On Tuesday 03 July 2007 08:41, Tito wrote: > On Tuesday 03 July 2007 08:11:42 Denis Vlasenko wrote: > > On Tuesday 03 July 2007 00:08, Tito wrote: > > > Hi, > > > I noticed that our password checking routine in correct_password.c > > > behaves differently than real login app. > > > In case that support for shadow passwords is enabled and > > > /etc/shadow is missing it complains with an error message: > > > > > > "no valid shadow password, checking ordinary one" > > > > > > thus disclosing information about the state of the system. > > > I think it should instead fake an incorrect login. > > > A patch is attached, comments and critics are welcome. > > > > With this patch, you *require* admin to keep passwords in /etc/shadow. > Why? > > + if (LONE_CHAR(pw->pw_passwd, 'x') || LONE_CHAR(pw->pw_passwd, '*')) > + correct = (getspnam_r(pw->pw_name, &spw, buffer, > sizeof(buffer), &result)) ? "aa" : spw.sp_pwdp; > > It's the admin himself that is saying through 'x' or '*' that he wants to use > shadow passwords. > If you put a real password in pw->pw_passwd this code is not executed.
Oops... my brainfart, you're right. Will fix in svn in a few minutes. -- vda _______________________________________________ busybox mailing list [email protected] http://busybox.net/cgi-bin/mailman/listinfo/busybox
