This bug was fixed in the package pam - 1.0.1-1ubuntu1 --------------- pam (1.0.1-1ubuntu1) intrepid; urgency=low * Merge from Debian unstable * Dropped changes: - Linux-PAM/modules/pam_selinux/pam_selinux.8: Ubuntu pam_selinux manpage is 2 years newer than Debian's, contains a number of character escaping fixes plus content updates - debian/patches-applied/ubuntu-pam_selinux_seusers: patch pam_selinux to correctly support seusers (backported from changes in PAM 0.99.8). - debian/rules: install unix_chkpwd setgid shadow instead of setuid root. The nis package handles overriding this as necessary. - debian/patches-applied/ubuntu-rlimit_nice_correction: Bound RLIMIT_NICE from below as well as from above. Fix off-by-one error when converting RLIMIT_NICE to the range of values used by the kernel. * Remaining changes: - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's not present there or in /etc/security/pam_env.conf. (should send to Debian). - debian/libpam-runtime.postinst, debian/local/common-{auth,password}{,.md5sums}: Use the new 'missingok' option by default for pam_smbpass in case libpam-smbpass is not installed (LP: #216990); must use "requisite" rather than "required" to prevent "pam_smbpass migrate" from firing in the event of an auth failure; md5sums updated accordingly. - debian/libpam0g.postinst: only ask questions during update-manager when there are non-default services running. - debian/patches-applied/series: Ubuntu patches are as below ... - debian/patches-applied/ubuntu-fix_standard_types: Use standard u_int8_t type rather than __u8. - debian/patches-applied/ubuntu-no-error-if-missingok: add a new, magic module option 'missingok' which will suppress logging of errors by libpam if the module is not found. - debian/patches-applied/ubuntu-regression_fix_securetty: prompt for password on bad username. - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly initialise RLIMIT_NICE rather than relying on the kernel limits. - debian/patches-applied/ubuntu-user_defined_environment: Look at ~/.pam_environment too, with the same format as /etc/security/pam_env.conf. (Originally patch 100; converted to quilt.) * Refresh patch ubuntu-no-error-if-missingok for the new upstream version. * Change Vcs-Bzr to point at the new Ubuntu branch. pam (1.0.1-1) unstable; urgency=low * New upstream version. - pam_limits: bound RLIMIT_NICE from below. Closes: #403718. - pam_mail: set the MAIL variable even when .hushlogin is set. Closes: #421010. - new minclass option introduced for pam_cracklib. Closes: #454237. - fix a failure to check the string length when matching usernames in pam_group. Closes: #444427. - fix setting shell security context in pam_selinux. Closes: #451722. - use --disable-audit, to avoid libaudit being linked in accidentally - pam_unix now supports SHA-256 and SHA-512 password hashes. Closes: #484249, LP: #245786. - pam_rhosts_auth is dropped upstream (closes: #382987); add a compat symlink to pam_rhosts to support upgrades for a release, and give a warning in NEWS.Debian. - new symbol in libpam.so.0, pam_modutil_audit_write; shlibs bump, and do another round of service restarts on upgrade. - pam_unix helper is now called whenever an unprivileged process tries and fails to query a user's account status. Closes: #367834. * Drop patches 006_docs_cleanup, 015_hurd_portability, 019_pam_listfile_quiet, 024_debian_cracklib_dict_path, 038_support_hurd, 043_pam_unix_unknown_user_not_alert, 046_pam_group_example, no_pthread_mutexes, limits_wrong_strncpy, misc_conv_allow_sigint.patch, pam_tally_audit.patch, 057_pam_unix_passwd_OOM_check, and 065_pam_unix_cracklib_disable which have been merged upstream. * Patch 022_pam_unix_group_time_miscfixes: partially merged upstream; now is really just "pam_group_miscfixes". * Patch 007_modules_pam_unix partially superseded upstream; stripping hpux-style expiry information off of password fields is now supported. * New patch pam_unix_thread-safe_save_old_password.patch, to make sure all our getpwnam() use in pam_unix is thread-safe (fixes an upstream regression) * New patch pam_unix_fix_sgid_shadow_auth.patch, fixing an upstream regression which prevents sgid shadow apps from being able to authenticate any more because the module forces use of the helper and the helper won't allow authentication of arbitrary users. This change does mean we're going to be noisier for the time being in an SELinux environment, which should be addressed but is not a regression on Debian. * New patch pam_unix_dont_trust_chkpwd_caller.patch, rolling back an upstream change that causes unix_chkpwd to assume that setuid(getuid()) is sufficient to drop permissions and attempt any authentication on behalf of the user. * The password-changing helper functionality for SELinux systems has been split out into a separate unix_update binary, so at long last we can change unix_chkpwd to be sgid shadow instead of suid root. Closes: #155583. - Update the lintian override to match. * Install the new unix_update helper into libpam-modules. * Use a pristine upstream tarball instead of repacking; requires various changes to debian/rules and debhelper files. * Replace the Vcs-Svn field with a Vcs-Bzr field; jumping ship from svn, and how! * Debconf translations: - Romanian, thanks to Igor Stirbu