From owner-cvs-src@FreeBSD.ORG Mon Sep 19 17:40:41 2005 Return-Path: X-Original-To: cvs-src@freebsd.org Delivered-To: cvs-src@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id C41DD16A41F; Mon, 19 Sep 2005 17:40:41 +0000 (GMT) (envelope-from keramida@ceid.upatras.gr) Received: from aiolos.otenet.gr (aiolos.otenet.gr [195.170.0.93]) by mx1.FreeBSD.org (Postfix) with ESMTP id 0171043D48; Mon, 19 Sep 2005 17:40:40 +0000 (GMT) (envelope-from keramida@ceid.upatras.gr) Received: from flame.pc (aris.bedc.ondsl.gr [62.103.39.226]) by aiolos.otenet.gr (8.13.4/8.13.4/Debian-1) with SMTP id j8JHeZMK014667; Mon, 19 Sep 2005 20:40:36 +0300 Received: from flame.pc (flame [127.0.0.1]) by flame.pc (8.13.4/8.13.4) with ESMTP id j8JHeKaF038359; Mon, 19 Sep 2005 20:40:20 +0300 (EEST) (envelope-from keramida@ceid.upatras.gr) Received: (from keramida@localhost) by flame.pc (8.13.4/8.13.4/Submit) id j8JHeIuk038358; Mon, 19 Sep 2005 20:40:18 +0300 (EEST) (envelope-from keramida@ceid.upatras.gr) Date: Mon, 19 Sep 2005 20:40:17 +0300 From: Giorgos Keramidas To: Ceri Davies , Gavin Atkinson , src-committers@freebsd.org, cvs-src@freebsd.org, cvs-all@freebsd.org Message-ID: <20050919174017.GA38329@flame.pc> References: <200509181540.j8IFe2LR042274@repoman.freebsd.org> <20050918200104.F89636@ury.york.ac.uk> <20050918203109.GA1419@flame.pc> <20050918222401.GQ441@submonkey.net> <20050919122020.GA1759@flame.pc> <20050919165219.GB4124@submonkey.net> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20050919165219.GB4124@submonkey.net> Cc: Subject: Re: cvs commit: src/share/man/man5 passwd.5 X-BeenThere: cvs-src@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: CVS commit messages for the src tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 19 Sep 2005 17:40:41 -0000 On 2005-09-19 17:52, Ceri Davies wrote: > > What I'm getting at is that some operating systems allow a special *FOO > string in their (equivalent of) master.passwd file in order to indicate > that sshd should not allow users with that string in their entry to log > in. > > For example, Solaris uses the string *NP* to indicate that a user has no > password - password authentication is therefore disabled for that user, > disallowing su, password-based ssh access, etc. Cron jobs, key-based > auth, etc. continue to work. It also supports *LK* which indicates that > an account is locked: in this case, cron jobs for the user will not be > run and ssh access is denied altogether. > > The ssh bit works because OpenSSH knows that it should be looking for > the string *LK* and denying access if it is there. Search for > LOCKED_PASSWD_STRING in src/crypto/openssh/auth.c. > > What I'm wondering is why OpenSSH doesn't know about *LOCKED*; previous > discussions that I've had indicate that this is because we (the FreeBSD > project) haven't decided that *LOCKED* is canonical enough yet. Right. This is exactly why I didn't even attempt to document anything to that effect. I'm not sure what to write about, so I don't write something that is wrong :)