Subject: bin/33138: /etc/security doesn't like nontrivial compat entries
To: None <gnats-admin@netbsd.org, netbsd-bugs@netbsd.org>
From: None <dholland@eecs.harvard.edu>
List: netbsd-bugs
Date: 03/24/2006 03:45:00
>Number: 33138
>Category: bin
>Synopsis: /etc/security doesn't like nontrivial compat entries
>Confidential: no
>Severity: serious
>Priority: medium
>Responsible: bin-bug-people
>State: open
>Class: sw-bug
>Submitter-Id: net
>Arrival-Date: Fri Mar 24 03:45:00 +0000 2006
>Originator: David A. Holland
>Release: NetBSD 3.0_STABLE (20060310)
>Environment:
System: NetBSD rhett 3.0_STABLE NetBSD 3.0_STABLE (RHETT) #0: Fri Mar 10 23:37:46 EST 2006 dholland@rhett:/usr/src/sys/arch/i386/compile/RHETT i386
Architecture: i386
Machine: i386
>Description:
NIS compat entries that in /etc/master.passwd that include usernames
cause /etc/security to issue incorrect error messages.
>How-To-Repeat:
Turn on NIS, and add (e.g.)
+joe:::::::::
to master.passwd. Then run /etc/security. Output includes messages like
Login +joe has non-alphanumeric characters.
Login +joe has no password.
Login +joe does not have a valid shell ()
Login +joe has a negative user id.
Login +joe has a negative group id.
This can be silenced by adding "+joe" to $check_passwd_nowarn_users,
but that's obviously not the correct long-term solution.
>Fix:
Suggested patch for /etc/security, against 1.94.2.1 (same as 1.95),
will merge with current 1.96:
Index: security
===================================================================
RCS file: /cvsroot/src/etc/security,v
retrieving revision 1.94.2.1
diff -u -r1.94.2.1 security
--- security 13 Apr 2005 15:56:38 -0000 1.94.2.1
+++ security 24 Mar 2006 03:27:53 -0000
@@ -213,13 +213,23 @@
printf "Line %d is a blank line.\n", NR;
next;
}
- if (NF != 10 && ($1 != "+" || NF != 1))
+
+ # NIS compat entry?
+ compatline = $1 ~ "^[\\+-]";
+ if (compatline) {
+ if ($1 == "+" && NF == 1) {
+ next;
+ }
+ sub("^.", "", $1);
+ }
+ if (NF != 10)
printf "Line %d has the wrong number of fields.\n", NR;
- if ($1 == "+" ) {
- if (NF != 1 && $3 == 0)
+ if (compatline) {
+ if ($3 == 0)
printf "Line %d includes entries with uid 0.\n",
NR;
- next;
+ if ($1 == "")
+ next;
}
if (!permit_nonalpha &&
$1 !~ /^[_A-Za-z0-9]([-A-Za-z0-9_.]*[A-Za-z0-9])*$/)
@@ -228,7 +238,7 @@
if (length($1) > len)
printf "Login %s has more than "len" characters.\n",
$1;
- if ($2 == "" && !nowarn_users[$1])
+ if ($2 == "" && !compatline && !nowarn_users[$1])
printf "Login %s has no password.\n", $1;
if (!nowarn_shells[$10] && !nowarn_users[$1]) {
if (length($2) != 13 &&
@@ -242,15 +252,17 @@
if ($10 == "" || shells[$10])
printf "Login %s is off but still has "\
"a valid shell (%s)\n", $1, $10;
+ } else if (compatline && $10 == "") {
+ # nothing
} else if (! shells[$10])
printf "Login %s does not have a valid "\
"shell (%s)\n", $1, $10;
}
if ($3 == 0 && !uid0_users[$1] && !nowarn_users[$1])
printf "Login %s has a user id of 0.\n", $1;
- if ($3 < 0)
+ if ($3 != "" && $3 < 0)
printf "Login %s has a negative user id.\n", $1;
- if ($4 < 0)
+ if ($4 != "" && $4 < 0)
printf "Login %s has a negative group id.\n", $1;
}' < $MP > $OUTPUT
if [ -s $OUTPUT ] ; then