Commit Graph

411 Commits

Author SHA1 Message Date
nekral-guest
a917ba4fb9 *** security:
- generation of SHA encrypted passwords (chpasswd, gpasswd, newusers,
  chgpasswd; and also passwd if configured without PAM support).
  The number of rounds and number of salt bytes was fixed to their lower
  allowed values (resp. configurable and 8), hence voiding some of the
  advantages of this encryption method. Dictionary attacks with
  precomputed tables were easier than expected, but still harder than with
  the MD5 (or DES) methods.

	* NEWS, libmisc/salt.c (SHA_salt_size): Seed the RNG, and fix a
	overflow. These caused the SHA salt size to always be 8 bytes,
	instead of being in the 8-16 range. Thanks to Peter Vrabec
	pvrabec@redhat.com for noticing.
	* NEWS, libmisc/salt.c (SHA_salt_rounds): Seed the RNG with
	seedRNG instead of srand, and fix the same overflow. This caused
	the number of rounds to always be the smallest one.
2008-05-20 13:34:06 +00:00
nekral-guest
9c69fe73b1 Tag the section which require --enable-shadowgrp or --with-sha-crypt
accordingly.
2008-05-19 22:18:14 +00:00
nekral-guest
63228ac1c6 SHA_CRYPT_MAX_ROUNDS and SHA_CRYPT_MIN_ROUNDS can only exist if configured with --with-sha-crypt. 2008-05-19 21:57:48 +00:00
nekral-guest
a071d72e48 Document the -k, --skel option, and update the -m, --create-home documentation. 2008-05-19 21:32:19 +00:00
nekral-guest
7ab3a97dfe Sort options. 2008-05-19 21:04:34 +00:00
nekral-guest
ae7aeda621 SHA_CRYPT_MAX_ROUNDS and SHA_CRYPT_MIN_ROUNDS can
only exist if configured with --with-sha-crypt.
2008-05-19 20:59:51 +00:00
nekral-guest
0d6b2221ab SHA_CRYPT_MAX_ROUNDS and SHA_CRYPT_MIN_ROUNDS can
only exist if configured with --with-sha-crypt.
2008-05-19 20:58:59 +00:00
nekral-guest
337a97ceab Document the sections closed by #endif 2008-05-19 20:56:48 +00:00
nekral-guest
461d69522f * NEWS, man/groupadd.8.xml: Document the -r, --system option.
* NEWS, man/newusers.8.xml: Document the -r, --system option.
	* NEWS, man/newusers.8.xml: Document the -c, --crypt-method and
	-s, --sha-rounds options.
2008-05-19 20:53:12 +00:00
nekral-guest
537496c019 Fix formatting. 2008-05-19 20:31:48 +00:00
nekral-guest
300f7416c4 Document the -r, --system option. 2008-05-19 19:43:24 +00:00
nekral-guest
3fed00196c Import Debian patch 487_passwd_chauthtok_failed_message
* libmisc/pam_pass.c: Be more verbose and indicate that the
	password was not changed when pam_chauthtok fails (in addition to
	the PAM error, which may not be comprehensible for the users).
2008-05-18 15:06:51 +00:00
nekral-guest
fb4271bdf9 Import Debian patch 434_login_stop_checking_args_after--
* NEWS, src/login.c (check_flags): Stop checking the arguments
	after --. The later options will be sent to the shell, and do not
	need to be checked.
2008-05-18 14:54:35 +00:00
nekral-guest
6a17c2b27f * src/vipw.c, src/su.c, src/newgrp.c: Harmonize the children's
SIGSTOP handling. Raise the signal which stopped the child instead
	of always SIGSTOP.

