~ubuntu-branches/ubuntu/quantal/libpam-krb5/quantal-201405130549 : changes

~ubuntu-branches/ubuntu/quantal/libpam-krb5/quantal-201405130549 » Changes to pam_krb5.5 from revision 24

From Revision 24

Rev	Summary	Authors	Tags	Date
23	Fix build rule to not override CPPFLAGS, which deactivates s... Fix build rule to not override CPPFLAGS, which deactivates some of the options passed in by dpkg-buildflags. Instead, use --with-krb5-lib and --with-krb5-include to locate the Kerberos headers and libraries. Thanks, Moritz Muehlenhoff. (Closes: #654293)	Russ Allbery	4.5-3	12 years ago
20	* New upstream release. * New upstream release. - Do not prompt for a password when try_pkinit is set, removing a spurious password prompt introduced in 4.1, but partly reintroducing a bug causing the password to not be saved in the PAM data if authentication falls back to password after a PKINIT failure. - Organize the pam_krb5 man page into sections. * Fix custom patch header to refer to pam-krb5, not remctl. * Update standards version to 3.9.1. - Refer to the GPL version 1 now that it's in common-licenses. * Update to debhelper compatibility level V8 (no changes required).	Russ Allbery	4.4-1	13 years ago
19	* New upstream release. * New upstream release. - New fail_pwchange option which treats expired passwords like authentication failure and suppresses password change.	Russ Allbery	4.2-1	14 years ago
18	* New upstream release. * New upstream release. - Fix a segfault if pam-krb5 is configured with use_first_pass or use_authtok and there is no stored password. Thanks, Jonathan Guthrie. (Closes: #537729)	Russ Allbery	3.15-1	14 years ago
16	* Merge from Debian unstable, remaining changes: * Merge from Debian unstable, remaining changes: - debian/{pam-auth-update,postinst,prerm}, debian/rules, debian/dirs: enable pam_krb5 by default using the new pam-auth-update support. - debian/control: depend on libpam-runtime (>= 1.0.1-6) for the above. * Logging is now done with the LOG_AUTHPRIV facility. LP: #227531.	Steve Langasek	3.13-2ubuntu1	15 years ago
13	Fix segfault after detection of unsafe .k5login ownership wh... Fix segfault after detection of unsafe .k5login ownership when search_k5login is set. Thanks, Andrew Deason. (Closes: #499479)	Russ Allbery	3.11-3	15 years ago
12	* New upstream release. * New upstream release. - If no_ccache is set, don't fail if we can't find module data. - Better error handling when reading keytabs. * Document in README.Debian that accounts must still exist in /etc/shadow when following the standard configuration and suggest an alternate configuration when that isn't appropriate. Thanks, Raoul Borenius. (Closes: #452592) * No longer build-depend on comerr-dev, since the module no longer links to it directly. * Update standards version to 3.7.3 (no changes required).	Russ Allbery	3.10-1	16 years ago
11	* New upstream release. * New upstream release. - If use_authtok is set, fail if we retrieve a NULL password, since that's how pam_cracklib rejects passwords. (Closes: #447306) - Add clear_on_fail option to clear the password on failed password change to force later password modules using use_authtok to fail. - Fix parsing of the keytab PAM option. - Return PAM_AUTHINFO_UNAVAIL when unable to resolve the realm. - Additional debugging information in README. * Add Homepage control field.	Russ Allbery	3.9-1	16 years ago
10	* New upstream release. * New upstream release. - Restore prompting for expired passwords. (Closes: #444740) - Correctly handle a negative minimum UID setting.	Russ Allbery	3.8-1	16 years ago
9	* New upstream release. * New upstream release. - Fix compilation errors with Heimdal. (Closes: #413553) - Document that ChallengeResponseAuthentication must be enabled in sshd to prompt users to change expired passwords. (Closes: #411816) - Support specifying a keytab other than the system keytab to use to verify passwords. (Partly addresses #399002) - New ticket_lifetime, banner, and expose_account config options. - Honor PAM_SILENT where appropriate. - Prefix the default cache type with FILE: to be explicit. - If PAM_USER is set to a fully-qualified principal that the Kerberos library can map to a local account name, reset PAM_USER to that local account name after authentication. - Return better PAM error codes for authentication failures. - Fix various memory leaks and memory handling problems. - Better error message handling with later Kerberos releases. - Various improvements to debug logging. * Update debhelper compatibility level to V5.	Russ Allbery	3.5-1	17 years ago
8	* New upstream release. * New upstream release. - Don't assume the return from pam_get_user will persist. - Avoid a use of freed memory when debugging is enabled. - Bind function calls within the PAM module where possible.	Russ Allbery	2.6-1	17 years ago
7	* New upstream release. * New upstream release. - Don't free the results of pam_get_item on password changes. Thanks, Arne Nordmark. (Closes: #395041) - Be more paranoid when checking authorization in pam_sm_acct_mgmt. - Zero passwords before freeing them.	Russ Allbery	2.5-1	17 years ago
6	* New upstream release. * New upstream release. - Fix compilation with Heimdal. (Closes: #391276) - Better error handling and several uninitialized variable fixes. - Log when an unknown option is passed to the module.	Russ Allbery	2.4-1	17 years ago
5	* Only call krb5_kuserok when the account to which we're aut... * Only call krb5_kuserok when the account to which we're authenticating is a local account to allow use of pam_krb5 for application authentication of users without local accounts. (Closes: #354133) * Restructure the code to do user validation after obtaining their initial tickets. This eliminates a lot of confusing special cases and deferred checking and makes it easier to audit the code. * Don't create the ticket cache until after successful authentication. Otherwise, we leave files behind in /tmp. * Document what principals libpam_krb5.so looks for in the system keytab to do ticket validation. (Closes: #350556)	Russ Allbery	1.2.0-3	18 years ago
4	* New upstream maintainer and version. * New upstream maintainer and version. - Now supports reinitialization of credentials properly, allowing programs such as xlock to refresh credentials. (Closes: #309345) This currently only works with versions of xlock that try to refresh credentials (xlockmore does not). - Do not include the principal name in the prompt. This breaks some SSH clients and isn't necessary. (Closes: #321319) - New ignore_root option to skip this module for root authentication, ameliorating pam_krb5 problems when the network is down. Partially addresses #315622. * Bug fixes to upstream version (all sent back to the maintainer): - Succeed silently in account management if Kerberos wasn't used. - Parse ccache_dir correctly. - Bring the man page up to date. - Link with -z defs to ensure all symbols were found. * Readd the ccache option with a better implementation and allow for randomization of the filename using mkstemp even if ccache is used. * Add search_k5login option to allow authentication based on the principals listed in ~/.k5login when the local account name doesn't easily map to the Kerberos principal. * Add specific configuration recommendations to README.Debian. * Install upstream changelog now that there is one. * Add a watch file. * Update standards version to 3.6.2 (no changes required). * Remove maintainer from uploaders; dak can handle this properly. * Update uploader address. * Remove unnecessary code from debian/rules.	Russ Allbery	1.2.0-1	18 years ago
3	Revert the PAM_REINITIALIZE_CREDS change as it breaks sshd w... Revert the PAM_REINITIALIZE_CREDS change as it breaks sshd with UsePAM. Add a source comment explaining the confusion about the meaning of this flag.	Russ Allbery	1.0-12	19 years ago
2	Move fron non-us to main--second to last package of mine Move fron non-us to main--second to last package of mine	Sam Hartman	1.0-7	22 years ago
1	Import upstream version 1.0 Import upstream version 1.0	Sam Hartman	upstream-1.0	22 years ago