[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

bug in apache mod_auth_pam module version 1.1



Hi,

I think I have found a bug in apache mod_auth_pam module version 1.1.

The situation could cause the bug are the following:

When a user is authenticate by mod_auth_pam and use only "require
group" directive (no valid-user nor "require user"), the
authentication will go through only when user primary group 
is in the group specified by "require group".  I found this problem
with version 1.1 of mod_auth_pam on Apache Linux authenticate 
against NIS+ server.

Solution

In line 467 of the mod_auth_pam.c, change
if (!strcmp (*members, word))
to be
if (!strcmp (*members, r->connection->user))

Here is the diff
467c467
<                               if (!strcmp (*members,
r->connection->user))
---
>                               if (!strcmp (*members, word))

Regards,
Nick Kanakakorn

__________________________________________________
Do You Yahoo!?
Yahoo! Health - Feel better, live better
http://health.yahoo.com





[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index] []