Please remove php5-auth-pam from quantal

[Ole Wolf]

Binary package hint: php5-auth-pam

According to the team working on the Horde application framework, php5-auth-pam is unmaintanied and was deprecated years ago. This means that the php5-auth-pam package should be considered a security vulnerability.

The package info at http://packages.debian.org/changelogs/pool/main/p/php-auth-pam/php-auth-pam_0.4-10/copyright refers to the author's page at http://www.math.ohio-state.edu/~ccunning/pam_auth - however, that page is a 404 not found.

The Horde team suggests a package named "pam" instead of "auth-pam".

There are quite a few dependencies on php5-auth-pam, so it cannot readily be uninstalled and replaced by the appropriate PECL module.

[Marc Deslauriers (mdeslaur)]

Thanks for taking the time to report this bug and helping to make Ubuntu better. We appreciate the difficulties you are facing, but this appears to be a "regular" (non-security) bug. I have unmarked it as a security issue since this bug does not show evidence of allowing attackers to cross privilege boundaries nor directly cause loss of data/privacy. Please feel free to report any other bugs you may find.

[Ole Wolf (ole.wolf)]

Work-around:

Install the PECL version using "sudo pecl install pam" without removing php5-auth-pam. The build may require some build libraries to be installed, libpam0g-dev being one of them.

Then, remove the module in /etc/php5/conf.d/pam_auth.ini by prepending it with a ';' (semicolon, without quotes). Create a new file in the same directory named "pam.ini" with the contents: "extension=pam.so" (without quotes). Restart the web server.

The above workaround may be overwritten whenever php5-pam-auth is updated, but since it appears to be unmaintained, this isn't likely to happen too often.

[Ilya Barygin (randomaction)]

Please remove this package from quantal:
* source: php-auth-pam
* binary: php5-auth-pam

No rdepends.

Removed from sid in March 2012, reference: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=663694

[Dave Walker (davewalker)]

horde3 seems to only Suggest this, so no firm rdepends. This looks fine to remove.

Thanks.

[Dave Walker (davewalker)]

Removing packages:
 php-auth-pam 0.4-10ubuntu1 in quantal
  php5-auth-pam 0.4-10ubuntu1 in quantal amd64
  php5-auth-pam 0.4-10ubuntu1 in quantal armel
  php5-auth-pam 0.4-10ubuntu1 in quantal armhf
  php5-auth-pam 0.4-10ubuntu1 in quantal i386
  php5-auth-pam 0.4-10ubuntu1 in quantal powerpc
Comment: LP: #798571 | Debian, RM: php-auth-pam -- RoReverseDependency; maintainer seems MIA; RC-buggy; abandoned upstream
1 package successfully removed.