Re: [hylafax-users] proceedure for hylafax setup for PAM authentiation

[Dileep <dileep@xxxxxxxxxxxxxxx>]

Hi,

this is to revisit my old problem, which has become more confusing!!

I have upgraded to 'hylafax-4.2.3-1rhel4.i386.rpm' to try and make PAM 
authentication work and observed something very funny(alarming!!). Now 
my WHFC client asks for a password to connect, but accepts anything that 
I throw at it.

I removed my /etc/pam.d entry for hylafax to test if it is actually 
checking with PAM and still the server accepts any password that I 
give!! So I concluded that hylafax is not attempting to use PAM.

Next I went one more step and commented out 'all' the entries in 
hosts.hfaxd (including the localhost and 127.0.0.1 entries). The server 
still accepted any user and password!

So now I am running without any entries in hosts.hfaxd and without any 
/etc/pam.d file. I feel this could be a serious security issue as the 
server does not seem to have any means to restrict access.

If anybody has experienced similar problems, please let me know how to 
work around it. I am using RHEL 4.0.

regards

dileep

Lee Howard wrote:
> See if this link helps you any:
>
>  http://bugs.hylafax.org/bugzilla/show_bug.cgi?id=439
>
> Lee.
>
>
> Dileep V.S. wrote:
>
> > Hi,
> >
> > I have been doing some research on finding documentation on how to use 
> > PAM authentication with Hylafax. On hylafax website it only says in 
> > many places that  Hylafax 4.2 supports PAM, but no documentation on 
> > how to get this setup and working. I also downloaded the latest source 
> > to see if it comes with some documentation on this, without success.
> >
> > From what ever information I could gather from googling, I understand 
> > that you have to create /et/pam.d/hylafax file with the usual pam 
> > entries. But I am at a loss to understand how to tell hylafax to use 
> > PAM instead of the default hosts.hfaxd file for user authentication.
> >
> > In '/etc/hylafax/hfaxd.conf' I have found the following line - 
> > UserAcessFile:  "/etc/hosts.hfaxd". However this is commented out. Is 
> > this the place where I tell Hylafax to look for PAM authentication? if 
> > yes what is the directive? Do I have to install some additional 
> > modules? Is there any way to find if the installed Hylafax packege has 
> > PAM support?
> >
> > I am running  hylafax-4.2.1 on RHEL 4.0.
> >
> > dileep
> >
> >
> >
> > ____________________ HylaFAX(tm) Users Mailing List 
> > _______________________
> >  To subscribe/unsubscribe, click 
> > http://lists.hylafax.org/cgi-bin/lsg2.cgi
> > On UNIX: mail -s unsubscribe hylafax-users-request@xxxxxxxxxxx < 
> > /dev/null
> >  *To learn about expensive HylaFAX(tm) support, mail sales@xxxxxxxxx*
>
>
> ____________________ HylaFAX(tm) Users Mailing List _______________________
>  To subscribe/unsubscribe, click http://lists.hylafax.org/cgi-bin/lsg2.cgi
> On UNIX: mail -s unsubscribe hylafax-users-request@xxxxxxxxxxx < /dev/null
>  *To learn about commercial HylaFAX(tm) support, mail sales@xxxxxxxxx*

____________________ HylaFAX(tm) Users Mailing List _______________________
 To subscribe/unsubscribe, click http://lists.hylafax.org/cgi-bin/lsg2.cgi
On UNIX: mail -s unsubscribe hylafax-users-request@xxxxxxxxxxx < /dev/null
 *To learn about commercial HylaFAX(tm) support, mail sales@xxxxxxxxx*