From cea8ec53de95a08d2503706f40d8dfafc14a15e8 Mon Sep 17 00:00:00 2001 From: Karel Zak Date: Thu, 6 Oct 2011 00:30:45 +0200 Subject: login: use LOG_UNKFAIL_ENAB from login.defs, improve logging Signed-off-by: Karel Zak --- login-utils/login.c | 29 +++++++++++++++++++++++------ 1 file changed, 23 insertions(+), 6 deletions(-) (limited to 'login-utils/login.c') diff --git a/login-utils/login.c b/login-utils/login.c index c9ae19f63..e44aa5fc6 100644 --- a/login-utils/login.c +++ b/login-utils/login.c @@ -711,12 +711,16 @@ static pam_handle_t *init_loginpam(struct login_context *cxt) static void loginpam_auth(struct login_context *cxt) { - int rc, failcount = 0; + int rc, failcount = 0, show_unknown; + const char *hostname = cxt->hostname ? cxt->hostname : + cxt->tty_name ? cxt->tty_name : ""; pam_handle_t *pamh = cxt->pamh; /* if we didn't get a user on the command line, set it to NULL */ loginpam_get_username(pamh, &cxt->username); + show_unknown = getlogindefs_bool("LOG_UNKFAIL_ENAB", 0); + /* * There may be better ways to deal with some of these conditions, but * at least this way I don't think we'll be giving away information... @@ -732,11 +736,19 @@ static void loginpam_auth(struct login_context *cxt) (rc == PAM_CRED_INSUFFICIENT) || (rc == PAM_AUTHINFO_UNAVAIL))) { - loginpam_get_username(pamh, &cxt->username); + if (rc == PAM_USER_UNKNOWN && !show_unknown) + /* + * logging unknown usernames may be a security issue if + * an user enter her password instead of her login name + */ + cxt->username = NULL; + else + loginpam_get_username(pamh, &cxt->username); syslog(LOG_NOTICE, _("FAILED LOGIN %d FROM %s FOR %s, %s"), - failcount, cxt->hostname, cxt->username, + failcount, hostname, + cxt->username ? cxt->username : "(unknown)", pam_strerror(pamh, rc)); log_btmp(cxt); @@ -750,17 +762,22 @@ static void loginpam_auth(struct login_context *cxt) if (is_pam_failure(rc)) { - loginpam_get_username(pamh, &cxt->username); + if (rc == PAM_USER_UNKNOWN && !show_unknown) + cxt->username = NULL; + else + loginpam_get_username(pamh, &cxt->username); if (rc == PAM_MAXTRIES) syslog(LOG_NOTICE, _("TOO MANY LOGIN TRIES (%d) FROM %s FOR %s, %s"), - failcount, cxt->hostname, cxt->username, + failcount, hostname, + cxt->username ? cxt->username : "(unknown)", pam_strerror(pamh, rc)); else syslog(LOG_NOTICE, _("FAILED LOGIN SESSION FROM %s FOR %s, %s"), - cxt->hostname, cxt->username, + hostname, + cxt->username ? cxt->username : "(unknown)", pam_strerror(pamh, rc)); log_btmp(cxt); -- cgit v1.2.3-55-g7522