~ubuntu-branches/debian/squeeze/libpam-krb5/squeeze : changes

~ubuntu-branches/debian/squeeze/libpam-krb5/squeeze » Changes from revision 18

From Revision 18

Rev	Summary	Authors	Tags	Date
18	* New upstream release. * New upstream release. - New fast_ccache option, which if set attempts to use credentials in that ticket cache to protect the Kerberos authentication with FAST. Requires FAST support in the Kerberos libraries and hence only is available in libpam-krb5, not libpam-heimdal, for right now. - Fix error in freeing a previous alt_auth_map setting. * Switch to 3.0 (quilt) source format. Force a single Debian patch and include a custom patch header explaining that it is a rollup of any fixes cherry-picked from upstream and breaking those patches out separately would be work for no gain.	Russ Allbery	4.3-1	14 years ago
17	* Build libpam-krb5 and libpam-heimdal from the same source ... * Build libpam-krb5 and libpam-heimdal from the same source package. * Acknowledge libpam-heimdal NMU. - Rebuild against current Heimdal libraries. (Closes: #559779) - Add support for pam-auth-update. (Closes: #551455) * Lower libpam-heimdal priority to extra, since it conflicts with libpam-krb5 and the MIT Kerberos version will be sufficient for most users. * Fix spelling error in manual page. * Update standards version to 3.8.4 (no changes required).	Russ Allbery	4.2-2	14 years ago
16	* New upstream release. * New upstream release. - New fail_pwchange option which treats expired passwords like authentication failure and suppresses password change.	Russ Allbery	4.2-1	14 years ago
15	* New upstream release. * New upstream release. - Fix a segfault if pam-krb5 is configured with use_first_pass or use_authtok and there is no stored password. Thanks, Jonathan Guthrie. (Closes: #537729)	Russ Allbery	3.15-1	14 years ago
14	Return PAM_IGNORE for ignored users in pam_chauthtok instead... Return PAM_IGNORE for ignored users in pam_chauthtok instead of PAM_PERM_DENIED. This change is necessary for the pam-auth-update configuration to work properly. Thanks, Steve Langasek.	Russ Allbery	3.13-4	15 years ago
13	Fix segfault after detection of unsafe .k5login ownership wh... Fix segfault after detection of unsafe .k5login ownership when search_k5login is set. Thanks, Andrew Deason. (Closes: #499479)	Russ Allbery	3.11-3	15 years ago
12	* New upstream release. * New upstream release. - If no_ccache is set, don't fail if we can't find module data. - Better error handling when reading keytabs. * Document in README.Debian that accounts must still exist in /etc/shadow when following the standard configuration and suggest an alternate configuration when that isn't appropriate. Thanks, Raoul Borenius. (Closes: #452592) * No longer build-depend on comerr-dev, since the module no longer links to it directly. * Update standards version to 3.7.3 (no changes required).	Russ Allbery	3.10-1	16 years ago
11	* New upstream release. * New upstream release. - If use_authtok is set, fail if we retrieve a NULL password, since that's how pam_cracklib rejects passwords. (Closes: #447306) - Add clear_on_fail option to clear the password on failed password change to force later password modules using use_authtok to fail. - Fix parsing of the keytab PAM option. - Return PAM_AUTHINFO_UNAVAIL when unable to resolve the realm. - Additional debugging information in README. * Add Homepage control field.	Russ Allbery	3.9-1	16 years ago
10	* New upstream release. * New upstream release. - Restore prompting for expired passwords. (Closes: #444740) - Correctly handle a negative minimum UID setting.	Russ Allbery	3.8-1	16 years ago
9	* New upstream release. * New upstream release. - Fix compilation errors with Heimdal. (Closes: #413553) - Document that ChallengeResponseAuthentication must be enabled in sshd to prompt users to change expired passwords. (Closes: #411816) - Support specifying a keytab other than the system keytab to use to verify passwords. (Partly addresses #399002) - New ticket_lifetime, banner, and expose_account config options. - Honor PAM_SILENT where appropriate. - Prefix the default cache type with FILE: to be explicit. - If PAM_USER is set to a fully-qualified principal that the Kerberos library can map to a local account name, reset PAM_USER to that local account name after authentication. - Return better PAM error codes for authentication failures. - Fix various memory leaks and memory handling problems. - Better error message handling with later Kerberos releases. - Various improvements to debug logging. * Update debhelper compatibility level to V5.	Russ Allbery	3.5-1	17 years ago
8	* New upstream release. * New upstream release. - Don't assume the return from pam_get_user will persist. - Avoid a use of freed memory when debugging is enabled. - Bind function calls within the PAM module where possible.	Russ Allbery	2.6-1	17 years ago
7	* New upstream release. * New upstream release. - Don't free the results of pam_get_item on password changes. Thanks, Arne Nordmark. (Closes: #395041) - Be more paranoid when checking authorization in pam_sm_acct_mgmt. - Zero passwords before freeing them.	Russ Allbery	2.5-1	17 years ago
6	* New upstream release. * New upstream release. - Fix compilation with Heimdal. (Closes: #391276) - Better error handling and several uninitialized variable fixes. - Log when an unknown option is passed to the module.	Russ Allbery	2.4-1	17 years ago
5	* Only call krb5_kuserok when the account to which we're aut... * Only call krb5_kuserok when the account to which we're authenticating is a local account to allow use of pam_krb5 for application authentication of users without local accounts. (Closes: #354133) * Restructure the code to do user validation after obtaining their initial tickets. This eliminates a lot of confusing special cases and deferred checking and makes it easier to audit the code. * Don't create the ticket cache until after successful authentication. Otherwise, we leave files behind in /tmp. * Document what principals libpam_krb5.so looks for in the system keytab to do ticket validation. (Closes: #350556)	Russ Allbery	1.2.0-3	18 years ago
4	* New upstream maintainer and version. * New upstream maintainer and version. - Now supports reinitialization of credentials properly, allowing programs such as xlock to refresh credentials. (Closes: #309345) This currently only works with versions of xlock that try to refresh credentials (xlockmore does not). - Do not include the principal name in the prompt. This breaks some SSH clients and isn't necessary. (Closes: #321319) - New ignore_root option to skip this module for root authentication, ameliorating pam_krb5 problems when the network is down. Partially addresses #315622. * Bug fixes to upstream version (all sent back to the maintainer): - Succeed silently in account management if Kerberos wasn't used. - Parse ccache_dir correctly. - Bring the man page up to date. - Link with -z defs to ensure all symbols were found. * Readd the ccache option with a better implementation and allow for randomization of the filename using mkstemp even if ccache is used. * Add search_k5login option to allow authentication based on the principals listed in ~/.k5login when the local account name doesn't easily map to the Kerberos principal. * Add specific configuration recommendations to README.Debian. * Install upstream changelog now that there is one. * Add a watch file. * Update standards version to 3.6.2 (no changes required). * Remove maintainer from uploaders; dak can handle this properly. * Update uploader address. * Remove unnecessary code from debian/rules.	Russ Allbery	1.2.0-1	18 years ago
3	Revert the PAM_REINITIALIZE_CREDS change as it breaks sshd w... Revert the PAM_REINITIALIZE_CREDS change as it breaks sshd with UsePAM. Add a source comment explaining the confusion about the meaning of this flag.	Russ Allbery	1.0-12	19 years ago
2	Move fron non-us to main--second to last package of mine Move fron non-us to main--second to last package of mine	Sam Hartman	1.0-7	22 years ago
1	Import upstream version 1.0 Import upstream version 1.0	Sam Hartman	upstream-1.0	22 years ago