The day Slackware meets PAM: Wed Feb 12 05:05:50 UTC 2020

Tonus · 02-12-2020, 08:01 AM

First problem to report : our friends Pamela will have some trouble with their own packages naming.

orbea · 02-12-2020, 08:44 AM

Just a word of advice, its pretty terrible idea for security to hook pam into everything. Like the changelog says, this is a much bigger attack surface and doesn't really gain anything for most users. If it really must be added it should be done only where absolutely necessary, but even then I doubt most users will gain any benefits.

hua · 02-12-2020, 08:46 AM

Quote:

Next we need to be looking at Xfce 4.14 and Plasma 5.18 LTS

Yes, good news. Getting closer definitely

Gerard Lally · 02-12-2020, 09:06 AM

Quote:

Originally Posted by orbea

Just a word of advice, its pretty terrible idea for security to hook pam into everything. Like the changelog says, this is a much bigger attack surface and doesn't really gain anything for most users. If it really must be added it should be done only where absolutely necessary, but even then I doubt most users will gain any benefits.

I'm not familiar with PAM. Can you be more specific? I use SSH, OpenVPN and StrongSwan. Does the inclusion of PAM compromise them, or render them less secure? Does it make these specific targets bigger and easier to hit?

hitest · 02-12-2020, 09:17 AM

Quote:

Originally Posted by hua

Yes, good news. Getting closer definitely

Absolutely! Many thanks to Mr. Volkerding and the Slackware Team.

kikinovak · 02-12-2020, 10:02 AM

Quote:

Originally Posted by orbea

Just a word of advice, its pretty terrible idea for security to hook pam into everything. Like the changelog says, this is a much bigger attack surface and doesn't really gain anything for most users. If it really must be added it should be done only where absolutely necessary, but even then I doubt most users will gain any benefits.

Three technologies with a very reduced attack surface:

Pocket calculator
Abacus
Letter opener

cwizardone · 02-12-2020, 10:22 AM

Quote:

Originally Posted by GazL

Just installed them all. Nothing obvious broke here.........

Ditto.
It seems to be completely transparent (to this "end user").

chemfire · 02-12-2020, 10:49 AM

Quote:

Originally Posted by orbea

Just a word of advice, its pretty terrible idea for security to hook pam into everything. Like the changelog says, this is a much bigger attack surface and doesn't really gain anything for most users. If it really must be added it should be done only where absolutely necessary, but even then I doubt most users will gain any benefits.

PAM is not all that complex a beast; in fact the code to check authorization against PAM is in most cases simpler than other means. PAM has been around a long time and has had a lot of eyes. Remember it stands for Pluggable Authentication Modules, I will grant you if you start using lots of low-quality modules and make highly complex rules about them, you might end up less secure. If you are using Pat's out of box config (I have not looked yet but I assume) that is just going after local files passwd/group/shadow than I really don't see how you can make a credible claim the security posture is appreciably different, at least in a negative way, than the way things were before yesterday.

denydias · 02-12-2020, 10:49 AM

Quote:

Originally Posted by hua

Yes, good news. Getting closer definitely

Eric has also made his move:

Quote:

Tue Feb 11 19:33:45 UTC 2020
Here is KDE 5_20.02 for Slackware, consisting of the KDE Frameworks 5.67.0,
Plasma 5.18.0 and Applications 19.12.2. All this on top of Qt 5.13.2.
The ktown updates are targeting Slackware -current only.
Updates of the KDE 5 package sets for Slackware 14.2 have come to an end.
Upgrading from the previous 5_20.01 is straight-forward.
Read the accompanying README file for detailed installation and
upgrade instructions!
Note: the KDE 5_20.02 'testing' repository contains PAM support and is
meant to be used with the PAM packages in Slackware-current's '/testing'!

Upgrading now, but I'll left tests for the time when they reach -current tree (can't break anything now as I'm too busy with work).

bw42 · 02-12-2020, 11:48 AM

This is great.

Will cut down on the number of packages I have to maintain my own builds of to use Slackware with my domain at home.

Just kicked off upgrade-all on my desktop at home, hopefully it works when I get out of work.