<?xml version="1.0" encoding="UTF-8"?>
<feed xmlns="http://www.w3.org/2005/Atom" xml:lang="en-gb">
<link rel="self" type="application/atom+xml" href="https://forum.yubico.com/feed.php?f=3&amp;t=254" />

<title>Yubico Forum</title>
<subtitle>...visit our web-store at</subtitle>
<link href="https://forum.yubico.com/index.php" />
<updated>2009-03-24T15:01:30+01:00</updated>

<author><name><![CDATA[Yubico Forum]]></name></author>
<id>https://forum.yubico.com/feed.php?f=3&amp;t=254</id>
<entry>
<author><name><![CDATA[fergus]]></name></author>
<updated>2009-03-24T15:01:30+01:00</updated>
<published>2009-03-24T15:01:30+01:00</published>
<id>https://forum.yubico.com/viewtopic.php?t=254&amp;p=1318#p1318</id>
<link href="https://forum.yubico.com/viewtopic.php?t=254&amp;p=1318#p1318"/>
<title type="html"><![CDATA[Re: pam_yubico on 64 bit?]]></title>

<content type="html" xml:base="https://forum.yubico.com/viewtopic.php?t=254&amp;p=1318#p1318"><![CDATA[
Hmm...  You may want to malloc an integer to store the retval before setting with pam_set_data.  The current scope of retval will get recollected when that function returns.  When the data is retrieved that location is probably is use by something else or it could segfault.  We should malloc a dynamic memory location and recollect with a 'cleanup' function.<p>Statistics: Posted by <a href="https://forum.yubico.com/memberlist.php?mode=viewprofile&amp;u=413">fergus</a> — Tue Mar 24, 2009 3:01 pm</p><hr />
]]></content>
</entry>
<entry>
<author><name><![CDATA[Simon]]></name></author>
<updated>2009-03-24T14:41:04+01:00</updated>
<published>2009-03-24T14:41:04+01:00</published>
<id>https://forum.yubico.com/viewtopic.php?t=254&amp;p=1317#p1317</id>
<link href="https://forum.yubico.com/viewtopic.php?t=254&amp;p=1317#p1317"/>
<title type="html"><![CDATA[Re: pam_yubico on 64 bit?]]></title>

<content type="html" xml:base="https://forum.yubico.com/viewtopic.php?t=254&amp;p=1317#p1317"><![CDATA[
<div class="quotetitle">cmoates wrote:</div><div class="quotecontent"><br />Here's a diff which I believe fixes the problem. I've tested it on Ubuntu 8.10 64 bit as well as Ubuntu 8.10 32 bit. Anyone else care to try it out?<br /></div><br /><br />Hi!  I applied a slightly different patch, see:<br /><br /><!-- m --><a class="postlink" href="http://code.google.com/p/yubico-pam/source/detail?r=141#">http://code.google.com/p/yubico-pam/sou ... ail?r=141#</a><!-- m --><br /><br />Please check it.  I'll likely do another 1.13 release with this later today.<br /><br />/Simon<p>Statistics: Posted by <a href="https://forum.yubico.com/memberlist.php?mode=viewprofile&amp;u=2">Simon</a> — Tue Mar 24, 2009 2:41 pm</p><hr />
]]></content>
</entry>
<entry>
<author><name><![CDATA[fergus]]></name></author>
<updated>2009-03-12T12:32:16+01:00</updated>
<published>2009-03-12T12:32:16+01:00</published>
<id>https://forum.yubico.com/viewtopic.php?t=254&amp;p=1283#p1283</id>
<link href="https://forum.yubico.com/viewtopic.php?t=254&amp;p=1283#p1283"/>
<title type="html"><![CDATA[Re: pam_yubico on 64 bit?]]></title>

<content type="html" xml:base="https://forum.yubico.com/viewtopic.php?t=254&amp;p=1283#p1283"><![CDATA[
I uploaded a patch to the pam_yubico google page that should fix most of the things I was having issues with.  It now checks the password to make sure its long enough to contain an OTP before it splits it.  It also allows users that don't have a yubikey id associated with them to login.  This patch also includes the 64-bit patch above.  Feedback is appreciated.<br /><br />Issue report -&gt; <a href="http://code.google.com/p/yubico-pam/issues/detail?id=12" class="postlink">http://code.google.com/p/yubico-pam/issues/detail?id=12</a><br />Direct link -&gt; <a href="http://yubico-pam.googlecode.com/issues/attachment?aid=5317245680863813985&amp;name=pam_yubico-1.11updates2.patch" class="postlink">http://yubico-pam.googlecode.com/issues/attachment?aid=5317245680863813985&amp;name=pam_yubico-1.11updates2.patch</a><p>Statistics: Posted by <a href="https://forum.yubico.com/memberlist.php?mode=viewprofile&amp;u=413">fergus</a> — Thu Mar 12, 2009 12:32 pm</p><hr />
]]></content>
</entry>
<entry>
<author><name><![CDATA[TrinitronX]]></name></author>
<updated>2009-03-12T07:11:33+01:00</updated>
<published>2009-03-12T07:11:33+01:00</published>
<id>https://forum.yubico.com/viewtopic.php?t=254&amp;p=1280#p1280</id>
<link href="https://forum.yubico.com/viewtopic.php?t=254&amp;p=1280#p1280"/>
<title type="html"><![CDATA[Re: pam_yubico on 64 bit?]]></title>

