Verified on RHL 5.1 and 5.2 1. Install RHL 2. Set up shadowed passwd with 'pwconv' From here on /etc/passwd should not contain any passwd hashes (right?) 3. Add a test user ('adduser test1') and set a passwd ('passwd test1') hash is now in /etc/shadow as it is supposed to be 4. Disable the user by putting '*' in the passwd field of /etc/shadow (replace the hash with '*' not prepand it) 5. Enable the account by changing passwd ('passwd test1') 6. Account is valid, but the hash has ended up in world readable /etc/passwd (not private /etc/shadow) If in step 4 you prepand '*' to the hash this will fail and the passwd command will work as designed. Is this the correct behaviour of passwd/shadow? /Seva
I believe this is normal behavour - by default, passwd puts the new password in the same file, where you had the old one. In the case you did not have any, it thinks you had it in /etc/passwd... You can tell passwd to always put the new password into the shadow file by changing password required /lib/security/pam_pwdb.so use_authtok nullok line in /etc/pam.d/passwd to password required /lib/security/pam_pwdb.so shadow use_authtok nullok
Hmm, ok I'll try that, but may be RHS should make that default after 'pwconv' has run? /Seva
ayn2's suggestion does work. I think pwconv should make it this way by default. But also note that if the /etc/shadow has '*HASH' or '!!' in the passwd field then the passwd gets put there and not /etc/passwd even w/out this change. /Seva
/etc/pam.d/passwd should have the 'shadow' argument to pam_pwdb