Package: sh-utils
Version: 2.0f
Command: su
Summary: su breaks shadow authentication and pam authentication

Hallo sh-utils developers.

I have found followning bug in sh-utils's su:

If shadow package is installed and defined user has shadow password,
an "invalid password" response is obtained from su.

Details:
Looking at shadow's su, the algorithm is following:
Look at passwd record. If password field does not contain shadow padding,
use this password, otherwise look at shadow record for password.
sh-utils's su doesnt't do this step.

Solution:
I see the simplest possible solution: Don't install su, if shadow package is
installed ;-). Let shadow's su does the shadow things.

Conclusion:
Do the same also in case pam package is installed. Pam also have its own
su, which covers more authentication types. Installing sh-utils's su
breaks su pam support.

-- 
Stanislav Brabec

Reply via email to