Relevant BUGIDs:

Purpose of commit: bugfix

Commit summary:
---------------

Don't be more restrictive than useradd for account names:

2006-12-20  Thorsten Kukuk  <kukuk@thkukuk.de>

        * modules/pam_unix/pam_unix_passwd.c (pam_sm_chauthtok): Forbid
        only '+' and '-' as first characters for account names.
        * modules/pam_unix/pam_unix_auth.c (pam_sm_authenticate): Likewise.

diff --git a/ChangeLog b/ChangeLog
index a1d3b113f2872dcac9b21e03ce746172c6eec280..91147f23aab326bd8315a405f1aba21656f57546 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+2006-12-20  Thorsten Kukuk  <kukuk@thkukuk.de>
+
+       * modules/pam_unix/pam_unix_passwd.c (pam_sm_chauthtok): Forbid
+       only '+' and '-' as first characters for account names.
+       * modules/pam_unix/pam_unix_auth.c (pam_sm_authenticate): Likewise.
+
 2006-12-18  Thorsten Kukuk  <kukuk@thkukuk.de>
 
        * configure.in: Fix ENOKEY check (specify errno.h as header
@@ -16,14 +22,14 @@
 
        * modules/pam_unix/pam_unix_passwd.c (pam_sm_chauthtok): Localize
        message printed to user.
-       
+
        * modules/pam_unix/support.c (_unix_verify_password): Use strncmp
        only for bigcrypt result.
-       
+
        * modules/pam_keyinit/pam_keyinit.c (kill_keyrings): Switch to new
        egid first, euid next. Revert euid/egid to old euid/egid and not
        ruid/rgid.
-       (pam_sm_open_session): Switch to new rgid first, ruid next. 
+       (pam_sm_open_session): Switch to new rgid first, ruid next.
 
 2006-12-13  Thorsten Kukuk  <kukuk@thkukuk.de>
 

diff --git a/modules/pam_unix/pam_unix_auth.c b/modules/pam_unix/pam_unix_auth.c
index 5cdec27f46fe868d605f21629acf7211b93ba6f7..3004bee848eb4e8d15f69a06c538e98a5356bf4e 100644 (file)
--- a/modules/pam_unix/pam_unix_auth.c
+++ b/modules/pam_unix/pam_unix_auth.c
@@ -124,11 +124,10 @@ PAM_EXTERN int pam_sm_authenticate(pam_handle_t * pamh, int flags
        if (retval == PAM_SUCCESS) {
                /*
                 * Various libraries at various times have had bugs related to
-                * '+' or '-' as the first character of a user name. Don't take
-                * any chances here. Require that the username starts with an
-                * alphanumeric character.
+                * '+' or '-' as the first character of a user name. Don't
+                * allow this characters here.
                 */
-               if (name == NULL || !isalnum(*name)) {
+               if (name == NULL || name[0] == '-' || name[0] == '+') {
                        pam_syslog(pamh, LOG_ERR, "bad username [%s]", name);
                        retval = PAM_USER_UNKNOWN;
                        AUTH_RETURN;

diff --git a/modules/pam_unix/pam_unix_passwd.c b/modules/pam_unix/pam_unix_passwd.c
index c7ee28c9467460fbcc7b2d96ccec1658cd5c1544..8921d1cc11aad85f81b30528dcec0f28be13d5ff 100644 (file)
--- a/modules/pam_unix/pam_unix_passwd.c
+++ b/modules/pam_unix/pam_unix_passwd.c
@@ -1037,11 +1037,10 @@ PAM_EXTERN int pam_sm_chauthtok(pam_handle_t * pamh, int flags,
        if (retval == PAM_SUCCESS) {
                /*
                 * Various libraries at various times have had bugs related to
-                * '+' or '-' as the first character of a user name. Don't take
-                * any chances here. Require that the username starts with an
-                * alphanumeric character.
+                * '+' or '-' as the first character of a user name. Don't
+                * allow them.
                 */
-               if (user == NULL || !isalnum(*user)) {
+               if (user == NULL || user[0] == '-' || user[0] == '+') {
                        pam_syslog(pamh, LOG_ERR, "bad username [%s]", user);
                        return PAM_USER_UNKNOWN;
                }