Bug 58114

Summary:	kdm divulges user accounts
Product:	[Retired] Red Hat Linux	Reporter:	Chris Ricker <chris.ricker>
Component:	kdebase	Assignee:	Petr Rockai <prockai>
Status:	CLOSED CANTFIX	QA Contact:	Ben Levenson <benl>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	7.2	CC:	than
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2006-10-18 17:29:03 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Chris Ricker 2002-01-08 23:04:09 UTC

When using kdm in standard configuration (ie, no user browser), typing a correct
account name into the login box is often enough to divulge the fact that the
account name is correct.

Normally, the Session_Type dialog box displays "Default" as the session type. 
If a user has a different session type set in his or her home directory, this
Session_Type box automatically changes to display the preferred Session_type,
even before a password is typed.

Under some circumstances, this can be used to determine whether an account
exists on the system or not.

To fix this, the Session_Type should not be checked by KDM until after the
username *and* password have been verified.

Comment 1 Chris Ricker 2002-03-23 08:21:44 UTC

This is true with the skipjack public beta as well.

In KDE3, before the password is even entered, the Session_Type changes to the
previous session for valid users.  This feedback reveals the existance of
accounts....

Comment 2 Petr Rockai 2005-08-10 16:14:07 UTC

Please retry with current version of Fedora Core. Unless you followup on this      
bug, it will be considered fixed and will be closed at some point... Thank you      
for your time.

Comment 3 Bill Nottingham 2006-10-18 17:29:03 UTC

Red Hat Linux is no longer supported by Red Hat, Inc. If you are still
running Red Hat Linux, you are strongly advised to upgrade to a
current Fedora Core release or Red Hat Enterprise Linux or comparable.
Some information on which option may be right for you is available at
http://www.redhat.com/rhel/migrate/redhatlinux/.

Closing as CANTFIX.