RFE: Set PAM_USER and PAM_AUTHTOK before starting authentication

[akkornel]

Hello!

I'd like to request that PAM_USER and PAM_AUTHTOK both be set within auth_userpass (in https://github.com/neutrinolabs/xrdp/blob/devel/sesman/verify_user_pam.c). This will allow basic PAM stacks to run possibly without the need for prompting for a username/password in the conversation mechanism.

Here's what I was thinking in terms of implementation:

• In the call to pam_start, for the second parameter, provide user (the string passed in to the function call). That will automatically set the PAM_USER item1.
• Once you have the PAM handle, call pam_set_item to set the PAM_AUTHTOK item type to be the user's password (the pass string passed into the function call).2

For PAM stacks to take advantage of it, modules which prompt for a password (like pam_unix) would have to be invoked with the try_first_pass or use_first_pass option, but for pam_unix try_first_pass is the default already.

If all of this works, then a successful authentication will not require invoking the conversation function.

Please let me know if you have any questions about my request!

[matt335672]

Hi @akkornel

I'm having a look at this area at the moment.

The pam_start(() change you mention was addressed by #1883.

The pam_set_item(,PAM_AUTHTOK,) call can't be done from an application as you request. This is raised on stackoverflow but not adequately answered. For that we need to look at the code for linux-PAM. The relevent code from pam_set_item() is here:-

https://github.com/linux-pam/linux-pam/blob/a324607b5db8873289409d7c609bb76ddb47022b/libpam/pam_item.c#L75-L89

This is also part of the opengroup standard:-

https://pubs.opengroup.org/onlinepubs/8329799/chap4.htm#tagcjh_05_02_01_01

Note:
The values of PAM_AUTHTOK and PAM_OLDAUTHTOK are only available to PAM modules and not to applications.

So AFAICT, avoiding the pam conversation using this approach is not possible. There does not seem to be a way for use to set PAM_AUTHTOK.

Any thoughts?

[matt335672]

I'm closing this for now, as I can't see a way to implement the setting of PAM_AUTHTOK. This seems to be discouraged by the PAM developers.