Can't use NIS with 'password' feature of pam_unix

This regression happened between 0.75-1 and 0.75-2 -- tried all the binaries
from snapshot.debian.net.

pam (0.75-2) experimental; urgency=low
[...]
  * Patch from Martin Schwenke <email address hidden> to only change
    passwords in pam_unix when they exist in the password file; hopefully
    does not break NIS, closes: #135990
[...]
 -- Sam Hartman <email address hidden> Sat, 8 Jun 2002 18:04:40 -0400

I sent email to Sam Hartman regarding this bug.

I think this is related to #135990.

Created an attachment (id=3478)
Potental patch for nis passwd issue in pam

This patch seems to work for me. I've also placed it in the upstream debian
bug. Its mostly cut-and-paste from newer versions of pam.

This bug is very old; does the problem still exist in Dapper?

Yes, it still exists in Dapper (tested today with Flight 5 + all current updates). Same symptoms as the original poster.

Last fall, I looked at the pam_unix code that was available upstream then, and it seemed that changing a NIS password through pam_unix could not work properly in any version released until then. Though every version seemed to be broken in a new and different way ;-) In the end I gave up and locally patched the version that comes with Breezy (0.76 iirc).

I haven't looked at the very newest versions available upstream, but I assume that such a big version jump isn't possible anyway? If help with a patch for the version included in Dapper is needed, I'd be willing to try to patch it (or test patches, if there's already something available). Is 0.79 likely to be the version that will ship with Dapper?

Currently 0.79-3ubuntu10 is the one which will ship with dapper (modulo any fixes we make for this)

You're sure that the bug manifests in the same way as the original reporter says Christina? Because 0.79 contains the code which Scott backported in an earlier comment.

What patch were you using if it wasn't the one attached above?

Thanks,
D.

I'll try to find some time this week to setup a dapper nis client here at work and test this issue. I need to cut my teeth on dapper in the environment here anyhow.

I wrote my own patch. Will digg it out tomorrow or Wednesday, and also investigate what exactly is going wrong with 0.79-3ubuntu10, just haven't found the time to do this until now.

This is the patch I made for Breezy. I have no idea what I'm doing, so you better don't use it ...

I didn't manage to do more testing with 0.79 this week, and I won't be able to do anything next week => back in 2 weeks. Sorry :(

I'm still seeing this issue. Hopefully I'll get time this week to debug the problem.

It seems a workaround (if no other reasons require you to stick with pam_unix.sso) is to use pam_unix2.so from the libpam-unix2 package in universe.

Fixed in this patch. Using the pre-existing flag is a style option, but I think it makes sense. The issue is that some nis networks will not have shadow maps, so shadow works for local users but not NIS users.

I'm still having the same problem using

ii libpam-modules 0.79-3ubuntu14 Pluggable Authentication Modules for PAM

has the patch ever been committed?

Seems 0.79 has been replaced with 0.99 since Gutsy. Can anyone confirm if this is still an issue?

Seems to be, at least in Debian:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=469635

I have a NIS setup here (clients running Debian etch or Ubuntu gutsy, server running Debian etch) and can confirm this: passwd can't change NIS passwords.

This bug was fixed in the package pam - 1.0.1-1ubuntu1

---------------
pam (1.0.1-1ubuntu1) intrepid; urgency=low

  * Merge from Debian unstable
  * Dropped changes:
    - Linux-PAM/modules/pam_selinux/pam_selinux.8: Ubuntu pam_selinux manpage
      is 2 years newer than Debian's, contains a number of character escaping
      fixes plus content updates
    - debian/patches-applied/ubuntu-pam_selinux_seusers: patch pam_selinux to
      correctly support seusers (backported from changes in PAM 0.99.8).
    - debian/rules: install unix_chkpwd setgid shadow instead of setuid root.
      The nis package handles overriding this as necessary.
    - debian/patches-applied/ubuntu-rlimit_nice_correction: Bound RLIMIT_NICE
      from below as well as from above. Fix off-by-one error when converting
      RLIMIT_NICE to the range of values used by the kernel.
  * Remaining changes:
    - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's not
      present there or in /etc/security/pam_env.conf. (should send to Debian).
    - debian/libpam-runtime.postinst,
      debian/local/common-{auth,password}{,.md5sums}:
      Use the new 'missingok' option by default for pam_smbpass in case
      libpam-smbpass is not installed (LP: #216990); must use "requisite"
      rather than "required" to prevent "pam_smbpass migrate" from firing in
      the event of an auth failure; md5sums updated accordingly.
    - debian/libpam0g.postinst: only ask questions during update-manager when
      there are non-default services running.
    - debian/patches-applied/series: Ubuntu patches are as below ...
    - debian/patches-applied/ubuntu-fix_standard_types: Use standard u_int8_t
      type rather than __u8.
    - debian/patches-applied/ubuntu-no-error-if-missingok: add a new, magic
      module option 'missingok' which will suppress logging of errors by
      libpam if the module is not found.
    - debian/patches-applied/ubuntu-regression_fix_securetty: prompt for
      password on bad username.
    - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly
      initialise RLIMIT_NICE rather than relying on the kernel limits.
    - debian/patches-applied/ubuntu-user_defined_environment: Look at
      ~/.pam_environment too, with the same format as
      /etc/security/pam_env.conf. (Originally patch 100; converted to quilt.)
  * Refresh patch ubuntu-no-error-if-missingok for the new upstream version.
  * Change Vcs-Bzr to point at the new Ubuntu branch.

pam (1.0.1-1) unstable; urgency=low

  * New upstream version.
    - pam_limits: bound RLIMIT_NICE from below. Closes: #403718.
    - pam_mail: set the MAIL variable even when .hushlogin is set.
      Closes: #421010.
    - new minclass option introduced for pam_cracklib. Closes: #454237.
    - fix a failure to check the string length when matching usernames in
      pam_group. Closes: #444427.
    - fix setting shell security context in pam_selinux. Closes: #451722.
    - use --disable-audit, to avoid libaudit being linked in
      accidentally
    - pam_unix now supports SHA-256 and SHA-512 password hashes.
      Closes: #484249, LP: #245786.
    - pam_rhosts_auth is dropped upstream (closes...