i.pamconf revision f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01
#!/bin/sh
#
# CDDL HEADER START
#
# The contents of this file are subject to the terms of the
# Common Development and Distribution License (the "License").
# You may not use this file except in compliance with the License.
#
# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
# or http://www.opensolaris.org/os/licensing.
# See the License for the specific language governing permissions
# and limitations under the License.
#
# When distributing Covered Code, include this CDDL HEADER in each
# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
# If applicable, add the following below this CDDL HEADER, with the
# fields enclosed by brackets "[]" replaced with your own identifying
# information: Portions Copyright [yyyy] [name of copyright owner]
#
# CDDL HEADER END
#
#
#ident "%Z%%M% %I% %E% SMI"
#
# Copyright 2007 Sun Microsystems, Inc. All rights reserved.
# Use is subject to license terms.
#
CLEANUP_FILE=/tmp/CLEANUP
PAM_TMP=/tmp/pam_conf.$$
KERB_ENTRIES=$PAM_TMP/scr.$$
PPP_ENTRIES=$PAM_TMP/scp.$$
CRON_ENTRIES=$PAM_TMP/scc.$$
TX_ENTRIES=$PAM_TMP/sct.$$
mkdir $PAM_TMP || exit 1
PATH="/usr/bin:/usr/sbin:${PATH}"
