1

I have a long list (more than 1013 chars) of hostnames and IPs in my /etc/environment no_proxy/NO_PROXY variable, because my corporate proxy does not know them. My local Unbound DNS does. Only some of that hostnames and IPs are working.

It looks like pam_env from that package limits the var=value (e.g. no_proxy="blah") assignments to 1024 bytes each.

  1. How can I get the source (apt-get source libpam-modules)? Which /etc/apt/sources.list deb-src entries do I need?
  2. In which path is pam_env.c, so I can edit it? Does updatedb && locate pam_env.c help?
  3. How do I build it and integrate it in Ubuntu 14.04 and in Ubuntu 16.04?
  • As a non-answer / workaround, what if you set partial variables that were under 1023 bytes then combined them in a separate shell init file? np1=a; np2=b; ... from pam, then final=${np1}${np2}... ? – Jeff Schaller Jul 27 '17 at 15:20
  • 1
    As a side note, your question seems to be about rebuilding pam with larger limits, so I'd recommend that be in the title. – Jeff Schaller Jul 27 '17 at 15:23
  • @JeffSchaller I need my no proxy hosts not only in console but also for applications like Git, Jetty/Tomcat, Jenkins. – uav Jul 27 '17 at 15:27
  • Maybe it is easier to have them source a separate "proxy environment" file during their startup? – Jeff Schaller Jul 27 '17 at 15:31
  • You can alternatively put . /etc/environment in your .profile to read them in. – Mark Plotnick Jul 27 '17 at 15:42
3

Rebuilding PAM with larger limits

Execute scripts as normal user with sudo privileges.

Script for Ubuntu with BZR (= Bazaar) (really untested!)

Create file with vi build_pam_via_ubuntu_and_bzr.sh, put script in it (see below), make file executable chmod +x build_pam_via_ubuntu_and_bzr.sh and exec it with ./build_pam_via_ubuntu_and_bzr.sh

#!/usr/bin/env bash

# Stop when folder exists (please delete manually):
[ -e /opt/bzr/pam/ ] && exit 0

# Update sources:
sudo apt-get update || exit 1

# Install source control:
sudo apt-get install bzr bzr-builddeb -y || exit 1

# Create folder:
sudo mkdir -p /opt/bzr/pam/ || exit 1

# Change owner and group:
sudo chown -R $(id -u):$(id -g) /opt/bzr/pam/  || exit 1

# Enter folder:
cd /opt/bzr/pam/ || exit 1

# Clone PAM repo
bzr branch lp:ubuntu/vivid/pam || exit 1

# Join folder:
cd /opt/bzr/pam/ubuntu/ || exit 1

# Main point: Change BUF_SIZE limit:
sed -i "s/#define BUF_SIZE 1024/#define BUF_SIZE 8192/" modules/pam_env/pam_env.c || exit 1

# Add new version number to debian/changelog:
dch -n "Change environment variable limit from 1024 to 8192." || exit 1

# `bzr builddeb -- -uc -us` will fail with `unmet build dependencies`, install them:
sudo apt-get install libcrack2-dev debhelper quilt flex bison libfl-dev libdb-dev libselinux1-dev po-debconf dh-autoreconf autopoint libaudit-dev pkg-config xsltproc libxml2-utils docbook-xml docbook-xsl w3m -y || exit 1

# Another error lead me to remove fop (maybe not necessary):
###sudo apt-get remove fop || exit 1

# Build packages without signing them (takes ~ 20 minutes):
bzr builddeb -- -uc -us || exit 1

# Install local packages and dependencies with apt-get (possible since Ubuntu 16.04)
# Otherwise (Ubuntu 14.04) use dpkg
sudo apt-get install /opt/bzr/pam/*.deb || sudo dpkg --force-all -i /opt/bzr/pam/*.deb || exit 1

# Now you can have env variables with ~ 8192 chars:
sudo bash -c "echo 'BLUBB123=\"'$(tr -dc 'a-z0-9' < /dev/urandom | head -c8000)'\"' >> /etc/environment" || exit 1

Script for Ubuntu 14.04.5 with Git (tested)

Create file with vi build_pam_via_trusty_and_git.sh, put script in it (see below), make file executable chmod +x build_pam_via_trusty_and_git.sh and exec it with ./build_pam_via_trusty_and_git.sh

#!/usr/bin/env bash

# Stop when folder exists (please delete manually):
[ -e /opt/git/pam/ ] && exit 0

# Update sources:
sudo apt-get update || exit 1

# Install source control:
sudo apt-get install git git-buildpackage -y || exit 1

# Create folder:
sudo mkdir -p /opt/git/pam/ || exit 1

# Change owner and group:
sudo chown -R $(id -u):$(id -g) /opt/git/pam/  || exit 1

# Enter folder:
cd /opt/git/pam/ || exit 1

# Clone PAM repo
git clone -b ubuntu/trusty-security https://git.launchpad.net/~usd-import-team/ubuntu/+source/pam || exit 1

# Join folder:
cd /opt/git/pam/pam/ || exit 1

# Main point: Change BUF_SIZE limit:
sed -i "s/#define BUF_SIZE 1024/#define BUF_SIZE 8192/" modules/pam_env/pam_env.c || exit 1

# Add new version number to debian/changelog (coming from 1.1.8-1ubuntu2.2):
dch -n "Change environment variable limit from 1024 to 8192." || exit 1

