* src/pwck.c: Warn if an user has an entry in passwd and shadow,

	and the password field in passwd is not 'x'.
	* src/grpck.c: Warn if a group has an entry in group and gshadow,
	and the password field in group is not 'x'.

diff --git a/ChangeLog b/ChangeLog
index b5e2b3a12bf1861c6dcf2a044fd8ba35eeb4ce3a..afae0aac53e5ceea16db419e7ee3f1ab36124ff4 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+2009-05-09  Nicolas François  <nicolas.francois@centraliens.net>
+
+       * src/pwck.c: Warn if an user has an entry in passwd and shadow,
+       and the password field in passwd is not 'x'.
+       * src/grpck.c: Warn if a group has an entry in group and gshadow,
+       and the password field in group is not 'x'.
+
 2009-05-09  Nicolas François  <nicolas.francois@centraliens.net>
 
        * man/login.defs.d/ENCRYPT_METHOD.xml,

diff --git a/NEWS b/NEWS
index 3b9f943812aac6bf71deb69716553548d0abcf38..9421fdca97a6b53b7010c392d3871fe4c90042af 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -14,6 +14,9 @@ shadow-4.1.3.1 -> shadow-4.1.3.2                                      UNRELEASED
     policy in a central place. The -c/--crypt-method, -e/--encrypted,
     -m/--md5 and -s/--sha-rounds options are no more supported on PAM
     enabled systems.
+- grpck
+  * Warn if a group has an entry in group and gshadow, and the password
+    field in group is not 'x'.
 - login
   * Do not trust the current utmp entry's ut_line to set PAM_TTY. This could
     lead to DOS attacks.
@@ -25,6 +28,9 @@ shadow-4.1.3.1 -> shadow-4.1.3.2                                      UNRELEASED
   * Change the passwords using PAM. This permits to define the password
     policy in a central place. The -c/--crypt-method and -s/--sha-rounds
     options are no more supported on PAM enabled systems.
+- pwck
+  * Warn if an user has an entry in passwd and shadow, and the password
+    field in passwd is not 'x'.
 
 *** translation
  - Updated Czech translation

diff --git a/src/grpck.c b/src/grpck.c
index ca4d72e18d9c7d56a1b34106888f3bd562b7967f..15d5f9fba0814a3eb6183f365d547fbe2357493e 100644 (file)
--- a/src/grpck.c
+++ b/src/grpck.c
@@ -627,6 +627,15 @@ static void check_grp_file (int *errors, bool *changed)
                                compare_members_lists (grp->gr_name,
                                                       grp->gr_mem, sgr->sg_mem,
                                                       grp_file, sgr_file);
+
+                               /* The group entry has a gshadow counterpart.
+                                * Make sure no passwords are in group.
+                                */
+                               if (strcmp (grp->gr_passwd, SHADOW_PASSWD_STRING) != 0) {
+                                       printf (_("group %s has an entry in %s, but its password field in %s is not set to 'x'\n"),
+                                               grp->gr_name, sgr_file, grp_file);
+                                       *errors += 1;
+                               }
                        }
                }
 #endif

diff --git a/src/pwck.c b/src/pwck.c
index badb3b26d1b44bc90232cc328507f149397163e2..8bc19a47fdb8302cf7507e17bffcb0ef90386139 100644 (file)
--- a/src/pwck.c
+++ b/src/pwck.c
@@ -497,6 +497,15 @@ static void check_pw_file (int *errors, bool *changed)
                                                exit (E_CANTUPDATE);
                                        }
                                }
+                       } else {
+                               /* The passwd entry has a shadow counterpart.
+                                * Make sure no passwords are in passwd.
+                                */
+                               if (strcmp (pwd->pw_passwd, SHADOW_PASSWD_STRING) != 0) {
+                                       printf (_("user %s has an entry in %s, but its password field in %s is not set to 'x'\n"),
+                                               pwd->pw_name, spw_file, pwd_file);
+                                       *errors += 1;
+                               }
                        }
                }
        }