export PATH
setup_kerb_changes() {
#
# No comments or blanks lines allowed in entries below
#
cat > ${KERB_ENTRIES} << EOF
krlogin auth required pam_unix_cred.so.1
krlogin auth required pam_krb5.so.1
krsh auth required pam_unix_cred.so.1
krsh auth required pam_krb5.so.1
ktelnet auth required pam_unix_cred.so.1
ktelnet auth required pam_krb5.so.1
EOF
}
setup_ppp_changes() {
#
# No comments or blanks lines allowed in entries below
#
cat > ${PPP_ENTRIES} << EOF
ppp auth requisite pam_authtok_get.so.1
ppp auth required pam_dhkeys.so.1
ppp auth required pam_unix_cred.so.1
ppp auth required pam_unix_auth.so.1
ppp auth required pam_dial_auth.so.1
EOF
}
setup_cron_changes(){
#
# No comments or blanks lines allowed in entries below
#
cat > ${CRON_ENTRIES} << EOF
cron account required pam_unix_account.so.1
EOF
}
setup_tx_changes(){
#
# No comments or blanks lines allowed in entries below
#
cat > ${TX_ENTRIES} << EOF
dtlogin account requisite pam_roles.so.1
dtlogin account required pam_unix_account.so.1
dtsession account requisite pam_roles.so.1
dtsession account required pam_unix_account.so.1
gdm account requisite pam_roles.so.1
gdm account required pam_unix_account.so.1
xscreensaver account requisite pam_roles.so.1
xscreensaver account required pam_unix_account.so.1
passwd account requisite pam_roles.so.1
passwd account required pam_unix_account.so.1
dtpasswd account requisite pam_roles.so.1
dtpasswd account required pam_unix_account.so.1
other account required pam_tsol_account.so.1
EOF
}
#
setup_kerb_changes
setup_ppp_changes
setup_cron_changes
setup_tx_changes
while read src dest
do
if [ ! -f $dest ] ; then
cp $src $dest
else
echo "${dest} default entries updated, \c" \
>> ${CLEANUP_FILE}
echo "please examine/update customized entries" \
>> ${CLEANUP_FILE}
#
#Update pam.conf with relative pathname
#
if grep '/usr/lib/security/$ISA/pam_' $dest > /dev/null 2>&1; then
sed 's,/usr/lib/security/$ISA/, ', \
$dest > /tmp/pamconf.$$
cp /tmp/pamconf.$$ $dest
rm -f /tmp/pamconf.$$
fi
if grep '/usr/lib/security/pam_' $dest > /dev/null 2>&1; then
sed 's,/usr/lib/security/, ', \
$dest > /tmp/pamconf.$$
cp /tmp/pamconf.$$ $dest
rm -f /tmp/pamconf.$$
fi
#
# Update pam.conf with entries for PAM modules pam_authtok_get,
# pam_authtok_check, pam_authtok_store, pam_unix_auth, pam_unix_account,
# pam_unix_cred, pam_unix_session, pam_dhkeys and pam_passwd_auth
#
echo "${dest} updating pam_unix with default PAM entries \c" \
>> ${CLEANUP_FILE}
echo "please examine/update any new entries" \
>> ${CLEANUP_FILE}
nawk '/^#/ { print; next } \
$4 ~ /pam_unix.so/ && $2 == "auth" { \
print $1 "\t" $2 " " "requisite\t\t" \
"pam_authtok_get.so.1"; \
print $1 "\t" $2 " " $3 "\t\t" \
"pam_dhkeys.so.1"; \
print $1 "\t" $2 " " $3 "\t\t" \
"pam_unix_cred.so.1"; \
print $1 "\t" $2 " " $3 "\t\t" \
"pam_unix_auth.so.1"; \
next \
} \
$4 ~ /pam_passwd_auth.so.1/ && $2 == "auth" { \
if ($1 == "passwd") \
passwd_seen = 1;\
}\
$4 ~ /pam_rhosts_auth/ && $1 == "rsh" && $3 == "required" { \
print $1 "\t" $2 " " "sufficient\t\t" $4; \
print $1 "\t" $2 " " "required\t\t" "pam_unix_cred.so.1"; \
next \
}\
$4 ~ /pam_unix_cred/ && $3 == "required" { \
cred_seen = 1;\
print; \
next \
}\
$4 ~ /pam_unix_auth/ && $1 == "rsh" && $3 == "required" { \
if (cred_seen == 0) { \
print $1 "\t" $2 " " "required\t\t" \
"pam_unix_cred.so.1"; \
} \
next \
} \
$4 ~ /pam_unix_auth/ && $3 == "required" { \
if (cred_seen == 0) { \
print $1 "\t" $2 " " "required\t\t" \
"pam_unix_cred.so.1"; \
} \
print ; \
next \
}\
END {
if (passwd_seen == 0) { \