<content type="html" xml:base="https://forum.yubico.com/viewtopic.php?t=254&amp;p=1280#p1280"><![CDATA[
Nice, good find!<br /><br />I can see what you're talking about&#058;<br /><br /><div class="codetitle"><b>Code:</b></div><div class="codecontent">  token_otp_with_password = (char *) password;<br />  password_len = strlen (token_otp_with_password);<br /><br />  /* Getting Token value and SSH password */<br />  &#91;color=#FF0000&#93;strncpy&#91;/color&#93; ((char *) token_otp,<br />      token_otp_with_password + (password_len - TOKEN_LEN), TOKEN_LEN);<br /></div><br /><br />Might this also cause possible security issues?  Not sure if this is really exploitable, but since it's in login code, I'm kinda wary.<p>Statistics: Posted by <a href="https://forum.yubico.com/memberlist.php?mode=viewprofile&amp;u=522">TrinitronX</a> — Thu Mar 12, 2009 7:11 am</p><hr />
]]></content>
</entry>
<entry>
<author><name><![CDATA[fergus]]></name></author>
<updated>2009-03-10T15:38:13+01:00</updated>
<published>2009-03-10T15:38:13+01:00</published>
<id>https://forum.yubico.com/viewtopic.php?t=254&amp;p=1269#p1269</id>
<link href="https://forum.yubico.com/viewtopic.php?t=254&amp;p=1269#p1269"/>
<title type="html"><![CDATA[Re: pam_yubico on 64 bit?]]></title>

<content type="html" xml:base="https://forum.yubico.com/viewtopic.php?t=254&amp;p=1269#p1269"><![CDATA[
I found some time to browse through the source and found that the issue I describe above is not 64-bit related.  This code makes the assumption that all users have a yubikey ID associated with their accounts.  Additionally, It never checks to see if the user has an associated ID or that the length of the entered password is long enough to contain a OTP before it splits it up into pieces.  In my scenario, a user without a yubikey, enters their password and the pam module attempts to split it into the base password and OTP pieces.  Since the password is less that 44 chars the code attempts to strncpy from an invalid memory location.  We should add some sanity checks to the code to make sure the given password is greater than 44 chars before attempting to parse it and also check to see if the user has an associated yubikey ID before verifying against it.  This would also lead to a decision of how to handle accounts without a yubikey ID.  Do they succeed or fail?  We may need another top level option 'require_yubikey' or something to specify how to handle that case.  Not sure how much time I'll have but if I can get a patch together i'll post it.<p>Statistics: Posted by <a href="https://forum.yubico.com/memberlist.php?mode=viewprofile&amp;u=413">fergus</a> — Tue Mar 10, 2009 3:38 pm</p><hr />
]]></content>
</entry>
<entry>
<author><name><![CDATA[cmoates]]></name></author>
<updated>2009-02-20T21:01:26+01:00</updated>
<published>2009-02-20T21:01:26+01:00</published>
<id>https://forum.yubico.com/viewtopic.php?t=254&amp;p=1142#p1142</id>
<link href="https://forum.yubico.com/viewtopic.php?t=254&amp;p=1142#p1142"/>
<title type="html"><![CDATA[Re: pam_yubico on 64 bit?]]></title>

<content type="html" xml:base="https://forum.yubico.com/viewtopic.php?t=254&amp;p=1142#p1142"><![CDATA[
I've not run across the scenario you describe, but I've done very limited testing on Ubuntu. I'll add that to my test plans.<p>Statistics: Posted by <a href="https://forum.yubico.com/memberlist.php?mode=viewprofile&amp;u=406">cmoates</a> — Fri Feb 20, 2009 9:01 pm</p><hr />
]]></content>
</entry>
<entry>
<author><name><![CDATA[fergus]]></name></author>
<updated>2009-02-20T13:18:31+01:00</updated>
<published>2009-02-20T13:18:31+01:00</published>
<id>https://forum.yubico.com/viewtopic.php?t=254&amp;p=1133#p1133</id>
<link href="https://forum.yubico.com/viewtopic.php?t=254&amp;p=1133#p1133"/>
<title type="html"><![CDATA[Re: pam_yubico on 64 bit?]]></title>

