pam_unix: Support reading YESCRYPT_COST_FACTOR from /etc/login.defs

Hi! I package PAM integration and shadow for Arch Linux.

We are currently discussing the move to yescrypt and want to rely on PAM.
As integration with shadow's /etc/login.defs will remain though, we would love to see the possibility to also retrieve `rounds` from `YESCRYPT_COST_FACTOR` in /etc/login.defs.

Currently it appears that the `rounds=` parameter is supported for yescrypt:
https://github.com/linux-pam/linux-pam/blob/77bd338125cde583ecdfb9fd69619bcd2baf15c2/modules/pam_unix/support.c#L188-L195

Seeing how an integration with /etc/login.defs is supported for SHA256 and SHA512
https://github.com/linux-pam/linux-pam/blob/77bd338125cde583ecdfb9fd69619bcd2baf15c2/modules/pam_unix/support.c#L101-L111

it would be amazing to also be able to use the same kind of integration for yescrypt!

	/* Enforce sane "rounds" values */
	if (on(UNIX_ALGO_ROUNDS, ctrl)) {
	if (on(UNIX_GOST_YESCRYPT_PASS, ctrl) \|\|
	on(UNIX_YESCRYPT_PASS, ctrl)) {
	if (*rounds < 3)
	*rounds = 3;
	else if (*rounds > 11)
	*rounds = 11;

	/* read number of rounds for crypt algo */
	if (rounds && (on(UNIX_SHA256_PASS, ctrl) \|\| on(UNIX_SHA512_PASS, ctrl))) {
	val = pam_modutil_search_key(pamh, LOGIN_DEFS, "SHA_CRYPT_MAX_ROUNDS");

	if (val) {
	*rounds = strtol(val, NULL, 10);
	set(UNIX_ALGO_ROUNDS, ctrl);
	free (val);
	}
	}
	}

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

pam_unix: Support reading YESCRYPT_COST_FACTOR from /etc/login.defs #607

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

pam_unix: Support reading YESCRYPT_COST_FACTOR from /etc/login.defs #607

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions