Date: Wed, 20 Jun 2001 19:48:15 -0700 (PDT) From: Mike Tancsa <mike@sentex.net> To: freebsd-gnats-submit@FreeBSD.org Subject: bin/28311: ftpd and sshd do not honor expired pw entries Message-ID: <200106210248.f5L2mFq08512@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 28311
>Category: bin
>Synopsis: ftpd and sshd do not honor expired pw entries
>Confidential: no
>Severity: serious
>Priority: high
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Wed Jun 20 19:50:00 PDT 2001
>Closed-Date:
>Last-Modified:
>Originator: Mike Tancsa
>Release: 4
>Organization:
Sentex Communications
>Environment:
4.3-STABLE FreeBSD 4.3-STABLE #0: Wed May 23 17:17:10 EDT 2001
>Description:
sshd and ftpd do not look at the expire field for a user. This is a security risk if the site relies on the expire field to prevent access
>How-To-Repeat:
backup2# pw useradd deadguy
backup2# mkdir /home/deadguy
chown deadguy /home/deadguy
backup2# passwd deadguy
Changing local password for deadguy.
New password:
Please enter a password at least 6 characters in length.
New password:
Retype new password:
passwd: updating the database...
passwd: done
backup2# ssh deadguy@localhost
deadguy@localhost's password:
Copyright (c) 1980, 1983, 1986, 1988, 1990, 1991, 1993, 1994
The Regents of the University of California. All rights reserved.
FreeBSD 4.3-STABLE (backup) #0: Wed May 23 17:17:10 EDT 2001
$ id
uid=20460(deadguy) gid=20460(deadguy) groups=20460(deadguy)
$ exit
backup2# chfn deadguy
backup2# tail -1 /etc/master.passwd
deadguy:$1$MDq4lIvx$W6jTaMLK3/vfBaZyFMQYb/:20460:20460::0:991368000:User &:/home/deadguy:/bin/sh
backup2#
backup2# tail -1 /etc/master.passwd
deadguy:$1$MDq4lIvx$W6jTaMLK3/vfBaZyFMQYb/:20460:20460::0:991368000:User &:/home/deadguy:/bin/sh
backup2# !ssh
ssh deadguy@localhost
deadguy@localhost's password:
Last login: Wed Jun 20 22:44:19 2001 from localhost
Copyright (c) 1980, 1983, 1986, 1988, 1990, 1991, 1993, 1994
The Regents of the University of California. All rights reserved.
FreeBSD 4.3-STABLE (backup) #0: Wed May 23 17:17:10 EDT 2001
Welcome to backup2.sentex.ca
$ id
uid=20460(deadguy) gid=20460(deadguy) groups=20460(deadguy)
$ exit
Connection to localhost closed.
backup2# ftp localhost
ftp: connect to address ::1: Permission denied
Trying 127.0.0.1...
Connected to localhost.
220 backup2.sentex.ca FTP server (Version 6.00LS) ready.
Name (localhost:mdtancsa): deadguy
331 Password required for deadguy.
Password:
230 User deadguy logged in.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> bye
221 Goodbye.
backup2#
>Fix:
>Release-Note:
>Audit-Trail:
>Unformatted:
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-bugs" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200106210248.f5L2mFq08512>