RHBA-2011:0685 - Bug Fix Advisory

Topic

Updated pam packages that fix bugs and add enhancements are now available.

Description

Pluggable Authentication Modules (PAM) provide a system whereby
administrators can set up authentication policies without having to
recompile programs to handle authentication.

These updated pam packages fix the following bugs:

• When the pam packages were updated, the /var/log/tallylog and

/var/log/faillog files were overwritten with empty files because of
an incorrect condition check in the %post script. This has been
corrected, and PAM no longer attempts to overwrite tallylog and
faillog files when they exist prior to update. (BZ#614766)

• A code review revealed several small memory leaks and improperly

handled error paths in pam_namespace, pam_selinux, pam_limits,
pam_pwhistory, pam_time, and pam_group modules. These issues have
been corrected. (BZ#679069)

These updated packages also provide the following enhancements:

• The pam_limits module, which sets resource limits for processes,

now supports matching individual and ranges of user and group
identifiers in its limits.conf configuration file. (BZ#622847)

• A new pam_faillock module was added to support temporary locking of

user accounts in the event of multiple failed authentication
attempts. This new module improves functionality over the existing
pam_tally2 module, as it also allows temporary locking when the
authentication attempts are done over a screen saver. (BZ#644971)

• The audit records provided by the pam_selinux and pam_tally2

modules have been improved to include tty and remote hostname
information in each recorded event. (BZ#677664)

All pam users are advised to upgrade to these updated packages, which resolve
these issues and add these enhancements.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
http://access.redhat.com/kb/docs/DOC-11259

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 x86_64
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for Power, big endian 6 ppc64
• Red Hat Enterprise Linux for Scientific Computing 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 i386
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 6 s390x
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension (for IBM z Systems) 6 s390x

Fixes

• BZ - 614766 - PAM truncates /var/log/faillog on upgrade
• BZ - 677664 - pam USER_ROLE_CHANGE audit events missing some info

CVEs

(none)

References

(none)