Bug#734818: enable pam_keyinit by default

2014-05-08 Thread Laurent Bigonville
Le Wed, 7 May 2014 08:18:09 -0700, Steve Langasek a écrit : > On Wed, May 07, 2014 at 10:13:02AM +0200, Laurent Bigonville wrote: > > Le Tue, 6 May 2014 09:36:59 -0700, > > Steve Langasek a écrit : > > > > On Tue, May 06, 2014 at 09:12:59AM -0700, Russ Allbery wrote: > > > > Laurent Bigonville

Bug#734818: enable pam_keyinit by default

2014-05-07 Thread Steve Langasek
On Wed, May 07, 2014 at 10:13:02AM +0200, Laurent Bigonville wrote: > Le Tue, 6 May 2014 09:36:59 -0700, > Steve Langasek a écrit : > > On Tue, May 06, 2014 at 09:12:59AM -0700, Russ Allbery wrote: > > > Laurent Bigonville writes: > > > > On Fedora they are using: > > > > session optional pa

Bug#734818: enable pam_keyinit by default

2014-05-07 Thread Laurent Bigonville
Le Tue, 6 May 2014 09:36:59 -0700, Steve Langasek a écrit : > On Tue, May 06, 2014 at 09:12:59AM -0700, Russ Allbery wrote: > > Laurent Bigonville writes: > > > > On Fedora they are using: > > > > session optional pam_keyinit force revoke > > > force revoke looks good to me. I'm not sure t

Bug#734818: enable pam_keyinit by default

2014-05-06 Thread Steve Langasek
On Tue, May 06, 2014 at 09:12:59AM -0700, Russ Allbery wrote: > Laurent Bigonville writes: > > On Fedora they are using: > > session optional pam_keyinit force revoke > force revoke looks good to me. I'm not sure that force is necessary, but > it's probably a good idea in general. > > As it

Bug#734818: enable pam_keyinit by default

2014-05-06 Thread Russ Allbery
Laurent Bigonville writes: > On Fedora they are using: > session optional pam_keyinit force revoke force revoke looks good to me. I'm not sure that force is necessary, but it's probably a good idea in general. > As it's only available on linux architectures, I was thinking of adding > a '-'

Bug#734818: enable pam_keyinit by default

2014-05-06 Thread Laurent Bigonville
Hello, Steve Langasek wrote: > Hi Russ, > > On Wed, Jan 08, 2014 at 07:00:54PM -0800, Russ Allbery wrote: > > It would be better for any application that uses the kernel keyring > > if pam_keyinit were run by default in the PAM session stack. > > Without this module, users are placed in a default