Description

When configuring cobbler-web to authentificate via PAM. The authorization of a account validity is missing. Therefore expired accounts can still login.

Proof of Concept

Enable authn_pam in the modules.conf

Create a testuser to login

    $ useradd expired_user

    $ passwd expired_user
    # 12345

    $ chage -E0 expired_user

Login via cobbler-web and see that it works although you don't have any privileges anymore.

Impact

Since disabling an account still would allow login via ssh-keys or alike, it is common usage to expire an PAM account. Therefore the PAM library demands to check the handle with pam_acct_mgmt() after successful pam_authenticate()

After successfull authentication, the authorization of the user is not checked via pam_acct_mgmt(). This allows access to accounts that have been expired or have expired passwords. Both should be declined access by PAM convention. Depending on how cobbler is configured this can become pretty severe. You don’t revoke privileges for an account without a reason.