Changeset 43

Timestamp:

05/22/07 14:36:33 (2 years ago)

Author:

csellers

Message:

basic working deny_interval support

Files:

• trunk/RHEL5/pam_tally2/README (modified) (1 diff)
• trunk/RHEL5/pam_tally2/pam_tally.c (modified) (4 diffs)
• trunk/RHEL5/pam_tally2/pseudo.txt (modified) (1 diff)

trunk/RHEL5/pam_tally2/README

@@ -22 +22 @@
-            magic root.
-                * deny=n (Deny access if tally for this user exceeds n.)
+                
+                * deny_interval=n (Only deny access if tally for this user
+                        exceeds limit within n second time interval. Requires
+                        deny=8 or less.)
-                
-                * lock_time=n (Deny access for n seconds after every failed

trunk/RHEL5/pam_tally2/pam_tally.c

@@ -97 +97 @@
-    const char *filename;
-    tally_t deny;
+    unsigned long deny_interval;
-    long lock_time;
-    long unlock_time;
@@ -200 +201 @@
-        log_phase_no_auth(pamh, phase, *argv);
-        if ( sscanf((*argv)+12,"%ld",&opts->unlock_time) != 1 ) {
+          pam_syslog(pamh, LOG_ERR, "bad number supplied: %s", *argv);
+          return PAM_AUTH_ERR;
+        }
+      }
+      else if ( ! strncmp( *argv, "deny_interval=", 14 ) ) {
+        log_phase_no_auth(pamh, phase, *argv);
+        if ( sscanf((*argv)+14,"%ld",&opts->deny_interval) != 1 ) {
-          pam_syslog(pamh, LOG_ERR, "bad number supplied: %s", *argv);
-          return PAM_AUTH_ERR;
@@ -555 +563 @@
-    const void *remote_host = NULL;
-    int i, rv;
+    uint16_t last_fail;
-
-    tally.fail_cnt = 0;  /* !TALLY_HI --> Log opened for update */
@@ -565 +574 @@
-    }
-
+    last_fail = (tally.fail_cnt>TALLYLOG_FAIL_TIME_COUNT) ?
+                TALLYLOG_FAIL_TIME_COUNT-1 :
+                tally.fail_cnt-1;
+
-    /* to remember old fail time (for locktime) */
-    if (oldtime && tally.fail_cnt > 0) {
-
-
+
+
+
+
-                TALLYLOG_FAIL_TIME_COUNT-1 :
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-    (void) pam_get_item(pamh, PAM_RHOST, &remote_host);
-    if (!remote_host) {

trunk/RHEL5/pam_tally2/pseudo.txt

@@ -57 +57 @@
-        save old fail_time[fail_cnt-1] in oldtime
-        fail_time[fail_cnt] = current time
+        if (deny_interval and not previously exceeded limit)
+                while fail_time[fail_cnt] - fail_time[0] > deny_interval
+                        shift fail_time values left
+                        fail_cnt--
-        save old fail_cnt in oldcnt
-        if not magic_root option or uid not root