	Import Debian patch 406_vipw_resume_properly.
	Thanks to Dean Gaudet.
	* NEWS, src/vipw.c: Resume properly after ^Z.
2008-05-18 13:41:56 +00:00
nekral-guest
c7302b61ef Make sure every source files are distributed with a copyright and license.
Files with no license use the default 3-clauses BSD license. The copyright
were mostly not recorded; they were updated according to the Changelog.
"Julianne Frances Haugh and contributors" changed to "copyright holders
and contributors".
2008-04-27 00:40:09 +00:00
nekral-guest
8a8072a563 If the SULOG_FILE does not exist when an su session is logged, make sure
the file is created with group root, instead of using the group of the
caller.
2008-04-27 00:27:59 +00:00
nekral-guest
4196525702 Allow non-US-ASCII characters in the GECOS fields ("name", "room number",
and "other info" fields).
2008-04-27 00:24:49 +00:00
nekral-guest
4d7d6a1a9f Fix build failure when configured with audit support. Thanks to Mike
Frysinger for reporting it.
2008-04-16 22:04:46 +00:00
nekral-guest
7baffa5e74 Ensure that getpwent() is used in setpwent(), getpwent(),
endpwend() sequences (ditto for getgrent(), getspent(), and
getsgent()). The only real (minor) issue was in login, which kept
the passwd file open.
* libmisc/entry.c: Remove unneeded setspent() and endspent() (only
  getspnam is called in the middle).
* libmisc/find_new_ids.c: Make sure to close the password and
  group files with endpwent() and endgrent().
* libmisc/pwdcheck.c: Remove unneeded endspent() (only getspnam()
  is called before).
* src/lastlog.c, src/passwd.c, src/groupmod.c, src/faillog.c,
  src/groups.c: Make sure to close
  the password file with endpwent().
* src/login.c: Remove unneeded setpwent() (only xgetpwnam is
  called before).
* src/login.c, src/newgrp.c: Fix typos in comments.
2008-04-16 21:52:46 +00:00
nekral-guest
8e82ae234e Also fix the detection of the pam and selinux features:
Fail if the feature is requested but the library (or
header file) could not be found. If nothing is specified, enable
the feature only if we can find the library (or header file).
2008-04-16 21:18:20 +00:00
nekral-guest
17cb7c754e Document --with-selinux as "yes if found" rather than "autodetected" for consistency with other options. 2008-04-16 20:16:43 +00:00
nekral-guest
70bf7cca33 Fix the detection of the audit library and header file. 2008-04-16 20:09:03 +00:00
nekral-guest
f89cf0cf20 * NEWS, etc/pam.d/Makefile.am: Add chfn, chsh, and userdel to
$(pamd_files). Remove the duplicate useradd. And sort
  alphabetically. Thanks to Mark Rosenstand  <mark@borkware.net>.
* NEWS: Prepare next release, 4.1.2.
2008-04-04 18:50:22 +00:00
nekral-guest
1de80f9457 * NEWS, configure.in: Prepare release 4.1.1
* NEWS: Fix the release date of 4.1.0. Was in 2007, not 2008.
2008-04-02 21:55:27 +00:00
nekral-guest
b345316e49 Update according to the file under review. Thanks to Jean-Luc Coulon. 2008-04-02 21:54:23 +00:00
bubulle
5c9143c432 German translation update 2008-04-01 19:01:16 +00:00
bubulle
9dda0ada5f Basque translation update 2008-03-31 17:54:52 +00:00
nekral-guest
57144e2820 updated to 360t71f. Thanks to Leandro Azevedo <leorock182@gmail.com>. 2008-03-30 12:52:57 +00:00
bubulle
d7a926d69a Turkish translation update 2008-03-30 12:18:40 +00:00
nekral-guest
0a5fad05a8 updated to 431t. Thanks to Clytie Siddall 2008-03-30 12:06:33 +00:00
nekral-guest
ad135f478a Updated Swedish translation. Thanks to Daniel Nylander. 2008-03-30 11:54:19 +00:00
nekral-guest
f2b518a31f Updated to 431t. Thanks to helix84 <helix84@centrum.sk>. 2008-03-28 23:23:41 +00:00
bubulle
231bb00904 Italian translation update 2008-03-27 18:54:34 +00:00
nekral-guest
f7a256fc19 * src/passwd.c, NEWS: Make SE Linux tests more strict, when the
real UID is 0 SE Linux checks will be performed. Thanks to
 Russell Coker  <russell@coker.com.au>
* TODO: Added entries regarding SE Linux.
2008-03-26 22:00:50 +00:00
bubulle
9a6f0d3969 Russian translation update 2008-03-24 18:34:04 +00:00
bubulle
fed294e11e Updated Korean and Portuguese translations 2008-03-23 08:39:58 +00:00
nekral-guest
04af9cb9f8 Fix manpages generation. The SYS_GID_MAX and SYS_UID_MAX entities were not defined. 2008-03-17 23:07:04 +00:00
nekral-guest
32b424e507 Fix minor compilation warning (assignment used as a comparison). 2008-03-17 23:05:59 +00:00
nekral-guest
d94602add8 login_access() is used in src/login.c, and defined in src/login_nopam.c
(which lacks a prototype). Move its prototype from src/login.c to
lib/prototypes.h.
2008-03-17 23:04:46 +00:00
nekral-guest
e33e2b7d79 Compilation fix. gshadow_locked should only be used if SHADOWGRP is defined. 2008-03-17 23:02:23 +00:00
nekral-guest
78c59b7261 Fix some warnings. compare_members_lists() is only used if SHADOWGRP is defined. 2008-03-17 23:00:49 +00:00
nekral-guest
a8a614c515 * NEWS, src/groupmod.c: Make sure the passwd, group, and gshadow
files are unlocked on exit. Unlock locked files in fail_exit().
  Prefer fail_exit() over exit().
* NEWS, src/groupmod.c: When the GID of a group is changed, update
  also the GID of the passwd entries of the users whose primary
  group is the group being modified.
2008-03-08 23:01:49 +00:00
nekral-guest
b1a0769d3d * lib/commonio.c (commonio_remove): Fail when the name to be
removed is used by different entries (like commonio_update does).
* NEWS: This fix the behavior of groupdel when the system is not
  configured to support split group but different group entries
  have the name of the group to be deleted.
2008-03-08 22:52:44 +00:00
nekral-guest
1b808e62df Make sure the passwd, group, shadow, and gshadow files are unlocked on
exit. Unlock locked files in fail_exit(). Prefer fail_exit() over exit().
2008-03-08 22:44:53 +00:00
nekral-guest
5af8a5d74d * NEWS, src/groupdel.c: Make sure the group, and gshadow files are
unlocked on exit. Add function fail_exit(). Use fail_exit()
	instead of exit().
	* src/groupdel.c: Fail immediately instead of increasing errors.
	Better handling of error cases, like locked group or gshadow file.
2008-03-08 21:13:54 +00:00
nekral-guest
d1290c0d5d Make sure the passwd, group, shadow, and gshadow files are unlocked on
exit. Add function fail_exit(). Use fail_exit() instead of exit().
2008-03-08 21:04:31 +00:00
nekral-guest
bded00fd11 Make sure the group and gshadow files are unlocked on exit. Add function fail_exit(). 2008-03-08 20:54:54 +00:00
nekral-guest
a2242f6f1b Do not rewrite the group and gshadow file in case of error. 2008-03-08 16:23:22 +00:00
nekral-guest
9e07fec6ba Do not log that the group was deleted if an error occurred. 2008-03-08 16:20:55 +00:00
nekral-guest
d44f1dfeca Do not raise an error if the group does not exist in the gshadow file. 2008-03-08 16:17:07 +00:00