Return to BSD News archive
Path: euryale.cc.adfa.oz.au!newshost.carno.net.au!harbinger.cc.monash.edu.au!news.cs.su.oz.au!metro!metro!munnari.OZ.AU!news.ecn.uoknor.edu!feed1.news.erols.com!howland.erols.net!newsfeed.internetmci.com!news-was.dfn.de!news-fra1.dfn.de!news-ber1.dfn.de!news-lei1.dfn.de!news.urz.tu-dresden.de!irz401!orion.sax.de!uriah.heep!news
From: j@uriah.heep.sax.de (J Wunsch)
Newsgroups: comp.unix.bsd.freebsd.misc
Subject: Re: 2.2.1 and empty-passwords
Date: 31 Mar 1997 18:26:02 GMT
Organization: Private BSD site, Dresden
Lines: 41
Message-ID: <5hovjq$b82@uriah.heep.sax.de>
References: <zPQtlMD4F99acz9@rb.xs.use.ch>
Reply-To: joerg_wunsch@uriah.heep.sax.de (Joerg Wunsch)
NNTP-Posting-Host: localhost.heep.sax.de
Mime-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 8bit
X-Newsreader: knews 0.9.6
X-Phone: +49-351-2012 669
X-PGP-Fingerprint: DC 47 E6 E4 FF A6 E9 8F 93 21 E0 7D F9 12 D6 4E
Xref: euryale.cc.adfa.oz.au comp.unix.bsd.freebsd.misc:38460
borki@rb.xs.use.ch (Reto Burkhalter) wrote:
> I used to have some users with an empty password. But it seems
> that this doesn't work any longer. I think it changed between
> 2.2.0 and 2.2.1...
>
> Any idea? Is this a bug or a security improvement????
A security improvement, of course! What did you think? We don't have
bugs!
:-))
Two people doing wrong... one with a logico, and another one who
dragged this logico untested onto the 2.2 branch at 23:59. :-(
Index: /usr/src/usr.bin/login/login.c
===================================================================
RCS file: /home/cvs/src/usr.bin/login/login.c,v
retrieving revision 1.12.2.2
retrieving revision 1.12.2.3
diff -u -u -r1.12.2.2 -r1.12.2.3
--- login.c 1997/03/25 05:26:29 1.12.2.2
+++ login.c 1997/03/27 10:06:43 1.12.2.3
@@ -268,7 +268,7 @@
/* already authenticated */
break;
} else if (pwd->pw_passwd[0] == '\0') {
- if (rootlogin && !rootok) {
+ if (!rootlogin || rootok) {
/* pretend password okay */
rval = 0;
goto ttycheck;
--
cheers, J"org
joerg_wunsch@uriah.heep.sax.de -- http://www.sax.de/~joerg/ -- NIC: JW11-RIPE
Never trust an operating system you don't have sources for. ;-)