[OpenWrt-Devel] [PATCH] session: deny access if password login is disabled
fabian at blaese.de
Tue Mar 17 11:44:55 EDT 2020
The special characters '!' and '*' in /etc/shadow are
used to disable password login for a specific account.
The character 'x' has no special meaning, but should not
be interpreted as an empty password.
However, rpcd did treat these special characters like no
password was set, which allows access even though the account
By removing the additional checks for these characters, the
encrypted password string is passed to crypt, which returns NULL
if the salt has an invalid format and therefore access is denied.
Signed-off-by: Fabian Bläse <fabian at blaese.de>
session.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/session.c b/session.c
index 13a2ef3..908e298 100644
@@ -795,7 +795,7 @@ rpc_login_test_password(const char *hash, const char *password)
/* password is not set */
- if (!hash || !*hash || !strcmp(hash, "!") || !strcmp(hash, "x"))
+ if (!hash || !*hash)
openwrt-devel mailing list
openwrt-devel at lists.openwrt.org
More information about the openwrt-devel