print "passwd" "\t" "auth required\t\t" \
"pam_passwd_auth.so.1"; \
} \
} \
$4 ~ /pam_unix.so/ && $2 == "account" { \
print $1 "\t" $2 " " $3 "\t\t" \
"pam_unix_account.so.1"; \
next \
} \
$4 ~ /pam_unix.so/ && $2 == "session" { \
print $1 "\t" $2 " " $3 "\t\t" \
"pam_unix_session.so.1"; \
next \
} \
$4 ~ /pam_unix.so/ && $2 == "password" { \
print $1 "\t" $2 " " $3 "\t\t" \
"pam_dhkeys.so.1"; \
print $1 "\t" $2 " " "requisite\t\t" \
"pam_authtok_get.so.1"; \
print $1 "\t" $2 " " "requisite\t\t" \
"pam_authtok_check.so.1"; \
print $1 "\t" $2 " " $3 "\t\t" \
"pam_authtok_store.so.1"; \
next \
} \
{ print }' $dest > /tmp/pamconf.$$
cp /tmp/pamconf.$$ $dest
rm -f /tmp/pamconf.$$
#
#update pam.conf with entries for roles
#
grep 'pam_roles.so' $dest > /dev/null 2>&1
if [ $? = 1 ] ; then
echo "${dest} updating default entries for roles, \c" \
>> ${CLEANUP_FILE}
echo "please examine/update any new entries" \
>> ${CLEANUP_FILE}
nawk '/^#/ { print; next } \
$4 ~ /pam_role_auth/ { next } \
$2 == "account" && $4 ~ /pam_unix/ { \
print $1 "\t" $2 " requisite\t\t" \
"pam_roles.so.1"; \
print; \
next \
} \
{ print }' $dest > /tmp/pamconf.$$
cp /tmp/pamconf.$$ $dest
rm -f /tmp/pamconf.$$
fi
#
#update pam.conf with entries for projects
#
grep 'pam_projects.so' $dest > /dev/null 2>&1
if [ $? = 0 ] ; then
echo "${dest} removing pam_project.so" >> ${CLEANUP_FILE}
grep -v pam_projects.so $dest > /tmp/pamconf.$$
cp /tmp/pamconf.$$ $dest
rm -f /tmp/pamconf.$$
fi
#
# update pam.conf to append PPP entries if not already present
# (note: default list above already has role added, so we
# must do this after the upgrade above has run.)
#
rm -f /tmp/pamconf.$$
while read e1 e2 e3 e4 e5
do
# See if the entry already exists
grep \
"^[# ]*$e1[ ][ ]*$e2[ ][ ]*$e3[ ][ ]*$e4" \
$dest >/dev/null 2>&1
if [ $? = 1 ] ; then
# Doesn't exist, enter into pam.conf
echo "$e1\t$e2 $e3\t\t$e4 $e5" >> /tmp/pamconf.$$
fi
done < ${PPP_ENTRIES}
# Append PPP lines if any were not present already.
if [ -f /tmp/pamconf.$$ ] ; then
cat /tmp/pamconf.$$ >> $dest
echo "${dest} updating entries for PPP; \c" \
>> ${CLEANUP_FILE}
echo "please examine/update any new entries" \
>> ${CLEANUP_FILE}
rm -f /tmp/pamconf.$$
fi
#
# update pam.conf to append cron entries if not already present
# (note: the kerberos default list above already has the cron entried added.)
#
rm -f /tmp/pamconf.$$
while read e1 e2 e3 e4 e5
do
# See if the entry already exists
grep \
"^[# ]*$e1[ ][ ]*$e2[ ][ ]*$e3[ ][ ]*$e4" \
$dest >/dev/null 2>&1
if [ $? = 1 ] ; then
# Doesn't exist, enter into pam.conf
echo "$e1\t$e2 $e3\t\t$e4 $e5" >> /tmp/pamconf.$$
fi
done < ${CRON_ENTRIES}
# Append cron lines if any were not present already.
if [ -f /tmp/pamconf.$$ ] ; then
cat /tmp/pamconf.$$ >> $dest
echo "${dest} updating entries for cron, \c" \
>> ${CLEANUP_FILE}
echo "please examine/update any new entries" \
>> ${CLEANUP_FILE}
rm -f /tmp/pamconf.$$
fi
#
# update pam.conf to remove the rlogin entry that uses pam_krb5.so.1
#
rm -f /tmp/pamconf.$$
sed -e "/^[# ]*rlogin.*pam_krb5.so.1/d" \
$dest > /tmp/pamconf.$$
if [ $? -ne 0 ]; then
echo "Couldn't edit /tmp/pamconf.$$, rlogin lines have not been \
updated to remove pam_krb5.so.1." \
>> ${CLEANUP_FILE}
else
cp /tmp/pamconf.$$ $dest
fi
#
# update pam.conf to remove obsolete flags used with pam_krb5.so.1
#
rm -f /tmp/pamconf.$$
sed -e "s/\(pam_krb5.so.1.*\)acceptor/\1/g" \
-e "s/\(pam_krb5.so.1.*\)use_first_pass/\1/g" \
-e "s/\(pam_krb5.so.1.*\)try_first_pass/\1/g" \
-e "s/\(pam_krb5.so.1.*\)use_xfn_pass/\1/g" \
-e "s/\(pam_krb5.so.1.*\)try_xfn_pass/\1/g" \
