From owner-freebsd-bugs@FreeBSD.ORG Sat Sep 4 15:20:23 2004 Return-Path: Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 953F616A4CE for ; Sat, 4 Sep 2004 15:20:23 +0000 (GMT) Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by mx1.FreeBSD.org (Postfix) with ESMTP id 8603443D2D for ; Sat, 4 Sep 2004 15:20:23 +0000 (GMT) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.12.11/8.12.11) with ESMTP id i84FKNiK020361 for ; Sat, 4 Sep 2004 15:20:23 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.12.11/8.12.11/Submit) id i84FKNrc020360; Sat, 4 Sep 2004 15:20:23 GMT (envelope-from gnats) Date: Sat, 4 Sep 2004 15:20:23 GMT Message-Id: <200409041520.i84FKNrc020360@freefall.freebsd.org> To: freebsd-bugs@FreeBSD.org From: "Simon L. Nielsen" Subject: Re: bin/71147: sshd(8) will allow to log into a locked account X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: "Simon L. Nielsen" List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 04 Sep 2004 15:20:23 -0000 The following reply was made to PR bin/71147; it has been noted by GNATS. From: "Simon L. Nielsen" To: Yar Tikhiy Cc: freebsd-gnats-submit@FreeBSD.org Subject: Re: bin/71147: sshd(8) will allow to log into a locked account Date: Sat, 4 Sep 2004 17:13:14 +0200 --vEao7xgI/oilGqZ+ Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On 2004.09.02 16:47:27 +0400, Yar Tikhiy wrote: > On Wed, Sep 01, 2004 at 05:06:21PM +0200, Simon L. Nielsen wrote: > > On 2004.09.01 03:10:22 +0000, Yar Tikhiy wrote: > > > The following reply was made to PR bin/71147; it has been noted by GN= ATS. > > >=20 > > > However, I feel that the full blown prefix `*LOCKED*' should be > > > left for pw(8) purposes while just a leading asterisk may be > > > considered by sshd(8) as a sure sign of an account being locked. > > > E.g., the macro PASSWD_LOCK_PREFIX("*") should be used IMHO. > >=20 > > If you prevent accounts with a "*" from logging in with a ssh key you > > will break POLA. I know that I have several systems where the > > password in master.passwd is set to "*" and I then log in via ssh > > keys. > >=20 > > Also a "*" in the password file does not prevent a user logging in > > when authenticating via Kerberos. >=20 > Will Kerberos authentication codepath check for ``*LOCKED*'' either? No, I actually think Kerberos telnetd will allow login just as long as there is a user account and a valid Lerberos account/ticket. --=20 Simon L. Nielsen FreeBSD Documentation Team --vEao7xgI/oilGqZ+ Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.5 (FreeBSD) iD8DBQFBOduKh9pcDSc1mlERAnhvAJ4jmrlBlc9vcB62zwZHTIEeDTlFgwCggyWT x6hpYoehlliHSI20PwA+6eU= =AAWw -----END PGP SIGNATURE----- --vEao7xgI/oilGqZ+--