(This happens in FC6 and RHEL5 as well) # useradd _foo # passwd _foo Changing password for user _foo. passwd: Authentication token manipulation error From pam_unix_passwd.c: /* * First get the name of a user */ retval = pam_get_user(pamh, &user, "Username: "); if (retval == PAM_SUCCESS) { /* * Various libraries at various times have had bugs related to * '+' or '-' as the first character of a user name. Don't take * any chances here. Require that the username starts with an * alphanumeric character. */ if (user == NULL || !isalnum(*user)) { _log_err(LOG_ERR, pamh, "bad username [%s]", user); return PAM_USER_UNKNOWN; } useradd should be modified to allow the same usernames as pam_unix (or vice-versa).
Another option is to fix it on PAM side.
Useradd allows [a-zA-Z0-9_.] as first character. We should allow the same in PAM.
This request was evaluated by Red Hat Product Management for inclusion in a Red Hat Enterprise Linux maintenance release. Product Management has requested further review of this request by Red Hat Engineering, for potential inclusion in a Red Hat Enterprise Linux Update release for currently deployed products. This request is not yet committed for inclusion in an Update release.
also luseradd supports "_ " as the first character of a user name. # luseradd _foo # echo $? 0
QE ack for 4.5.
To be conformant with IEEE 1003.1-2004, and probable 2001 too, a username should consist of characters from the "Portable Filename Character Set". The set consists of all alphanumeric characters and ._-. (Dot, underscore and hyphen). To be conformant, it should not begin with a hyphen. For those of you who can't wait for a fix of this you can fix it yourselves: In pam_unix_passwd.c and pam_unix_auth.c you can replace the lines: if (user == NULL || !isalnum(*user)) { with: if (user == NULL || (!isalnum(*user) && (*user !='_' && *user !='.'))) { and then rebuild your PAM package.
An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on the solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHBA-2007-0300.html