Issued:

2011-05-19

Updated:

2011-05-19

RHBA-2011:0685 - pam bug fix and enhancement update

Synopsis

pam bug fix and enhancement update

Type/Severity

Bug Fix Advisory (none)

Topic

Updated pam packages that fix bugs and add enhancements are now available.

Description

Pluggable Authentication Modules (PAM) provide a system whereby administrators can set up authentication policies without having to recompile programs to handle authentication.

These updated pam packages fix the following bugs:

• When the pam packages were updated, the /var/log/tallylog and /var/log/faillog files were overwritten with empty files because of an incorrect condition check in the %post script. This has been corrected, and PAM no longer attempts to overwrite tallylog and faillog files when they exist prior to update. (BZ#614766)

• A code review revealed several small memory leaks and improperly handled error paths in pam_namespace, pam_selinux, pam_limits, pam_pwhistory, pam_time, and pam_group modules. These issues have been corrected. (BZ#679069)

These updated packages also provide the following enhancements:

• The pam_limits module, which sets resource limits for processes, now supports matching individual and ranges of user and group identifiers in its limits.conf configuration file. (BZ#622847)

• A new pam_faillock module was added to support temporary locking of user accounts in the event of multiple failed authentication attempts. This new module improves functionality over the existing pam_tally2 module, as it also allows temporary locking when the authentication attempts are done over a screen saver. (BZ#644971)

• The audit records provided by the pam_selinux and pam_tally2 modules have been improved to include tty and remote hostname information in each recorded event. (BZ#677664)

All pam users are advised to upgrade to these updated packages, which resolve these issues and add these enhancements.

Solution

Before applying this update, make sure all previously-released errata relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at This content is not included.http://access.redhat.com/kb/docs/DOC-11259

Affected Products

Updated Packages

• pam-debuginfo-1.1.1-8.el6.x86_64.rpm
• pam-1.1.1-8.el6.x86_64.rpm
• pam-debuginfo-1.1.1-8.el6.s390.rpm
• pam-1.1.1-8.el6.ppc.rpm
• pam-debuginfo-1.1.1-8.el6.s390x.rpm
• pam-devel-1.1.1-8.el6.i686.rpm
• pam-1.1.1-8.el6.i686.rpm
• pam-debuginfo-1.1.1-8.el6.ppc64.rpm
• pam-devel-1.1.1-8.el6.s390.rpm
• pam-devel-1.1.1-8.el6.ppc64.rpm
• pam-devel-1.1.1-8.el6.ppc.rpm
• pam-devel-1.1.1-8.el6.x86_64.rpm
• pam-1.1.1-8.el6.ppc64.rpm
• pam-debuginfo-1.1.1-8.el6.ppc.rpm
• pam-debuginfo-1.1.1-8.el6.i686.rpm
• pam-1.1.1-8.el6.src.rpm
• pam-1.1.1-8.el6.s390x.rpm
• pam-1.1.1-8.el6.s390.rpm
• pam-devel-1.1.1-8.el6.s390x.rpm

Fixes

• This content is not included.BZ - 614766
• This content is not included.BZ - 677664

CVEs

(none)

References

(none)

Additional information

• The Red Hat security contact is This content is not included.secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.
• Offline Security Data data is available for integration with other systems. See Offline Security Data API to get started.