Use crypt_checkpass.
Note that this introduces a slight functional change. A user with a blank
password will be allowed to login with a blank password. I think if you don't
like that, you should give the user a password.
Bonus: if the user is not found, hashing work is still performed to prevent
trivial timing leak.
Index: auth.c
===================================================================
RCS file: /cvs/src/usr.sbin/pppd/auth.c,v
retrieving revision 1.37
diff -u -p -r1.37 auth.c
--- auth.c 17 May 2016 20:51:56 -0000 1.37
+++ auth.c 17 May 2016 20:54:37 -0000
@@ -741,25 +741,12 @@ plogin(user, passwd, msg, msglen)
char **msg;
int *msglen;
{
-
-
struct passwd *pw;
char *tty;
-
pw = getpwnam_shadow(user);
- endpwent();
- if (pw == NULL) {
- return (UPAP_AUTHNAK);
- }
-
-
- /*
- * If no passwd, don't let them login.
- */
- if (pw->pw_passwd == NULL || *pw->pw_passwd == '\0'
- || strcmp(crypt(passwd, pw->pw_passwd), pw->pw_passwd) != 0)
- return (UPAP_AUTHNAK);
+ if (crypt_checkpass(passwd, pw ? pw->pw_passwd : NULL))
+ return UPAP_AUTHNAK;
/*
* Write a wtmp entry for this user.