# Add changed files to Git index:
git add /opt/git/pam/pam/modules/pam_env/pam_env.c || exit 1
git add /opt/git/pam/pam/debian/changelog || exit 1

# Commit Git index:
git commit -m "Change environment variable limit from 1024 to 8192." || exit 1

sudo apt-get install libcrack2-dev debhelper quilt flex bison libfl-dev libdb-dev libselinux1-dev po-debconf dh-autoreconf autopoint libaudit-dev pkg-config xsltproc libxml2-utils docbook-xml docbook-xsl w3m -y || exit 1

# Another error lead me to remove fop (maybe not necessary):
###sudo apt-get remove fop || exit 1

# Build packages without signing them (takes ~ 20 minutes):
gbp buildpackage --git-debian-branch="ubuntu/trusty-security" --git-ignore-new --git-upstream-tree="ubuntu/trusty-security" -uc -us || exit 1

# Install local packages:
sudo dpkg --force-all -i /opt/git/pam/*.deb || exit 1

# Now you can have env variables with ~ 8192 chars:
sudo bash -c "echo 'BLUBB123=\"'$(tr -dc 'a-z0-9' < /dev/urandom | head -c8000)'\"' >> /etc/environment" || exit 1

Script for Ubuntu 16.04.4 with Git (tested)

Create file with vi build_pam_via_xenial_and_git.sh, put script in it (see below), make file executable chmod +x build_pam_via_xenial_and_git.sh and exec it with ./build_pam_via_xenial_and_git.sh

#!/usr/bin/env bash

# Stop when folder exists (please delete manually):
[ -e /opt/git/pam/ ] && exit 0

# Update sources:
sudo apt-get update || exit 1

# Install source control:
sudo apt-get install git git-buildpackage -y || exit 1

# Create folder:
sudo mkdir -p /opt/git/pam/ || exit 1

# Change owner and group:
sudo chown -R $(id -u):$(id -g) /opt/git/pam/  || exit 1

# Enter folder:
cd /opt/git/pam/ || exit 1

# Clone PAM repo
git clone -b ubuntu/xenial https://git.launchpad.net/~usd-import-team/ubuntu/+source/pam || exit 1

# Join folder:
cd /opt/git/pam/pam/ || exit 1

# Main point: Change BUF_SIZE limit:
sed -i "s/#define BUF_SIZE 1024/#define BUF_SIZE 8192/" modules/pam_env/pam_env.c || exit 1

# Add new version number to debian/changelog (coming from 1.1.8-3.2ubuntu2.1):
dch --distribution unstable --package "pam" --newversion "1.1.8-3.2ubuntu2.2" "Change environment variable limit from 1024 to 8192." || exit 1
# dch -n "Change environment variable limit from 1024 to 8192." || exit 1

# Add changed files to Git index:
git add /opt/git/pam/pam/modules/pam_env/pam_env.c || exit 1
git add /opt/git/pam/pam/debian/changelog || exit 1

# Commit Git index:
git commit -m "Change environment variable limit from 1024 to 8192." || exit 1

sudo apt-get install libcrack2-dev debhelper quilt flex bison libfl-dev libdb-dev libselinux1-dev po-debconf dh-autoreconf autopoint libaudit-dev pkg-config xsltproc libxml2-utils docbook-xml docbook-xsl w3m -y || exit 1

# Another error lead me to remove fop (maybe not necessary):
###sudo apt-get remove fop || exit 1

# Build packages without signing them (takes ~ 20 minutes):
gbp buildpackage --git-debian-branch="ubuntu/xenial" --git-ignore-new --git-upstream-tree="ubuntu/xenial" -uc -us || exit 1

# Install local packages and dependencies with apt-get (possible since Ubuntu 16.04):
sudo apt-get install /opt/git/pam/*.deb -y || exit 1

# Now you can have env variables with ~ 8192 chars:
sudo bash -c "echo 'BLUBB123=\"'$(tr -dc 'a-z0-9' < /dev/urandom | head -c8000)'\"' >> /etc/environment" || exit 1

Testing

Reboot your machine (maybe not necessary):

sudo reboot

Check installed version number:

sudo apt install apt-show-versions
sudo apt-show-versions libpam-modules

returns something like

libpam-modules:amd64 1.1.8-3.2ubuntu2.1 newer than version in archive
libpam-modules:i386 not installed

which is correct.

Reconnect and show env var BLUBB123 with 8000 chars:

echo $BLUBB123

Related to:

  1. https://github.com/linux-pam/linux-pam/issues/31
  2. What happens to self-built packages when I `apt dist-upgrade`?
  • You can use set -e in your scripts to avoid all the || exit 1 statements. Check out dch --nmu, it will produce a valid, newer version regardless of what the current version is, so you don’t need to hard-code a version number in your script. – Stephen Kitt Aug 2 '17 at 14:24
  • Hehe, I am coming from Python with explicit is better than implicit and set -e has side-effects. I will check dch --nmu. – uav Aug 2 '17 at 14:39
  • First: dch --help states that dch --nmu is the same as dch -n. Second: If you want that no editor (like vim, nano, mcedit) is shown (non-interactive/console only), give a message behind, like dch -n "foobar". – uav Aug 2 '17 at 16:07
  • My point was to use --nmu (or -n) instead of hard-coding a version with --newversion, that’s all. – Stephen Kitt Aug 2 '17 at 16:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.