4:03 p.m.
On a standard installation of FC1 and FC2 (and FC3?) is permit to login
with a user with a empty password ... is this correct?
[root@igloo root]# man sshd_config
PermitEmptyPasswords
When password authentication is allowed, it specifies whether the
server allows login to accounts with empty password strings. The
default is “no”.
[root@igloo root]# grep PermitEmptyPasswords
/etc/ssh/sshd_config
#PermitEmptyPasswords no
[root@igloo root]# useradd nopasswd
[root@igloo root]# passwd -d nopasswd
Removing password for user nopasswd.
passwd: Success
[root@igloo root]# ssh nopasswd@localhost
nopasswd@localhost's password: <type ENTER>
Permission denied, please try again.
nopasswd@localhost's password: <type "x" then ENTER>
[nopasswd@igloo nopasswd]$ id
uid=505(nopasswd) gid=507(nopasswd) gruppi=507(nopasswd)
[nopasswd@igloo nopasswd]$
How to disable this "feature"?
Many thanks
--
Dario Lesca <d.lesca(a)solinos.it>
2:01 a.m.
On Wed, 2004-11-24 at 23:03 +0100, Dario Lesca wrote:
On a standard installation of FC1 and FC2 (and FC3?) is permit to
login
with a user with a empty password ... is this correct?
This is fixed in FC3.
How to disable this "feature"?
Remove:
auth required pam_stack.so service=system-auth
from /etc/pam.d/sshd and replace it with auth lines
from /etc/pam.d/system-auth except with removing nullok option of
pam_unix.so
Or rebuild pam...src.rpm from FC3 on your FC2/1 and install it.
--
Tomas Mraz <tmraz(a)redhat.com>
5:54 a.m.
Il gio, 2004-11-25 alle 09:01, Tomas Mraz ha scritto:
On Wed, 2004-11-24 at 23:03 +0100, Dario Lesca wrote:
> On a standard installation of FC1 and FC2 (and FC3?) is permit to login
> with a user with a empty password ... is this correct?
This is fixed in FC3.
so this is a bug. (bad bug!), if I say "PermitEmptyPasswords no" SSHD
must NON permit logon to user whitout a password.
is a bug of openssh or fc-openssh?
Many thanks for your reply.
--
Dario Lesca <d.lesca(a)solinos.it>
7:05 a.m.
On Fri, 2004-11-26 at 12:54 +0100, Dario Lesca wrote:
Il gio, 2004-11-25 alle 09:01, Tomas Mraz ha scritto:
> On Wed, 2004-11-24 at 23:03 +0100, Dario Lesca wrote:
> > On a standard installation of FC1 and FC2 (and FC3?) is permit to login
> > with a user with a empty password ... is this correct?
> This is fixed in FC3.
so this is a bug. (bad bug!), if I say "PermitEmptyPasswords no" SSHD
must NON permit logon to user whitout a password.
is a bug of openssh or fc-openssh?
Bug in PAM.
--
Tomas Mraz <tmraz(a)redhat.com>
2:40 a.m.
On Wed, 2004-11-24 at 23:03, Dario Lesca wrote:
On a standard installation of FC1 and FC2 (and FC3?) is permit to
login
with a user with a empty password ... is this correct?
[snip]
How to disable this "feature"?
Put a non working shell as default for this user.
[root@igloo root]# useradd -s /sbin/nologin nopasswd
If you've got it already created use,
[root@igloo root]# usermod -s /sbin/nologin nopasswd
--
Iago Rubio
10:05 a.m.
On Thu, Nov 25, 2004 at 09:40:42AM +0100, Iago Rubio wrote:
> On a standard installation of FC1 and FC2 (and FC3?) is permit
to login
> with a user with a empty password ... is this correct?
Put a non working shell as default for this user.
[root@igloo root]# useradd -s /sbin/nologin nopasswd
That'll make it kind of hard for the user to get any work done, won't it?
--
Matthew Miller mattdm(a)mattdm.org <http://www.mattdm.org/>
Boston University Linux ------> <http://linux.bu.edu/>
3:54 a.m.
On Thu, 2004-11-25 at 17:05, Matthew Miller wrote:
On Thu, Nov 25, 2004 at 09:40:42AM +0100, Iago Rubio wrote:
> > On a standard installation of FC1 and FC2 (and FC3?) is permit to login
> > with a user with a empty password ... is this correct?
> Put a non working shell as default for this user.
> [root@igloo root]# useradd -s /sbin/nologin nopasswd
That'll make it kind of hard for the user to get any work done, won't it?
You've got a big bunch of users in your system with no login shells, and
they get their work done.
Check your /etc/passwd.
--
Iago Rubio
4:35 p.m.
On Fri, Nov 26, 2004 at 10:54:16AM +0100, Iago Rubio wrote:
> > Put a non working shell as default for this user.
> > [root@igloo root]# useradd -s /sbin/nologin nopasswd
> That'll make it kind of hard for the user to get any work done, won't it?
You've got a big bunch of users in your system with no login shells, and
they get their work done.
Check your /etc/passwd.
There's users and then there's users. :)
Not wanting regular (human) user accounts to be allowed to work with empty
passwords is a good precaution against accidents. (See
<https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=86414>;, for an example
of something that could happen.)
Obviously your suggestion is good for system accounts.
--
Matthew Miller mattdm(a)mattdm.org <http://www.mattdm.org/>
Boston University Linux ------> <http://linux.bu.edu/>
7091
days inactive
7093
days old
9 comments
6 participants
participants (6)
-
Dario Lesca -
Iago Rubio -
Kenneth Porter -
Matthew Miller -
Ralf Ertzinger -
Tomas Mraz