<content type="html" xml:base="https://forum.yubico.com/viewtopic.php?t=254&amp;p=1133#p1133"><![CDATA[
Ok, I made another attempt at getting the pam plugin to work with ubuntu 8.04 64 bit.  By using the above patch I was able to get farther this time but came across another issue.  If I attempted to login with a user with an associated yubikey ID it would work correctly.  I would enter by password, then press my yubikey button and the ssh session would begin.  I then tried to login with a user that doesn't have an associated yubikey ID.  After entering the users password, I would experience a segfault on the server side.  I haven't had time to debug this further, but perhaps there are a few more areas in the code that need to get massaged for 64 bit compatibility.  As I collect more information I will post updates.<br /><br />- pam_yubico v1.11 with the above two line modifications.<br />- /etc/pam.d/sshd files is configured to match the above listing<br />- /etc/ssh/sshd_config has the two options in the above listing<br />- Using system wide yubikey id file in /etc<br /><br />richard<p>Statistics: Posted by <a href="https://forum.yubico.com/memberlist.php?mode=viewprofile&amp;u=413">fergus</a> — Fri Feb 20, 2009 1:18 pm</p><hr />
]]></content>
</entry>
<entry>
<author><name><![CDATA[network-marvels]]></name></author>
<updated>2009-02-18T17:04:51+01:00</updated>
<published>2009-02-18T17:04:51+01:00</published>
<id>https://forum.yubico.com/viewtopic.php?t=254&amp;p=1121#p1121</id>
<link href="https://forum.yubico.com/viewtopic.php?t=254&amp;p=1121#p1121"/>
<title type="html"><![CDATA[Re: pam_yubico on 64 bit?]]></title>

<content type="html" xml:base="https://forum.yubico.com/viewtopic.php?t=254&amp;p=1121#p1121"><![CDATA[
Due to time constraints, we were not able to  include the changes suggested by cmoates to the new pam module version 1.11. We will include them to the next release of the PAM module.<br /><br />Meanwhile, we have tested the Yubico PAM configuration on following 64 bit test environment with the code changes suggested by cmoates and it worked fine:<br /><div class="codetitle"><b>Code:</b></div><div class="codecontent">1) OS Version: Debian GNU/Linux 5.0.0 _Lenny_ - Official amd64<br />2) Kernel Version: Linux Kernel version 2.6.26-1-amd64<br />3) OpenSSH Version: OpenSSH_5.1p1 Debian-5<br />4) Yubico PAM Version: pam_yubico-1.11<br />5) &quot;/etc/pam.d/sshd&quot;:<br /># PAM configuration for the Secure Shell service<br /># Administrative Level<br /><br />auth required pam_yubico.so authfile=/etc/yubikeyid id=16 debug<br /><br /># Read environment variables from /etc/environment and<br /># /etc/security/pam_env.conf.<br />auth       required     pam_env.so # &#91;1&#93;<br /># In Debian 4.0 (etch), locale-related environment variables were moved to<br /># /etc/default/locale, so read that as well.<br />auth       required     pam_env.so envfile=/etc/default/locale<br /><br /># Standard Un*x authentication.<br />@include common-auth<br /><br /># Disallow non-root logins when /etc/nologin exists.<br />account    required     pam_nologin.so<br /><br /># Uncomment and edit /etc/security/access.conf if you need to set complex<br /># access limits that are hard to express in sshd_config.<br /># account  required     pam_access.so<br /><br /># Standard Un*x authorization.<br />@include common-account<br /><br /># Standard Un*x session setup and teardown.<br />@include common-session<br /><br /># Print the message of the day upon successful login.<br />session    optional     pam_motd.so # &#91;1&#93;<br /><br /># Print the status of the user's mailbox upon successful login.<br />session    optional     pam_mail.so standard noenv # &#91;1&#93;<br /><br /># Set up user limits from /etc/security/limits.conf.<br />session    required     pam_limits.so<br /><br /># Set up SELinux capabilities (need modified pam)<br /># session  required     pam_selinux.so multiple<br /><br /># Standard Un*x password updating.<br />@include common-password<br /><br />6) &quot;/etc/ssh/sshd_config&quot; settings:<br /><br />ChallengeResponseAuthentication no<br />PasswordAuthentication yes<br /></div><p>Statistics: Posted by <a href="https://forum.yubico.com/memberlist.php?mode=viewprofile&amp;u=280">network-marvels</a> — Wed Feb 18, 2009 5:04 pm</p><hr />
]]></content>
</entry>
<entry>
<author><name><![CDATA[cmoates]]></name></author>
<updated>2009-02-17T23:14:40+01:00</updated>
<published>2009-02-17T23:14:40+01:00</published>
<id>https://forum.yubico.com/viewtopic.php?t=254&amp;p=1116#p1116</id>
<link href="https://forum.yubico.com/viewtopic.php?t=254&amp;p=1116#p1116"/>
<title type="html"><![CDATA[Re: pam_yubico on 64 bit?]]></title>

<content type="html" xml:base="https://forum.yubico.com/viewtopic.php?t=254&amp;p=1116#p1116"><![CDATA[
I've not had as much time as I'd like to work on this (it's my busy season at work) but we built RPM's for several Fedora and CentOS distros, and while testing the other night on Fedora 10, x86_64, we found that, without my patches, it would seg fault.<br /><br />HOWEVER, if we changed &quot;ChallengeResponseAuthentication&quot; in /etc/ssh/sshd_config to &quot;yes&quot;, then it would work. We didn't test this extensively, but we did determine that it was contributing to the problem. Note that the current instructions explicitly tell you to set this to &quot;no&quot; and so I'm not sure what other ill effects might come from this.<br /><br />In 1.11, there was a bunch of code added, and so I'm not surprised that there might be a new issue. I hope to work on this more soon, but it might be several weeks before my schedule clears up enough to really dig in.<br /><br />Many thanks to my friend Todd Zullinger, who has contributed a significant amount of effort to helping me, in spite of the fact that he doesn't own a Yubikey. (I'm gonna owe him one though!)<p>Statistics: Posted by <a href="https://forum.yubico.com/memberlist.php?mode=viewprofile&amp;u=406">cmoates</a> — Tue Feb 17, 2009 11:14 pm</p><hr />
]]></content>
</entry>
<entry>
<author><name><![CDATA[fergus]]></name></author>
<updated>2009-02-17T20:49:02+01:00</updated>
<published>2009-02-17T20:49:02+01:00</published>
<id>https://forum.yubico.com/viewtopic.php?t=254&amp;p=1114#p1114</id>
<link href="https://forum.yubico.com/viewtopic.php?t=254&amp;p=1114#p1114"/>
<title type="html"><![CDATA[Re: pam_yubico on 64 bit?]]></title>

<content type="html" xml:base="https://forum.yubico.com/viewtopic.php?t=254&amp;p=1114#p1114"><![CDATA[
What version of pam_yubico where you using?  I just tried your changes on version 1.11 and I still got a segfault.  I am wondering if the new version needs some more updates.  It was also late last night when I tried it.  I'll give it another shot when I am home, but I think the issue is still there, at least with version 1.11.<br /><br />richard<p>Statistics: Posted by <a href="https://forum.yubico.com/memberlist.php?mode=viewprofile&amp;u=413">fergus</a> — Tue Feb 17, 2009 8:49 pm</p><hr />
]]></content>
</entry>
<entry>
<author><name><![CDATA[lucienboland]]></name></author>
<updated>2009-02-08T14:32:21+01:00</updated>
<published>2009-02-08T14:32:21+01:00</published>
<id>https://forum.yubico.com/viewtopic.php?t=254&amp;p=1064#p1064</id>
<link href="https://forum.yubico.com/viewtopic.php?t=254&amp;p=1064#p1064"/>
<title type="html"><![CDATA[Re: pam_yubico on 64 bit?]]></title>

<content type="html" xml:base="https://forum.yubico.com/viewtopic.php?t=254&amp;p=1064#p1064"><![CDATA[
Hi cmoates,<br /><br />I tried your patch on RHEL5 64 bit and it worked.<br /><br />Much appreciated.<br /><br />Cheers<br />Lucien<p>Statistics: Posted by <a href="https://forum.yubico.com/memberlist.php?mode=viewprofile&amp;u=419">lucienboland</a> — Sun Feb 08, 2009 2:32 pm</p><hr />
]]></content>
</entry>
<entry>
<author><name><![CDATA[cmoates]]></name></author>
<updated>2009-02-07T19:56:58+01:00</updated>
<published>2009-02-07T19:56:58+01:00</published>
<id>https://forum.yubico.com/viewtopic.php?t=254&amp;p=1059#p1059</id>
<link href="https://forum.yubico.com/viewtopic.php?t=254&amp;p=1059#p1059"/>
<title type="html"><![CDATA[Re: pam_yubico on 64 bit?]]></title>

