Red Hat Bugzilla – Bug 1292815
usermod -p allowing colon (ie. ':' ) in encrypted password which then breaks /etc/shadow
Last modified: 2016-11-03 23:41:12 EDT
Description of problem: usermod -p allowing colon (ie. ':' ) in encrypted password which then breaks /etc/shadow Version-Release number of selected component (if applicable): shadow-utils-4.1.4.2-19.el6_6.1.x86_64 How reproducible: VERY Steps to Reproduce: 1. Create test user # useradd test # passwd test # grep ^test: /etc/shadow test:$6$ziMs4I5K$yh6QO6q4siNK8j.CMxCBO.hjF75XlQZzl7I2dXIJqnANNvhMwFtdDY2obXOjGnniPcVTpSazk5REcTKGHVEUb1:16566:0:99999:7::: 2. Modify user password with usermod and include colon # usermod -p 'sstest:123' test 3. Now see that the ':' was accepted even though it is really a delimiter for the file # grep ^test: /etc/shadow test:sstest:123:16566:0:99999:7::: Actual results: # grep ^test: /etc/shadow test:sstest:123:16566:0:99999:7::: Expected results: A failure like you get on RHEL 7 # usermod -p 'sstest:123' test usermod: failure while writing changes to /etc/shadow Additional info: If you run the usermod again you start adding duplicate lines: # usermod -p 'sstest:123' test # grep ^test: /etc/shadow test:sstest:123:16566:0:99999:7::: test:sstest:123:16566:0:99999:7:::
I opened the RHEL 6 verstion of the BZ, and included in the Expected results above is that RHEL 7 already warns of this issue. So not sure this BZ is needed for RHEL 7... # cat /etc/redhat-release Red Hat Enterprise Linux Server release 7.2 (Maipo) # grep ^test: /etc/shadow test:$6$iimWa/Hp$h2Vx0aM1WD/Z.khihwBnpRocSLTc8PgVNIwFjRejYpp74JxToLo6IrgaT.1CZDrbw9cYXfLt494aDQsweU6/60:16787:0:99999:7::: # usermod -p 'sstest:123' test usermod: failure while writing changes to /etc/shadow # grep ^test: /etc/shadow test:$6$iimWa/Hp$h2Vx0aM1WD/Z.khihwBnpRocSLTc8PgVNIwFjRejYpp74JxToLo6IrgaT.1CZDrbw9cYXfLt494aDQsweU6/60:16787:0:99999:7::: Now with colon removed on RHEL 7 (so seems the colon is cause of failure): # usermod -p 'sstest123' test # grep ^test: /etc/shadow test:sstest123:16787:0:99999:7:::
Hmm, you're right that there is additional check when writing the shadow entry. However the error message is not completely clear so it is better to include the explicit check for ':' which will be in RHEL-6.8.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2016-2322.html