1

I have a long list (more than 1013 chars) of hostnames and IPs in my /etc/environment no_proxy/NO_PROXY variable, because my corporate proxy does not know them. My local Unbound DNS does. Only some of that hostnames and IPs are working.

It looks like pam_env from that package limits the var=value (e.g. no_proxy="blah") assignments to 1024 bytes each.

  1. How can I get the source (apt-get source libpam-modules)? Which /etc/apt/sources.list deb-src entries do I need?
  2. In which path is pam_env.c, so I can edit it? Does updatedb && locate pam_env.c help?
  3. How do I build it and integrate it in Ubuntu 14.04 and in Ubuntu 16.04?
9
  • As a non-answer / workaround, what if you set partial variables that were under 1023 bytes then combined them in a separate shell init file? np1=a; np2=b; ... from pam, then final=${np1}${np2}... ?
    – Jeff Schaller
    Commented Jul 27, 2017 at 15:20
  • 1
    As a side note, your question seems to be about rebuilding pam with larger limits, so I'd recommend that be in the title.
    – Jeff Schaller
    Commented Jul 27, 2017 at 15:23
  • @JeffSchaller I need my no proxy hosts not only in console but also for applications like Git, Jetty/Tomcat, Jenkins.
    – uav
    Commented Jul 27, 2017 at 15:27
  • Maybe it is easier to have them source a separate "proxy environment" file during their startup?
    – Jeff Schaller
    Commented Jul 27, 2017 at 15:31
  • You can alternatively put . /etc/environment in your .profile to read them in. Commented Jul 27, 2017 at 15:42

1 Answer 1

3

Rebuilding PAM with larger limits

Execute scripts as normal user with sudo privileges.

Script for Ubuntu with BZR (= Bazaar) (really untested!)

Create file with vi build_pam_via_ubuntu_and_bzr.sh, put script in it (see below), make file executable chmod +x build_pam_via_ubuntu_and_bzr.sh and exec it with ./build_pam_via_ubuntu_and_bzr.sh

#!/usr/bin/env bash

# Stop when folder exists (please delete manually):
[ -e /opt/bzr/pam/ ] && exit 0

# Update sources:
sudo apt-get update || exit 1

# Install source control:
sudo apt-get install bzr bzr-builddeb -y || exit 1

# Create folder:
sudo mkdir -p /opt/bzr/pam/ || exit 1

# Change owner and group:
sudo chown -R $(id -u):$(id -g) /opt/bzr/pam/  || exit 1

# Enter folder:
cd /opt/bzr/pam/ || exit 1

# Clone PAM repo
bzr branch lp:ubuntu/vivid/pam || exit 1

# Join folder:
cd /opt/bzr/pam/ubuntu/ || exit 1

# Main point: Change BUF_SIZE limit:
sed -i "s/#define BUF_SIZE 1024/#define BUF_SIZE 8192/" modules/pam_env/pam_env.c || exit 1

# Add new version number to debian/changelog:
dch -n "Change environment variable limit from 1024 to 8192." || exit 1

# `bzr builddeb -- -uc -us` will fail with `unmet build dependencies`, install them:
sudo apt-get install libcrack2-dev debhelper quilt flex bison libfl-dev libdb-dev libselinux1-dev po-debconf dh-autoreconf autopoint libaudit-dev pkg-config xsltproc libxml2-utils docbook-xml docbook-xsl w3m -y || exit 1

# Another error lead me to remove fop (maybe not necessary):
###sudo apt-get remove fop || exit 1

# Build packages without signing them (takes ~ 20 minutes):
bzr builddeb -- -uc -us || exit 1

# Install local packages and dependencies with apt-get (possible since Ubuntu 16.04)
# Otherwise (Ubuntu 14.04) use dpkg
sudo apt-get install /opt/bzr/pam/*.deb || sudo dpkg --force-all -i /opt/bzr/pam/*.deb || exit 1

# Now you can have env variables with ~ 8192 chars:
sudo bash -c "echo 'BLUBB123=\"'$(tr -dc 'a-z0-9' < /dev/urandom | head -c8000)'\"' >> /etc/environment" || exit 1

Script for Ubuntu 14.04.5 with Git (tested)

Create file with vi build_pam_via_trusty_and_git.sh, put script in it (see below), make file executable chmod +x build_pam_via_trusty_and_git.sh and exec it with ./build_pam_via_trusty_and_git.sh

#!/usr/bin/env bash

# Stop when folder exists (please delete manually):
[ -e /opt/git/pam/ ] && exit 0

# Update sources:
sudo apt-get update || exit 1

# Install source control:
sudo apt-get install git git-buildpackage -y || exit 1

# Create folder:
sudo mkdir -p /opt/git/pam/ || exit 1

# Change owner and group:
sudo chown -R $(id -u):$(id -g) /opt/git/pam/  || exit 1

# Enter folder:
cd /opt/git/pam/ || exit 1

# Clone PAM repo
git clone -b ubuntu/trusty-security https://git.launchpad.net/~usd-import-team/ubuntu/+source/pam || exit 1

# Join folder:
cd /opt/git/pam/pam/ || exit 1

# Main point: Change BUF_SIZE limit:
sed -i "s/#define BUF_SIZE 1024/#define BUF_SIZE 8192/" modules/pam_env/pam_env.c || exit 1

# Add new version number to debian/changelog (coming from 1.1.8-1ubuntu2.2):
dch -n "Change environment variable limit from 1024 to 8192." || exit 1