<content type="html" xml:base="https://forum.yubico.com/viewtopic.php?t=254&amp;p=1059#p1059"><![CDATA[
Here's a diff which I believe fixes the problem. I've tested it on Ubuntu 8.10 64 bit as well as Ubuntu 8.10 32 bit. Anyone else care to try it out?<br /><br /><div class="codetitle"><b>Code:</b></div><div class="codecontent">Index: pam_yubico.c<br />===================================================================<br />--- pam_yubico.c   (revision 124)<br />+++ pam_yubico.c   (working copy)<br />@@ -397,7 +397,7 @@<br />     }<br />   if (debug)<br />     D ((&quot;done. &#91;%s&#93;&quot;, pam_strerror (pamh, retval)));<br />-  pam_set_data (pamh, &quot;yubico_setcred_return&quot;, (void *) retval, NULL);<br />+  pam_set_data (pamh, &quot;yubico_setcred_return&quot;, (void *) (uintptr_t)retval, NULL);<br /> <br />   return retval;<br /> }<br />@@ -406,7 +406,7 @@<br /> pam_sm_setcred (pam_handle_t * pamh, int flags, int argc, const char **argv)<br /> {<br />   int retval;<br />-  int auth_retval;<br />+  uintptr_t auth_retval;<br /> <br />   D ((&quot;called.&quot;));<br /></div><p>Statistics: Posted by <a href="https://forum.yubico.com/memberlist.php?mode=viewprofile&amp;u=406">cmoates</a> — Sat Feb 07, 2009 7:56 pm</p><hr />
]]></content>
</entry>
<entry>
<author><name><![CDATA[lucienboland]]></name></author>
<updated>2009-02-07T15:03:56+01:00</updated>
<published>2009-02-07T15:03:56+01:00</published>
<id>https://forum.yubico.com/viewtopic.php?t=254&amp;p=1057#p1057</id>
<link href="https://forum.yubico.com/viewtopic.php?t=254&amp;p=1057#p1057"/>
<title type="html"><![CDATA[Re: pam_yubico on 64 bit?]]></title>

<content type="html" xml:base="https://forum.yubico.com/viewtopic.php?t=254&amp;p=1057#p1057"><![CDATA[
We're seeing the exact same behaviour as you are describing on our Redhat Enterprise Linux 5.3 64 bit systems.<br /><br />I will test RHEL5 32-bit early next week and judging by your table of results so far suspect it will succeed without seg faulting.<br /><br />Hopefully we can sort this out soon.<br /><br />Cheers<p>Statistics: Posted by <a href="https://forum.yubico.com/memberlist.php?mode=viewprofile&amp;u=419">lucienboland</a> — Sat Feb 07, 2009 3:03 pm</p><hr />
]]></content>
</entry>
<entry>
<author><name><![CDATA[cmoates]]></name></author>
<updated>2009-02-07T05:36:28+01:00</updated>
<published>2009-02-07T05:36:28+01:00</published>
<id>https://forum.yubico.com/viewtopic.php?t=254&amp;p=1050#p1050</id>
<link href="https://forum.yubico.com/viewtopic.php?t=254&amp;p=1050#p1050"/>
<title type="html"><![CDATA[pam_yubico on 64 bit?]]></title>

<content type="html" xml:base="https://forum.yubico.com/viewtopic.php?t=254&amp;p=1050#p1050"><![CDATA[
I want to hopefully use yubikeys for SSH logins, among other miscellaneous things, so I immediately jumped at the pam_yubico code. At first, I was having no success at all, but further testing shows that my problem seems to be limited to 64 bit Linux distros. Is anyone else using this successfully on a 64 bit system?<br /><br />Here's what I am seeing: Authentication succeeds, but immediately after that, whatever app is using pam segfaults. I've tried to get backtraces but not much luck yet. I'm still gathering more information but thought I'd throw this out there, in hopes I don't have to dig all the way down this rabbit hole.<br /><br />Tested so far:<br /><br />Fedora 9 32 bit: Works<br />Debian Lenny 32 bit: Works<br />Ubuntu 8.10 32 bit: Works<br />Ubuntu 8.10 64 bit: Fails (seg faults)<br />Centos 5.2 64 bit: Fails (seg faults)<br />Fedora 10 64 bit: Fails (seg faults)<br /><br />Updated to include Fedora 10 64 bit testing results.<p>Statistics: Posted by <a href="https://forum.yubico.com/memberlist.php?mode=viewprofile&amp;u=406">cmoates</a> — Sat Feb 07, 2009 5:36 am</p><hr />
]]></content>
</entry>
</feed>