Bug 69279 - forced password change (last change = 0) trumps expired account
Summary: forced password change (last change = 0) trumps expired account
Keywords:
Status: CLOSED UPSTREAM
Alias: None
Product: Red Hat Linux
Classification: Retired
Component: pam
Version: 7.1
Hardware: i686
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Tomas Mraz
QA Contact: Aaron Brown
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2002-07-19 20:24 UTC by John Dalbec
Modified: 2007-04-18 16:44 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2004-11-17 12:50:46 UTC
Embargoed:


Attachments (Terms of Use)
proposed patch to fix this bug (651 bytes, patch)
2002-07-22 15:07 UTC, John Dalbec
no flags Details | Diff

Description John Dalbec 2002-07-19 20:24:00 UTC
From Bugzilla Helper:
User-Agent: Mozilla/4.79 [en] (Windows NT 5.0; U)

Description of problem:
If an account has the last password change set to the epoch to force a password change, *and* the accounf's expiration date has passed, 
changing the password allows the user to log in.

Version-Release number of selected component (if applicable):


How reproducible:
Always

Steps to Reproduce:
1. chage <user> -d 0 -E <yesterday's date>
2. login as <user>
3. change password as instructed
	

Actual Results:  Shell prompt (as user).

Expected Results:  Your account has expired.  Please contact your system administrator.
Password incorrect.

Additional info:

I think an expired account should take precedence over a forced password change.  There's no point in allowing someone to change their 
password if they're not supposed to be able to log in.

Comment 1 John Dalbec 2002-07-22 15:07:55 UTC
Created attachment 66264 [details]
proposed patch to fix this bug

Comment 2 Tomas Mraz 2004-11-17 12:50:46 UTC
Thanks, applied to upstream PAM CVS.



Note You need to log in before you can comment on or make changes to this bug.