From 784fb7dc2ccc63789ed85d803e3ae41eef0e0253 Mon Sep 17 00:00:00 2001
From: zsdc <taras@vyos.io>
Date: Tue, 19 Sep 2023 21:03:51 +0300
Subject: pam: T5577: Improved PAM configs for RADIUS and TACACS+

After sources analysis, we found the next possible return statuses for PAM
modules:

1. pam_tacplus

    Auth:

    - PAM_AUTH_ERR
    - PAM_AUTHINFO_UNAVAIL
    - PAM_AUTHTOK_ERR
    - PAM_BUF_ERR
    - PAM_CRED_INSUFFICIENT
    - PAM_PERM_DENIED
    - PAM_SUCCESS
    - PAM_USER_UNKNOWN

    Account:

    - PAM_AUTH_ERR
    - PAM_AUTHINFO_UNAVAIL
    - PAM_PERM_DENIED
    - PAM_SUCCESS
    - PAM_USER_UNKNOWN

    Session:

    - PAM_AUTHINFO_UNAVAIL
    - PAM_SESSION_ERR
    - PAM_SUCCESS
    - PAM_USER_UNKNOWN

2. pam_radius_auth

    Auth:

    - PAM_ABORT
    - PAM_AUTH_ERR
    - PAM_AUTHINFO_UNAVAIL
    - PAM_AUTHTOK_ERR
    - PAM_BAD_ITEM
    - PAM_BUF_ERR
    - PAM_CONV_AGAIN
    - PAM_CONV_ERR
    - PAM_IGNORE
    - PAM_NO_MODULE_DATA
    - PAM_PERM_DENIED
    - PAM_SUCCESS
    - PAM_SYSTEM_ERR
    - PAM_USER_UNKNOWN

    Account:

    - PAM_SUCCESS

    Session:

    - PAM_ABORT
    - PAM_AUTHINFO_UNAVAIL
    - PAM_BAD_ITEM
    - PAM_BUF_ERR
    - PAM_CONV_AGAIN
    - PAM_CONV_ERR
    - PAM_IGNORE
    - PAM_NO_MODULE_DATA
    - PAM_PERM_DENIED
    - PAM_SUCCESS
    - PAM_SYSTEM_ERR
    - PAM_USER_UNKNOWN

PAM configurations were replaced with tuned versions to take this into account.
---
 src/pam-configs/radius-optional | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'src/pam-configs/radius-optional')

diff --git a/src/pam-configs/radius-optional b/src/pam-configs/radius-optional
index 9f6d5f0ea..73085061d 100644
--- a/src/pam-configs/radius-optional
+++ b/src/pam-configs/radius-optional
@@ -11,9 +11,9 @@ Auth:
 Account-Type: Primary
 Account:
     [default=ignore success=1] pam_succeed_if.so user notingroup radius quiet
-    [default=ignore new_authtok_reqd=done success=end perm_denied=bad auth_err=bad] pam_radius_auth.so
+    [default=ignore success=end] pam_radius_auth.so
 
 Session-Type: Additional
 Session:
     [default=ignore success=1] pam_succeed_if.so user notingroup radius quiet
-    [default=ignore success=ok perm_denied=bad auth_err=bad] pam_radius_auth.so
+    [default=ignore success=ok perm_denied=bad user_unknown=bad] pam_radius_auth.so
-- 
cgit v1.2.3