On Fri, May 23, 2003 at 04:33:09PM +0200, Dag-Erling Smorgrav wrote: > Ruslan Ermilov <ru_at_freebsd.org> writes: > > In a chain with mutiple "binding" modules, only the _last_ > > failure gets ignored? Meaning, if some other module succeeds, > > override the failure status, right? > > Failure of a "binding" module causes the entire chain to fail once it > has completed. The error returned is that returned by the first > non-"optional", non-"sufficient" module that failed. > > Failure of a "sufficient" module, on the other hand, is always ignored > (so if no other non-"optional", non-"sufficient" module failed, the > chain will succeed). This is what constantly surprises users, and > what "binding" was introduced to alleviate. > > See the PAM article for details - particularly the following two > sections: > > http://www.freebsd.org/doc/en/articles/pam/pam-essentials.html#PAM-CHAINS-POLICIES > http://www.freebsd.org/doc/en/articles/pam/pam-config.html#PAM-POLICIES > Thanks, DES! I think I now understand this much better. :-) And I have the following question for you: Why pam_nologin in the "auth" chain of the "login" service is marked "required" and not "requisite", and why do we have the "required" at all? What's the point in continuing with the chain if we are going to return the failure anyway? What's the real application of "required" as compared to "requisite"? Cheers, -- Ruslan Ermilov Sysadmin and DBA, ru_at_sunbay.com Sunbay Software AG, ru_at_FreeBSD.org FreeBSD committer, +380.652.512.251 Simferopol, Ukraine http://www.FreeBSD.org The Power To Serve http://www.oracle.com Enabling The Information Age
This archive was generated by hypermail 2.4.0 : Wed May 19 2021 - 11:37:09 UTC