$dest > /tmp/pamconf.$$
if [ $? -ne 0 ]; then
echo "Couldn't edit /tmp/pamconf.$$ to remove obsolete flags: \
acceptor, use_first_pass, try_first_pass, use_xfn_pass, try_xfn_pass." \
>> ${CLEANUP_FILE}
else
cp /tmp/pamconf.$$ $dest
fi
#
# update pam.conf to remove the unnecessary unix_auth entries for the
# kerberized services.
#
rm -f /tmp/pamconf.$$
sed -e "/^[# ]*krlogin[ ]*auth[ ]*.*[ ]*pam_unix_auth.so.1/d" \
-e "/^[# ]*krsh[ ]*auth[ ]*.*[ ]*pam_unix_auth.so.1/d" \
-e "/^[# ]*ktelnet[ ]*auth[ ]*.*[ ]*pam_unix_auth.so.1/d" \
-e "s/^\([# ]*krlogin[ ]*auth[ ]*\)binding/\1required/" \
-e "s/^\([# ]*krsh[ ]*auth[ ]*\)binding/\1required/" \
-e "s/^\([# ]*ktelnet[ ]*auth[ ]*\)binding/\1required/" \
$dest > /tmp/pamconf.$$
if [ $? -ne 0 ]; then
echo "Couldn't edit /tmp/pamconf.$$, krlogin, krsh, ktelnet may \
still have pam_unix_auth in their stacks." \
>> ${CLEANUP_FILE}
else
cp /tmp/pamconf.$$ $dest
fi
#
# update pam.conf to append kerberos entries if not already present
#
rm -f /tmp/pamconf.$$
cat ${KERB_ENTRIES} |
(while read e1 e2 e3 e4 e5
do
# See if the entry already exists
grep \
"^[# ]*$e1[ ][ ]*$e2[ ][ ]*$e3[ ][ ]*$e4" \
$dest >/dev/null 2>&1
if [ $? = 1 ] ; then
# Check if service name is 'dtlogin' and it is
# mentioned explicitly, then add kerberos 'dtlogin'
if [ $e1 = "dtlogin" ]; then
if grep "^[# ]*$e1[ ][ ]*$e2[ ]" \
$dest >/dev/null 2>&1; then
echo "$e1\t$e2 $e3\t\t$e4 $e5" >> /tmp/pamconf.$$
fi
else
# Doesn't exist, enter into pam.conf
echo "$e1\t$e2 $e3\t\t$e4 $e5" >> \
/tmp/pamconf.$$
fi
else
# Does exist. To maintain proper stacking order: remove it
# and append it to the bottom of the conf file.
grep "^[# ]*$e1[ ][ ]*$e2[ ][ ]*$e3[ ][ ]*$e4" \
$dest >> /tmp/pamconf.$$ 2>/dev/null
sed -e "/^[# ]*$e1[ ][ ]*$e2[ ][ ]*$e3[ ][ ]*$e4/d" \
$dest > /tmp/pamconf2.$$
mv /tmp/pamconf2.$$ $dest
fi
done)
# Append kerberos lines if any were not present already.
if [ -f /tmp/pamconf.$$ ] ; then
cat /tmp/pamconf.$$ >> $dest
echo "${dest} updating entries to add kerberos, \c" \
>> ${CLEANUP_FILE}
echo "please examine/update any new entries" \
>> ${CLEANUP_FILE}
rm -f /tmp/pamconf.$$
fi
#
# notify pam_ldap users to manually intervene and examine/update their pam.conf
# due to the change in pam_ldap functionalty.
#
grep '^[^#].*pam_ldap.so' $dest > /dev/null 2>&1
if [ $? = 0 ] ; then
echo "${dest} please examine/update the pam_ldap configuration \c" \
>> ${CLEANUP_FILE}
echo "because its functionality has changed, \c" \
>> ${CLEANUP_FILE}
echo "refer to pam_ldap(5) documentation for more information" \
>> ${CLEANUP_FILE}
fi
#
# Update pam.conf to append Trusted Extensions entries if not
# already present.
#
rm -f /tmp/pamconf.$$
while read e1 e2 e3 e4 e5
do
# If this is the 'other' entry, add it unless it already
# exists.
if [ $e1 = "other" ]; then
grep \
"^[# ]*$e1[ ][ ]*$e2[ ][ ]*$e3[ ][ ]*$e4" \
$dest >/dev/null 2>&1
if [ $? = 1 ] ; then
# Doesn't exist, enter into pam.conf
echo "$e1\t$e2 $e3\t\t$e4 $e5" \
>> /tmp/pamconf.$$
fi
else
# Add other entries unless they already have a
# stack of their own.
grep "^[# ]*$e1[ ][ ]*$e2[ ]" \
$dest >/dev/null 2>&1
if [ $? = 1 ] ; then
echo "$e1\t$e2 $e3\t\t$e4 $e5" \
>> /tmp/pamconf.$$
fi
fi
done < ${TX_ENTRIES}
# Append TX lines if any were not present already.
if [ -f /tmp/pamconf.$$ ] ; then
cat /tmp/pamconf.$$ >> $dest
echo "${dest} updating entries for Trusted Extensions; \c" \
>> ${CLEANUP_FILE}
echo "please examine/update any new entries" \
>> ${CLEANUP_FILE}
rm -f /tmp/pamconf.$$
fi
fi
done
#
rm -rf $PAM_TMP
exit 0