man: don't suggest using pam_unix.so's use_authtok switch

Our dumbed down example PAM stacks do not contain cracklib/pwq modules,
hence using use_authtok on the pam_unix.so password change stack won't
work, because it has the effect that pam_unix.so never asks for a
password on its own, expecting the cracklib/pwq modules to have
queried/validated them beforehand.

I noticed this issue because of #30969: Debian's PAM setup suffers by
the same issue – even though they don't actually use our suggested PAM
fragments at all.

See: #30969

diff --git a/factory/etc/pam.d/system-auth b/factory/etc/pam.d/system-auth
index c2d6240930f04ec303bf34fa82010da0392804f4..cb4e570361682369e4c9cf76d0affdafa8a2f302 100644 (file)
--- a/factory/etc/pam.d/system-auth
+++ b/factory/etc/pam.d/system-auth
@@ -13,7 +13,7 @@ account   sufficient pam_unix.so
 account   required   pam_permit.so
 
 -password sufficient pam_systemd_home.so
-password  sufficient pam_unix.so sha512 shadow try_first_pass use_authtok
+password  sufficient pam_unix.so sha512 shadow try_first_pass
 password  required   pam_deny.so
 
 -session  optional   pam_keyinit.so revoke

diff --git a/man/pam_systemd.xml b/man/pam_systemd.xml
index 2c3bbec5d8147531ed39e5c1bde2abb930802ac8..1a841df13bf19441a0ce0a9908a11080f1d32f18 100644 (file)
--- a/man/pam_systemd.xml
+++ b/man/pam_systemd.xml
@@ -411,8 +411,7 @@ account   sufficient pam_unix.so
 account   required   pam_permit.so
 
 -password sufficient pam_systemd_home.so
-password  sufficient pam_unix.so sha512 shadow try_first_pass use_authtok
-
+password  sufficient pam_unix.so sha512 shadow try_first_pass
 password  required   pam_deny.so
 
 -session  optional   pam_keyinit.so revoke

diff --git a/man/pam_systemd_home.xml b/man/pam_systemd_home.xml
index 10ac7d9838ec50216baa1c2fabfea907c70e0c78..5bd48de4a60284dc209f7339715e6d3dd003990e 100644 (file)
--- a/man/pam_systemd_home.xml
+++ b/man/pam_systemd_home.xml
@@ -158,7 +158,7 @@ account   sufficient pam_unix.so
 account   required   pam_permit.so
 
 <command>-password sufficient pam_systemd_home.so</command>
-password  sufficient pam_unix.so sha512 shadow try_first_pass use_authtok
+password  sufficient pam_unix.so sha512 shadow try_first_pass
 password  required   pam_deny.so
 
 -session  optional   pam_keyinit.so revoke