Verified on RHL 5.1 and 5.2
1. Install RHL
2. Set up shadowed passwd with 'pwconv'
From here on /etc/passwd should not contain any
passwd hashes (right?)
3. Add a test user ('adduser test1')
and set a passwd ('passwd test1')
hash is now in /etc/shadow as it is supposed to be
4. Disable the user by putting '*' in the passwd field of
/etc/shadow (replace the hash with '*' not prepand it)
5. Enable the account by changing passwd ('passwd test1')
6. Account is valid, but the hash has ended up in world
readable /etc/passwd (not private /etc/shadow)
If in step 4 you prepand '*' to the hash this will fail and
the passwd command will work as designed.
Is this the correct behaviour of passwd/shadow?
I believe this is normal behavour - by default, passwd puts the new
password in the same file, where you had the old one. In the case you
did not have any, it thinks you had it in /etc/passwd...
You can tell passwd to always put the new password into the shadow
file by changing
password required /lib/security/pam_pwdb.so use_authtok nullok
line in /etc/pam.d/passwd to
password required /lib/security/pam_pwdb.so shadow use_authtok
Hmm, ok I'll try that, but may be RHS should make that default after
'pwconv' has run?
firstname.lastname@example.org's suggestion does work. I think pwconv should make
it this way by default.
But also note that if the /etc/shadow has '*HASH' or '!!' in the
passwd field then the passwd gets put there and not /etc/passwd even
w/out this change.
/etc/pam.d/passwd should have the 'shadow' argument to pam_pwdb