Bug#396726: chpasswd does not update opasswd

2006-11-06 Thread Brian Ristuccia
On Fri, Nov 03, 2006 at 10:50:12PM +0100, Nicolas Fran?ois wrote: chpasswd is currently not compiled with PAM support on Debian. As PAM is responsible for updating /etc/security/opasswd, I prefer to keep this bug open, but tagging it wontfix, until we decide whether we can compile this

Bug#396726: chpasswd does not update opasswd

2006-11-06 Thread Nicolas François
On Mon, Nov 06, 2006 at 10:15:35AM -0500, Brian Ristuccia wrote: On Fri, Nov 03, 2006 at 10:50:12PM +0100, Nicolas Fran?ois wrote: chpasswd is currently not compiled with PAM support on Debian. As PAM is responsible for updating /etc/security/opasswd, I prefer to keep this bug open, but

Bug#396726: chpasswd does not update opasswd

2006-11-06 Thread Brian Ristuccia
On Mon, Nov 06, 2006 at 05:07:31PM +0100, Nicolas Fran?ois wrote: I recommend you to set users' password by root to a simple password that can be communicated to the user, but also tag the password as expired, so that the user have to choose a new password the next time he login (and then

Bug#396726: chpasswd does not update opasswd

2006-11-06 Thread Nicolas François
On Mon, Nov 06, 2006 at 12:09:59PM -0500, Brian Ristuccia wrote: On Mon, Nov 06, 2006 at 05:07:31PM +0100, Nicolas François wrote: I recommend you to set users' password by root to a simple password that can be communicated to the user, but also tag the password as expired, so that the

Bug#396726: chpasswd does not update opasswd

2006-11-03 Thread Nicolas François
tags 396726 wontfix thanks Hello, On Thu, Nov 02, 2006 at 09:38:22AM -0500, Brian Ristuccia wrote: When changing a password with chpasswd, the previous password hash is not stored in /etc/security/opasswd. As a result, nothing prevents the user from changing their password back to a

Bug#396726: chpasswd does not update opasswd

2006-11-02 Thread Brian Ristuccia
Package: passwd Version: 1:4.0.3-31sarge5 When changing a password with chpasswd, the previous password hash is not stored in /etc/security/opasswd. As a result, nothing prevents the user from changing their password back to a previous (potentially compromised) value. -- Brian Ristuccia [EMAIL