Skip to Content.
Sympa Menu

sm-security - [SM-Security] shadow stable / -rc / test putting password hashes back into passwd/group

sm-security AT lists.ibiblio.org

Subject: Security bugs are reported here via bugzilla

List archive

Chronological Thread  
  • From: Thomas Orgis <thomas-forum AT orgis.org>
  • To: sm-security AT lists.ibiblio.org
  • Subject: [SM-Security] shadow stable / -rc / test putting password hashes back into passwd/group
  • Date: Tue, 6 Feb 2007 20:42:49 +0100

----- Bad bug, fix in test -----

The last shadow update brought a nasty side effect in case you say "n"
to the "fix/convert accounts" question:
PRE_REMOVE executed pwunconv/grpunconv unconditionally on dispel - and
a dispel happens on every upgrade before the new version is installed.

Thus, an upgrade to recent shadow could leave you with the password
hashes back in /etc/passwd!
Please refer to bug 8834
(http://bugs.sourcemage.org/show_bug.cgi?id=8834) for details and
history on that one.
There is a fix in git and about to be in the next test tarball.

Every admin should have a look at his /etc/passwd and /etc/group and
check if he may need a run of pwconv and grpconv!
The updated version of the spell has some logic to detect un-shadowed
passwd files and in that case defaults to running pwconv/grpconv unless
you say no.
The malicious unconv calls in PRE_REMOVE are removed now and the update
to the fixed shadow will _not_ unconv your files.
Even an explicit dispel shadow will not convert the files back now -
if you really want to do that, execute *unconv before dispelling if you
wish.


Thomas.




Archive powered by MHonArc 2.6.24.

Top of Page