Bug 128
| Summary: | Hashed passwd ends up in /etc/passwd even with shadow enabled | ||
|---|---|---|---|
| Product: | [Retired] Red Hat Linux | Reporter: | seva |
| Component: | distribution | Assignee: | Cristian Gafton <gafton> |
| Status: | CLOSED WORKSFORME | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | low | ||
| Version: | 5.2 | CC: | seva |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | i386 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 1998-11-20 12:14:25 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
I believe this is normal behavour - by default, passwd puts the new password in the same file, where you had the old one. In the case you did not have any, it thinks you had it in /etc/passwd... You can tell passwd to always put the new password into the shadow file by changing password required /lib/security/pam_pwdb.so use_authtok nullok line in /etc/pam.d/passwd to password required /lib/security/pam_pwdb.so shadow use_authtok nullok Hmm, ok I'll try that, but may be RHS should make that default after 'pwconv' has run? /Seva ayn2's suggestion does work. I think pwconv should make it this way by default. But also note that if the /etc/shadow has '*HASH' or '!!' in the passwd field then the passwd gets put there and not /etc/passwd even w/out this change. /Seva /etc/pam.d/passwd should have the 'shadow' argument to pam_pwdb |
Verified on RHL 5.1 and 5.2 1. Install RHL 2. Set up shadowed passwd with 'pwconv' From here on /etc/passwd should not contain any passwd hashes (right?) 3. Add a test user ('adduser test1') and set a passwd ('passwd test1') hash is now in /etc/shadow as it is supposed to be 4. Disable the user by putting '*' in the passwd field of /etc/shadow (replace the hash with '*' not prepand it) 5. Enable the account by changing passwd ('passwd test1') 6. Account is valid, but the hash has ended up in world readable /etc/passwd (not private /etc/shadow) If in step 4 you prepand '*' to the hash this will fail and the passwd command will work as designed. Is this the correct behaviour of passwd/shadow? /Seva