From owner-freebsd-bugs Wed Jun 20 19:50: 8 2001 Delivered-To: freebsd-bugs@hub.freebsd.org Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by hub.freebsd.org (Postfix) with ESMTP id 392B337B407 for ; Wed, 20 Jun 2001 19:50:01 -0700 (PDT) (envelope-from gnats@FreeBSD.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.11.3/8.11.3) id f5L2o1109087; Wed, 20 Jun 2001 19:50:01 -0700 (PDT) (envelope-from gnats) Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by hub.freebsd.org (Postfix) with ESMTP id BD61837B406 for ; Wed, 20 Jun 2001 19:48:15 -0700 (PDT) (envelope-from nobody@FreeBSD.org) Received: (from nobody@localhost) by freefall.freebsd.org (8.11.3/8.11.3) id f5L2mFq08512; Wed, 20 Jun 2001 19:48:15 -0700 (PDT) (envelope-from nobody) Message-Id: <200106210248.f5L2mFq08512@freefall.freebsd.org> Date: Wed, 20 Jun 2001 19:48:15 -0700 (PDT) From: Mike Tancsa To: freebsd-gnats-submit@FreeBSD.org X-Send-Pr-Version: www-1.0 Subject: bin/28311: ftpd and sshd do not honor expired pw entries Sender: owner-freebsd-bugs@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org >Number: 28311 >Category: bin >Synopsis: ftpd and sshd do not honor expired pw entries >Confidential: no >Severity: serious >Priority: high >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Wed Jun 20 19:50:00 PDT 2001 >Closed-Date: >Last-Modified: >Originator: Mike Tancsa >Release: 4 >Organization: Sentex Communications >Environment: 4.3-STABLE FreeBSD 4.3-STABLE #0: Wed May 23 17:17:10 EDT 2001 >Description: sshd and ftpd do not look at the expire field for a user. This is a security risk if the site relies on the expire field to prevent access >How-To-Repeat: backup2# pw useradd deadguy backup2# mkdir /home/deadguy chown deadguy /home/deadguy backup2# passwd deadguy Changing local password for deadguy. New password: Please enter a password at least 6 characters in length. New password: Retype new password: passwd: updating the database... passwd: done backup2# ssh deadguy@localhost deadguy@localhost's password: Copyright (c) 1980, 1983, 1986, 1988, 1990, 1991, 1993, 1994 The Regents of the University of California. All rights reserved. FreeBSD 4.3-STABLE (backup) #0: Wed May 23 17:17:10 EDT 2001 $ id uid=20460(deadguy) gid=20460(deadguy) groups=20460(deadguy) $ exit backup2# chfn deadguy backup2# tail -1 /etc/master.passwd deadguy:$1$MDq4lIvx$W6jTaMLK3/vfBaZyFMQYb/:20460:20460::0:991368000:User &:/home/deadguy:/bin/sh backup2# backup2# tail -1 /etc/master.passwd deadguy:$1$MDq4lIvx$W6jTaMLK3/vfBaZyFMQYb/:20460:20460::0:991368000:User &:/home/deadguy:/bin/sh backup2# !ssh ssh deadguy@localhost deadguy@localhost's password: Last login: Wed Jun 20 22:44:19 2001 from localhost Copyright (c) 1980, 1983, 1986, 1988, 1990, 1991, 1993, 1994 The Regents of the University of California. All rights reserved. FreeBSD 4.3-STABLE (backup) #0: Wed May 23 17:17:10 EDT 2001 Welcome to backup2.sentex.ca $ id uid=20460(deadguy) gid=20460(deadguy) groups=20460(deadguy) $ exit Connection to localhost closed. backup2# ftp localhost ftp: connect to address ::1: Permission denied Trying 127.0.0.1... Connected to localhost. 220 backup2.sentex.ca FTP server (Version 6.00LS) ready. Name (localhost:mdtancsa): deadguy 331 Password required for deadguy. Password: 230 User deadguy logged in. Remote system type is UNIX. Using binary mode to transfer files. ftp> bye 221 Goodbye. backup2# >Fix: >Release-Note: >Audit-Trail: >Unformatted: To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-bugs" in the body of the message