Bug#442095: Bug#442094: displays entered password

[Simon Josefsson]

Jack Bates <address@hidden> writes:

> Awesome, thanks Simon. I'm generally impressed by your free software,
> and particularly the speed you addressed these issues, thanks!

Thanks!

> First, I had trouble locating the Git repository. After Googling, I
> pulled from git://repo.or.cz/shishi.git
>
> When that didn't include the fixes you describe, I went to the list
> archive and pulled from git://git.josefsson.org/shishi.git
>
> If http://josefsson.org/shishi/#development could be updated with info
> on getting Shishi source from Git, that'd help.

Oops, sorry about that.  I have updated the information, and I also made
sure that the daily builds of shishi and gss will be working again --
they appears to have stopped working when we switched to Git
development.

> Next, I dusted off the GNU autotools book and tried building the Shishi
> source distribution from the Git source:
>
> ket% aclocal
> ket% autoconf 
> ket% automake --add-missing
> configure.ac:48: installing `build-aux/config.sub'
> configure.ac:33: installing `build-aux/missing'
> configure.ac:33: installing `build-aux/install-sh'
> configure.ac:48: installing `build-aux/config.guess'
> asn1/Makefile.am: installing `build-aux/depcomp'
> doc/Makefile.am:21: ENABLE_GTK_DOC does not appear in AM_CONDITIONAL
> doc/Makefile.am:30: installing `build-aux/mdate-sh'
> doc/Makefile.am:30: installing `build-aux/texinfo.tex'
> automake: cannot open < gtk-doc.make: No such file or directory
> ket% 
>
> I think I'm missing the gtk-doc-tools Debian package? If there's some
> documentation on building Shishi from Git I should have RTFMed, please
> let me know...

Alas, there aren't much instructions on this, but the hint is to just
type 'make'.  There is a GNUmakefile in the directory, and it takes care
of running autoreconf and gtk-docize appropriately.  And yes you'll need
to gtk-doc-tools package.

> Finally, the source I pulled from git://git.josefsson.org/shishi.git didn't
> include the fixes you describe either. Are they in a different
> repository, or a different branch?

Most likely the rsync cron job hadn't been run when you tested it.  It
is pulled from my machine from time to time.

> At this point, I apt-get sourced shishi, manually applied the fixes from
> your messages, built the package and voila, both issues are fixed: My
> password is not echoed as I login, and pam_unix succeeds when pam_shishi
> fails, without asking for my password again.

Great, thanks for your efforts in verifying that the bugs have been
fixed!  I'm sure that the instructions are now slightly better than
before if somebody else tests this.

I'll also see if I can't get daily builds of the debian packages to
start working again.

I'll make a new release shortly.

/Simon

> Much thanks, Jack
>
> On Thu, Sep 13, 2007 at 05:08:04PM +0200, Simon Josefsson wrote:
>> Jack Bates <address@hidden> writes:
>> 
>> > Sorry I've not had time until now to test and provide feedback on
>> > libpam-shishi. Thank you for developing this software.
>> >
>> > Using libpam-shishi, my password is displayed as I enter it. For
>> > instance, when logging into a console, most PAM plugins don't display
>> > the password as it's entered. However when using libpam-shishi, the
>> > password is displayed.
>> 
>> Hi Jack!  Thanks for the report.  I was quite surprised to hear that,
>> but looking at the source, I suspect some debug code was still present.
>> I probably mostly used this under X11 and didn't see this.
>> 
>> I have committed the patch below which looks like the right thing, but I
>> have not tested it.  If you can easily build Shishi from GIT yourself
>> and test whether the problem is fixed, that would help.
>> 
>> Thanks,
>> Simon
>> 
>> commit 64ba04853d9d3cdb949ec789ae6e33bbfe06049e
>> Author: Simon Josefsson <address@hidden>
>> Date:   Thu Sep 13 17:05:25 2007 +0200
>> 
>>     Add.
>> 
>> diff --git a/NEWS b/NEWS
>> index 2f50b10..ab2f635 100644
>> --- a/NEWS
>> +++ b/NEWS
>> @@ -4,6 +4,9 @@ See the end for copying conditions.
>>  
>>  * Version 0.0.33 (unreleased)
>>  
>> +** libpam_shishi: Don't echo password when reading it from console.
>> +Reported by Jack Bates <address@hidden>.
>> +
>>  ** Update translations.
>>  
>>  * Version 0.0.32 (released 2007-06-29)
>> 
>> commit 077dd5363b17cdd5565eeff68c0573205e4f7675
>> Author: Simon Josefsson <address@hidden>
>> Date:   Thu Sep 13 17:05:00 2007 +0200
>> 
>>     Don't echo password to console (untested patch).
>>     Reported by Jack Bates <address@hidden>.
>> 
>> diff --git a/extra/pam_shishi/pam_shishi.c b/extra/pam_shishi/pam_shishi.c
>> index 22641f4..cd92bad 100644
>> --- a/extra/pam_shishi/pam_shishi.c
>> +++ b/extra/pam_shishi/pam_shishi.c
>> @@ -126,7 +126,7 @@ pam_sm_authenticate (pam_handle_t * pamh,
>>        pmsg[0] = &msg[0];
>>        asprintf ((char **) &msg[0].msg, "Password for address@hidden': ",
>>              shishi_principal_default (h), shishi_realm_default (h));
>> -      msg[0].msg_style = PAM_PROMPT_ECHO_ON;
>> +      msg[0].msg_style = PAM_PROMPT_ECHO_OFF;
>>        resp = NULL;
>>  
>>        retval = conv->conv (nargs, (const struct pam_message **) pmsg,
>> 
>> 
> _______________________________________________
> Help-shishi mailing list
> address@hidden
> http://lists.gnu.org/mailman/listinfo/help-shishi