d/smtpd by adding following lines:
auth required /usr/lib/security/pam_mysql.so user=<type_db_user_here> passwd=<type_db_user_password_here> host=/run/mysqld.sock db=<type_db_name_here> table=<type_table_name_here> usercolumn=<type_user_column_name_here> passwdcolumn=<type_password_column_here> crypt=0 verbose=1
account sufficient /usr/lib/security/pam_mysql.so user=<type_db_user_here> passwd=<type_db_user_password_here> host=/run/mysqld.sock db=<type_db_name_here> table=<type_table_name_here> usercolumn=<type_user_column_name_here> passwdcolumn=<type_password_column_here> crypt=0 verbose=1
* create mariadb database and name it <type_db_name_here>
* create mariadb user and name it <type_db_user_here>
* set <type_db_user_here> password to <type_db_user_password_here>
* allow <type_db_user_here> SELECT privileges from any table within <type_db_name_here>
* create <type_table_name_here> in <type_db_name_here> as shown below with two columns: <type_user_column_name_here> vachar(50), <type_password_column_here> varchar(50)
* insert example data into <type_db_name_here>.<type_table_name_here> (type plain password) - i.e. as shown below:
+----------------------------+-----------------------------+
|<type_user_column_name_here>| <type_password_column_here> |
+----------------------------+-----------------------------+
| test_user@test_realm.com | test_password |
+----------------------------+-----------------------------+
* start saslauthd
* test saslauthd with following command:
testsaslauthd -u @test_realm.com -p test_password -s smtp

log output:

PAM unable to dlopen(/usr/lib/security/pam_mysql.so): /usr/lib/security/pam_mysql.so: undefined symbol: make_scrambled_password
PAM adding faulty module: /usr/lib/security/pam_mysql.so
DEBUG: auth_pam: pam_authenticate failed: Module is unknown
do_auth: auth failure: [user=test_user] [service=smtp] [realm=@test_realm.com] [mech=pam] [reason=PAM auth error]
This task depends upon

Closed by  Sven-Hendrik Haase (Svenstaro)
Saturday, 01 March 2014, 16:37 GMT
Reason for closing:  Won't fix
Additional comments about closing:  Package dropped to AUR
Comment by Grzegorz (gregosky) - Friday, 28 February 2014, 21:12 GMT
I found a patch that seems to replace make_scrambled_password with some dummy my_make_scrambled_password (which I think is just a workaround rather than solution):

https://lists.fedoraproject.org/pipermail/scm-commits/2011-June/613231.html
Comment by Sven-Hendrik Haase (Svenstaro) - Saturday, 01 March 2014, 09:40 GMT
Yeah, this package is going to AUR.
Comment by Grzegorz (gregosky) - Saturday, 01 March 2014, 12:20 GMT
So there will be no mysql authentication backend available via pam available from community repositories?
Comment by Sven-Hendrik Haase (Svenstaro) - Saturday, 01 March 2014, 13:24 GMT
Well, pam_mysql is supposed to provide security but it has been unmaintained for 8 years! In the security world, that is a bit too long. I don't really feel comfortable providing official support for that. However, I found https://github.com/NigelCunningham/pam-MySQL and might see how that does.
Comment by Sven-Hendrik Haase (Svenstaro) - Saturday, 01 March 2014, 13:30 GMT
Eh, I had a look. I'm going to drop it. It's too sensitive and too much code to rely on magic.

Loading...