On Thu, May 22, 2008 at 5:54 AM, Nico Golde <<a href="mailto:nion@debian.org">nion@debian.org</a>> wrote:<br><div class="gmail_quote"><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
reassign 482352 login<br>
severity normal<br>
tags 482352 - security<br>
thanks<br>
<br>
Hi Nicholas,<br>
* Nicholas Fleisher <<a href="mailto:nfleisher@gmail.com">nfleisher@gmail.com</a>> [2008-05-22 04:43]:<br>
[...]<br>
<div class="Ih2E3d">> Apologies if I've reported this as too severe: it was dealt with as high<br>
> severity in Arch, and seems like a major issue to this layman. Wish I<br>
> could tell you more, but as far as I can tell that's the extent of the<br>
> problem; everything works just fine if you login with a name that exists<br>
> on the system.<br>
<br>
</div>Adjusting severity. This is due to /etc/pam.d/login using<br>
auth requisite pam_securetty.so instead of<br>
auth require pam_securetty.so.<br>
<br>
However this is a known issue and even documented in the<br>
manual (man pam.conf):</blockquote><div><br>Thanks very much for the info and for the pointers on how to change it if desired! I wasn't aware of the password security concerns that prompted the 'requisite' setting instead of 'required', but simply remembered the discussion from when this came up on Arch and the level of concern it generated there. Anyway, thanks again.<br>
</div><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">Looking at this I don't really see this as a security issue, especially not<br>
as it makes sense to set it to requisite and people can still configure it<br>
different if they want.<br>
<br>
Opinions?</blockquote><div><br>All sounds reasonable to me. Sorry for any bother, and thanks for the pointers!<br><br>-NF<br> </div></div>