Category: Tech

I’ve discovered unknown terrors while researching and writing PAM Mastery. Well, terrors previously unknown to me, at least. I’m certain that the OpenPAM and Linux-PAM developers are very much aware of them. (I’m also certain that they’re part of the reason DES keeps his hair cut so short, so that he can’t yank it out of his head in bloody chunks.)

Part of the writing process was building a giant spreadsheet listing operating systems, PAM versions, and which modules appear in each OS. Strictly speaking, OpenPAM proper contains very few modules. Most “OpenPAM” modules actually originate from FreeBSD. But people are free to use them, so they generally get lumped into the “OpenPAM module” bucket.

One module that’s conspicuous by its absence in pam_listfile. Pam_listfile.so lets you accept or reject access based on the username’s presence in a file. It’s much like the traditional BSD /etc/ftpusers functionality.

It’s a reasonable enough module. And I’m told that pam_listfile.so can be compiled to work on FreeBSD, but nobody’s bothered to submit a port. How to make it work is a perennial question on the FreeBSD mailing lists.

The good news is, you can easily emulate pam_listfile.so on FreeBSD using pam_exec. Pam_exec runs a command as part of the PAM chain. If the command returns 0, the module says to grant access. If the command returns 1, the module says to deny access. (Whether PAM obeys this instruction or not depends on the type of statement.)

Here I implement basic pam_listfile.so functionality in a shell script, pam_listfile.sh.

Enable pam_listfile.sh as an auth rule.

auth required pam_exec /usr/local/scripts/pam_listfile.sh

Now all you need is a script. This version of the script permits access if the username appears in /etc/validusers.

#!/bin/sh
/usr/bin/grep ^$PAM_USER$ /etc/validusers
return $?

And here’s a version that rejects access if the username appears in /etc/validusers, exactly like /etc/ftpusers. It’s a huge change, adding an entire exclamation point.

#!/bin/sh
! /usr/bin/grep ^$PAM_USER$ /etc/validusers
return $?

You could add more functions as you need. The important thing is to return either 0 or not-zero.

PAM Mastery is over half finished. I’ve completed the parts on “this is how PAM works” and have moved on to “here are some cool PAM modules that you might want to use.”

And my marketing department says I need to mention that I’m taking sponsors on the print and ebook versions of PAM Mastery.

I’m slated to present at the next SemiBUG meeting.

By unpopular demand, I’ll offer “FreeBSD Filesystem Fun,” also known as “odd stuff I learned as I’ve written the FreeBSD storage books.” You’ll get content on UFS, ZFS, unionfs, various memory filesystems, and some of the really odd corners I discovered while writing the book. Warning: will contain actual math and ZFS tuning know-how.

15 March. 7 PM. Altair Engineering!

To be followed by dining at Leo’s Coney Island right next door. (We’re flexible on dinner, but somehow it always turns out to be Leo’s.)

Future meetings of note include two special guests:

On 19 April, Tom Lawrence is coming to talk about pfSense.

And on 17 May, Isaac Levy is flying in from New York City to talk about FreeBSD jails. I’d really like to fill our space for this one, as Ike is both a great speaker and making a special flight exclusively for us. Knowing Ike, I suspect that the dinner afterwards will involve beer.

June will be a BSDCan trip report, and July, Josh Grosse on porting software to OpenBSD.

The first meeting for theSoutheast Michigan BSD User Group, aka SEMIBUG, will be next Tuesday, 17 November 2015, at the Hazel Park Raceway restaurant.

We’ll discuss what sort of meeting we want, when the regular meeting will happen, where it will be, and suchlike. We’ll probably also draft someone to fix the website. (By fix, I mean “burn it to the ground and try again.”)

The restaurant menu is very minimal thanks to the season, but after the meeting interested parties can head out to one of the local places for actual food. Buy a soda or a beer at HPR to justify our presence.

This morning, I finally updated my web server to FreeBSD 10.2-p6 using freebsd-update. Normally I like freebsd-update, but this morning it decided to be cranky.

As usual, it was cranky because I didn’t know what I was doing.

First, I should say that I don’t need to update my hosts that often. If there’s, say, a mountd(8) security advisory, I don’t bother. And when I ran bunches of FreeBSD boxes, I ran freebsd-update through ansible.

This means I’m not terribly familiar with the output.

So, I run:

# freebsd-update -F -r 10.2-RELEASE upgrade

There’s the usual “downloading metadata” messages, then a bunch of stuff on updating patches.

I then get presented with an /etc/mail/sendmail.cf diff, saying some of the innards of that file has changed. Fine.

Then I get:

The following file will be removed, as it no longer exists in
FreeBSD 10.2-RELEASE: /etc/ntp.conf
Does this look reasonable (y/n)?

Wait… FreeBSD dropped /etc/ntp.conf? What, did they drop ntpd? Who do they think they are, OpenBSD? I’m sure that’s in the release notes, had I bothered to read the release notes. Fine, I’ll install openntpd from packages after the upgrade. No biggie. But I want /etc/ntp.conf to stick around, as I have custom twiddles in there. I think. It’s been a while.

So I answer n. Just like I would with mergemaster.

And freebsd-update ends.

Fine. That’s all the updates, right? I saw stuff download. I then do:

# freebsd-update install
No updates are available to install.
Run '/usr/sbin/freebsd-update fetch' first.

What fresh hell is this? I saw all sorts of stuff download!

I rerun the freebsd-update command, and this time I notice in the output:

/usr/sbin/freebsd-update: cannot open files/.gz: No such file or directory

Something’s missing.

I add -F, to say “hey, re-download everything.”

Same result.

Eventually, I let freebsd-update take /etc/ntp.conf. The upgrade kept running after that, downloading a bunch more stuff and finally telling me to reboot and run freebsd-update install.

The takeaways here are:

1) freebsd-update is not mergemaster. Answering n anywhere makes the update stop before it’s finished.
2) Read the release notes.

BTW, ntpd is still part of FreeBSD 10.2. I don’t know why the update wanted to blow away my ntp.conf rather than point out any diffs.