# Add changed files to Git index:
git add /opt/git/pam/pam/modules/pam_env/pam_env.c || exit 1
git add /opt/git/pam/pam/debian/changelog || exit 1

# Commit Git index:
git commit -m "Change environment variable limit from 1024 to 8192." || exit 1

sudo apt-get install libcrack2-dev debhelper quilt flex bison libfl-dev libdb-dev libselinux1-dev po-debconf dh-autoreconf autopoint libaudit-dev pkg-config xsltproc libxml2-utils docbook-xml docbook-xsl w3m -y || exit 1

# Another error lead me to remove fop (maybe not necessary):
###sudo apt-get remove fop || exit 1

# Build packages without signing them (takes ~ 20 minutes):
gbp buildpackage --git-debian-branch="ubuntu/trusty-security" --git-ignore-new --git-upstream-tree="ubuntu/trusty-security" -uc -us || exit 1

# Install local packages:
sudo dpkg --force-all -i /opt/git/pam/*.deb || exit 1

# Now you can have env variables with ~ 8192 chars:
sudo bash -c "echo 'BLUBB123=\"'$(tr -dc 'a-z0-9' < /dev/urandom | head -c8000)'\"' >> /etc/environment" || exit 1

Script for Ubuntu 16.04.4 with Git (tested)

Create file with vi build_pam_via_xenial_and_git.sh, put script in it (see below), make file executable chmod +x build_pam_via_xenial_and_git.sh and exec it with ./build_pam_via_xenial_and_git.sh

#!/usr/bin/env bash

# Stop when folder exists (please delete manually):
[ -e /opt/git/pam/ ] && exit 0

# Update sources:
sudo apt-get update || exit 1

# Install source control:
sudo apt-get install git git-buildpackage -y || exit 1

# Create folder:
sudo mkdir -p /opt/git/pam/ || exit 1

# Change owner and group:
sudo chown -R $(id -u):$(id -g) /opt/git/pam/  || exit 1

# Enter folder:
cd /opt/git/pam/ || exit 1

# Clone PAM repo
git clone -b ubuntu/xenial https://git.launchpad.net/~usd-import-team/ubuntu/+source/pam || exit 1

# Join folder:
cd /opt/git/pam/pam/ || exit 1

# Main point: Change BUF_SIZE limit:
sed -i "s/#define BUF_SIZE 1024/#define BUF_SIZE 8192/" modules/pam_env/pam_env.c || exit 1

# Add new version number to debian/changelog (coming from 1.1.8-3.2ubuntu2.1):
dch --distribution unstable --package "pam" --newversion "1.1.8-3.2ubuntu2.2" "Change environment variable limit from 1024 to 8192." || exit 1
# dch -n "Change environment variable limit from 1024 to 8192." || exit 1

# Add changed files to Git index:
git add /opt/git/pam/pam/modules/pam_env/pam_env.c || exit 1
git add /opt/git/pam/pam/debian/changelog || exit 1

# Commit Git index:
git commit -m "Change environment variable limit from 1024 to 8192." || exit 1

sudo apt-get install libcrack2-dev debhelper quilt flex bison libfl-dev libdb-dev libselinux1-dev po-debconf dh-autoreconf autopoint libaudit-dev pkg-config xsltproc libxml2-utils docbook-xml docbook-xsl w3m -y || exit 1

# Another error lead me to remove fop (maybe not necessary):
###sudo apt-get remove fop || exit 1

# Build packages without signing them (takes ~ 20 minutes):
gbp buildpackage --git-debian-branch="ubuntu/xenial" --git-ignore-new --git-upstream-tree="ubuntu/xenial" -uc -us || exit 1

# Install local packages and dependencies with apt-get (possible since Ubuntu 16.04):
sudo apt-get install /opt/git/pam/*.deb -y || exit 1

# Now you can have env variables with ~ 8192 chars:
sudo bash -c "echo 'BLUBB123=\"'$(tr -dc 'a-z0-9' < /dev/urandom | head -c8000)'\"' >> /etc/environment" || exit 1

Testing

Reboot your machine (maybe not necessary):

sudo reboot

Check installed version number:

sudo apt install apt-show-versions
sudo apt-show-versions libpam-modules

returns something like

libpam-modules:amd64 1.1.8-3.2ubuntu2.1 newer than version in archive
libpam-modules:i386 not installed

which is correct.

Reconnect and show env var BLUBB123 with 8000 chars:

echo $BLUBB123

Related to:

  1. https://github.com/linux-pam/linux-pam/issues/31
  2. What happens to self-built packages when I `apt dist-upgrade`?
4
  • You can use set -e in your scripts to avoid all the || exit 1 statements. Check out dch --nmu, it will produce a valid, newer version regardless of what the current version is, so you don’t need to hard-code a version number in your script. Commented Aug 2, 2017 at 14:24
  • Hehe, I am coming from Python with explicit is better than implicit and set -e has side-effects. I will check dch --nmu.
    – uav
    Commented Aug 2, 2017 at 14:39
  • First: dch --help states that dch --nmu is the same as dch -n. Second: If you want that no editor (like vim, nano, mcedit) is shown (non-interactive/console only), give a message behind, like dch -n "foobar".
    – uav
    Commented Aug 2, 2017 at 16:07
  • My point was to use --nmu (or -n) instead of hard-coding a version with --newversion, that’s all. Commented Aug 2, 2017 at 16:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .