3dbf1efbc3Updated to 757t. Thanks to Yuri Kozlov <kozlov.y@gmail.com>.
nekral-guest
2007-11-22 00:15:25 +00:00
08dadcb2b7Updated to 399t. Thanks to Yuri Kozlov <kozlov.y@gmail.com>.
nekral-guest
2007-11-22 00:06:50 +00:00
f171d63b5bAdd support for conditionally including paragraphs. (e.g. to support the documentation of PAM and !PAM features).
nekral-guest
2007-11-22 00:01:58 +00:00
a34110320f* man/newusers.8.xml: Added /etc/gshadow, /etc/group, /etc/shadow, and /etc/passwd to section FILES. * man/newusers.8.xml: Mentions that PAM is not used to set the passwords. * man/chpasswd.8.xml: Added section FILES (/etc/passwd, /etc/shadow, /etc/login.defs). * man/chpasswd.8.xml: Use the same paragraph as in newusers.8.xml to indicate that PAM is not used. * man/chgpasswd.8.xml: Added section FILES (/etc/group, /etc/gshadow, /etc/login.defs).
nekral-guest
2007-11-21 22:12:14 +00:00
46ae2113b6* Try harder to get the GID equal to the UID. This was not the case when the GID is not specified, and a GID exist with an ID higher than the all the UIDs. * Typo in comment: contrained -> constrained.
nekral-guest
2007-11-21 21:27:44 +00:00
6f7ed628e2Compile fix (related to last commit on src/chgpasswd.c).
nekral-guest
2007-11-21 20:28:13 +00:00
fd0b22cb55If the shadow group file is not present, do not try to locate the group entry from /etc/gshadow, and set the password in /etc/group.
nekral-guest
2007-11-20 20:59:42 +00:00
9aa40bb96d* libmisc/obscure.c, libmisc/salt.c, src/passwd.c: Match DES, MD5, SHA256, and SHA512 exactly (not only the first 3/6 chars). * libmisc/salt.c (SHA_salt_rounds): Set rounds to the specified prefered_rounds value, if specified. * src/gpasswd.c, libmisc/salt.c: Fix compilation warnings (use size_t for lengths). * src/chpasswd.c, src/chgpasswd.c: Add missing parenthesis.
nekral-guest
2007-11-20 20:00:16 +00:00
1d4b67c773Ignore the generated manpages. Add *.[1358] to the svn:ignore property.
nekral-guest
2007-11-20 19:15:34 +00:00
a30c0a8192The -c, -e, and -m options are exclusives.
nekral-guest
2007-11-20 13:09:55 +00:00
6e3ad7a275* man/chpasswd.8.xml, man/chgpasswd.8.xml: Document how the encryption algorithm is chosen for the passwords. Document the new -c and -s options. Add a reference to login.defs(5). * man/login.defs.5.xml: Document the ENCRYPT_METHOD, MD5_CRYPT_ENAB, SHA_CRYPT_MIN_ROUNDS, and SHA_CRYPT_MAX_ROUNDS variables. * etc/login.defs: Indicate that MD5_CRYPT_ENAB is deprecated. Document the relationship with PAM for MD5_CRYPT_ENAB and ENCRYPT_METHOD.
nekral-guest
2007-11-20 12:59:20 +00:00
5cb462d767Increase the size of crypt_passwd from 128 to 256 to avoid overflow in case of SHA512 (161 should be sufficient).
nekral-guest
2007-11-20 12:18:36 +00:00
90de228897passwd also use crypt_make_salt().
nekral-guest
2007-11-20 09:51:36 +00:00
0b695f5a76* lib/prototypes.h, libmisc/salt.c: Add parameters to crypt_make_salt to force the crypt method and number of rounds. * libmisc/salt.c: Add parameter to SHA_salt_rounds to force the number of rounds. * libmisc/salt.c, lib/getdef.c: ENCRYPT_METHOD and MD5_CRYPT_ENAB are needed also when USE_PAM (e.g. for chpasswd). * src/newusers.c, src/gpasswd.c: Use the new crypt_make_salt prototype. * src/chpasswd.c, src/chgpasswd.c: Add option -c, --crypt-method and -s, --sha-rounds to specify the crypt method and number of rounds in case of one of the SHA methods. The new prototype of crypt_make_salt simplifies the handling of -m, --md5.
nekral-guest
2007-11-20 09:33:52 +00:00
eb23bbfd98Hopefully, I review my commits in the morning...
nekral-guest
2007-11-20 09:20:34 +00:00
e406b7fe4a* libmisc/salt.c: The salt has a random size (between 8 and 16 bytes). * lib/getdef.c, etc/login.defs: Add definitions for SHA_CRYPT_MIN_ROUNDS and SHA_CRYPT_MAX_ROUNDS. * libmisc/salt.c: Use SHA_CRYPT_MIN_ROUNDS and SHA_CRYPT_MAX_ROUNDS to add a random number of rounds if needed.
nekral-guest
2007-11-20 00:05:54 +00:00
c214b26ee6* libmisc/salt.c (MAGNUM): Terminate the array with nul (the array is then used with strcat). * libmisc/salt.c (crypt_make_salt): Initialize result[0] to nul at the beginning (was not initialized when USE_PAM). * libmisc/salt.c (crypt_make_salt): Check that ENCRYPT_METHOD is a valid crypt method.
nekral-guest
2007-11-19 22:34:48 +00:00
b8d8d0de00Add support for SHA256 and SHA512 encrypt methods. Apply RedHat's patch shadow-4.0.18.1-sha256.patch. Thanks to Peter Vrabec. Hardly no changes except re-indent and changes related to recent modifications (max_salt_len in crypt_make_salt). Changes in lib/defines.h not applied (definition of ENCRYPTMETHOD_SELECT). I will add a configure check or flag.
nekral-guest
2007-11-19 22:14:19 +00:00
cfc3378a0bAll the manpages in de, fr, it, pl are auto-generated.
nekral-guest
2007-11-19 20:33:39 +00:00
39e5c0a1abFix some compilation warnings: * src/login.c: "dereferencing type-punned pointer will break strict-aliasing rules", add a variable indirection: ptr_pam_user. * lib/commonio.c: do not initialize the sb stat structure. * lib/pwio.c, lib/shadowio.c, lib/sgroupio.c, lib/groupio.c: initialize the security context if WITH_SELINUX. * lib/nscd.c: The service argument is not const (used in the exec* parameters). This matches with the prototype definition. * src/groupmems.c: Avoid ++i when i is also used in the same line. * src/newusers.c: i is positive every time it is compared. Add cast to unsigned int. * src/nologin.c: Use a main() prototype with no arguments. * libmisc/getdate.y: Initialize the type and value fields of the terminating entry for each TABLE. * libmisc/tz.c: Use "TZ=CST6CDT" as the default timezone.
nekral-guest
2007-11-19 20:25:36 +00:00
d16cc1ea89Add a NEWS entry to indicate the review of the usage of getpwnam(), getpwuid(), getgrnam(), getgrgid(), and getspnam().
nekral-guest
2007-11-19 01:19:45 +00:00
6a0a7171d2* man/pl/Makefile.am: Add getspnam.3 to EXTRA_DIST since it is generated with shadow.3. * man/generate_translations.mak: Clean all the manpages, based on $(EXTRA_DIST), not $(man_MANS).
nekral-guest
2007-11-19 01:16:42 +00:00
03118ffb9bRemove file. The vigr man page is generated from the vipw XML file.
nekral-guest
2007-11-18 23:21:49 +00:00
dcedc12f36Add forgotten files in the previous ChangeLog entry.
nekral-guest
2007-11-18 23:20:02 +00:00
9adfc136b6* lib/prototypes.h, configure.in, libmisc/Makefile.am, libmisc/xgetXXbyYY.c, libmisc/xgetpwnam.c, libmisc/xgetpwuid.c, libmisc/xgetgrnam.c, libmisc/xgetgrgid.c, libmisc/xgetspnam.c: Added functions xgetpwnam(), xgetpwuid(), xgetgrnam(), xgetgrgid(), and xgetspnam(). They allocate memory for the returned structure and are more robust to successive calls. They are implemented with the libc's getxxyyy_r() functions if available. * libmisc/limits.c, libmisc/entry.c, libmisc/chowntty.c, libmisc/addgrps.c, libmisc/myname.c, libmisc/rlogin.c, libmisc/pwdcheck.c, src/newgrp.c, src/login_nopam.c, src/userdel.c, src/lastlog.c, src/grpck.c, src/gpasswd.c, src/newusers.c, src/chpasswd.c, src/chfn.c, src/groupmems.c, src/usermod.c, src/expiry.c, src/groupdel.c, src/chgpasswd.c, src/su.c, src/useradd.c, src/groupmod.c, src/passwd.c, src/pwck.c, src/groupadd.c, src/chage.c, src/login.c, src/suauth.c, src/faillog.c, src/groups.c, src/chsh.c, src/id.c: Review all the usage of one of the getpwnam(), getpwuid(), getgrnam(), getgrgid(), and getspnam() functions. It was noticed on http://bugs.debian.org/341230 that chfn and chsh use a passwd structure after calling a pam function, which result in using information from the passwd structure requested by pam, not the original one. It is much easier to use the new xget... functions to avoid these issues. I've checked which call to the original get... functions could be left (reducing the scope of the structure if possible), and I've left comments to ease future reviews (e.g. /* local, no need for xgetpwnam */). Note: the getpwent/getgrent calls should probably be checked also. * src/groupdel.c, src/expiry.c: Fix typos in comments. * src/groupmod.c: Re-indent. * libmisc/Makefile.am, lib/groupmem.c, lib/groupio.c, lib/pwmem.c, lib/pwio.c, lib/shadowmem.c, lib/shadowio.c: Move the __<xx>_dup functions (used by the xget... functions) from the <xx>io.c files to the new <xx>mem.c files. This avoid linking some utils against the SELinux library.
nekral-guest
2007-11-18 23:15:26 +00:00
ea63711c2cSome fixes for the manpages: * man/pl/pl.po: Fix typo: chgpassw -> chgpasswd. * man/pl/Makefile.am: Fix typo: chgpassw -> chgpasswd. * man/de/de.po: groups shall not be translated (for command, refname, or refentrytitle).
nekral-guest
2007-11-18 22:58:31 +00:00
cd1089e6f0Fix a typo in a comment.
nekral-guest
2007-11-18 01:20:10 +00:00
311f4baa27Do not document the behavior compared to old versions.
nekral-guest
2007-11-17 23:11:02 +00:00
7b50ff67f9Do not mention the patch names in the NEWS entries. They are mentioned in the ChangeLog.
nekral-guest
2007-11-17 22:21:50 +00:00
a8aa7028f4Add NEWS entries for the previous changes.
nekral-guest
2007-11-17 22:17:42 +00:00
722941eae1Document the differences between locking an account and locking a password.
nekral-guest
2007-11-17 22:07:47 +00:00
0743a7236dSame fixes as applied to usermod: refuse to unlock an account when it would result in a passwordless account.
nekral-guest
2007-11-17 22:05:31 +00:00
85463e754dRefuse to unlock an account when it would result in a passwordless account. Based on Openwall's patch shadow-4.0.4.1-owl-usermod-unlock.diff
nekral-guest
2007-11-17 22:02:22 +00:00
5e438aa46cMake sure that the prefix is the name of a directory (not only the beginning of a directory). Openwall patch shadow-4.0.4.1-owl-userdel-path_prefix.diff.
nekral-guest
2007-11-17 21:24:06 +00:00
1f4488f963* src/newgrp.c: Do not give an indication that the group has no password. * src/newgrp.c: Do not only bail on syslog if the password is not valid. Also give an indication to the user on stderr.
nekral-guest
2007-11-17 21:03:33 +00:00
225b096838Remove a comment which states that an user shall provide a password to switch to her group.
nekral-guest
2007-11-17 20:41:49 +00:00
8e568ef697Last parts of the Openwall patch shadow-4.0.4.1-owl-chage-drop-priv.diff: * src/chage.c: Make chage -l also drop the saved GID. * src/chage.c: Prefer setregid/setreuid to setgid/setuid.
nekral-guest
2007-11-17 20:28:32 +00:00
24cfb1c158* src/chage.c: Remove cleanup(). pw_lock is never called. Replace cleanup(2) by spw_unlock and remove the calls to cleanup(1). * src/chage.c: Remove variable pwrw. It is always set to 0. The password database is always read only.
nekral-guest
2007-11-17 20:09:54 +00:00
cbb2911b7f* man/generate_translations.mak: Generic rules for all the generated translated manpages (if ENABLE_REGENERATE_MAN). * man/Makefile.am: Removed rules for all the generated translated manpages. * man/sv/Makefile.am, man/de/Makefile.am, man/fr/Makefile.am, man/pl/Makefile.am, man/ru/Makefile.am, man/it/Makefile.am: Include generate_translations.mak to handle the generated translations (XML and roff files). * man/Makefile.am: Translated XML files moved from the CLEANFILES variable of man/Makefile.am to the various languages Makefiles.
nekral-guest
2007-11-17 18:45:22 +00:00
a9f2f60c68Fixes from Openwall patch shadow-4.0.4.1-alt-man.diff: * man/useradd.8.xml: Indicate that the NIS caveats is also valid for any external database as LDAP. * man/groupadd.8.xml: Likewise. * man/groupadd.8.xml: Reorder and reformat the caveats bullets.
nekral-guest
2007-11-17 18:13:17 +00:00
1bcf56c8b2Start applying Debian patch 409_man_generate_from_PO: * NEWS: Applied Debian patch 409_man_generate_from_PO to automatically generate the translated manpages from the POs. * man/Makefile.am: Replace the individual rules for the generation of the manpages (from XML) by a generic Makefile rule an dependencies for the linked manpages.
nekral-guest
2007-11-17 17:47:02 +00:00
77bfba3017Document that chpasswd does not use PAM to update the passwords. This fixes http://bugs.debian.org/396726. Debian patch 411_chpasswd_document_no_pam.
nekral-guest
2007-11-17 17:31:54 +00:00
7eed43550cProvide URLs for the Debian bugs.
nekral-guest
2007-11-17 17:24:23 +00:00
0fd1ed4517Avoid terminating the PAM library in the forked child. This is done later in the parent after closing the PAM session. This fixes http://bugs.debian.org/412061. Debian patch 405_su_no_pam_end_before_exec.
nekral-guest
2007-11-17 17:19:44 +00:00
7503c8a029Mention sg in the newgrp manpage. Debian patch 410_newgrp_man_mention_sg.
nekral-guest
2007-11-17 17:03:01 +00:00
be972d7db3Fix typo: the warndays option was called warning. This is now warndays, as documented in the manpage and usage. Debian patch 417_passwd_warndays.
nekral-guest
2007-11-17 16:57:37 +00:00
fb6cb07a60Remove the preprocessor check SHADOWPWD. The variable is no more defined (and always assumed). Debian patch 493_pwck_no_SHADOWPWD.
nekral-guest
2007-11-17 16:50:26 +00:00
5bcc89ffe7Add NEWS entries for the last 2 changes.
nekral-guest
2007-11-17 16:43:00 +00:00
e47ee90033-l/-u options: edit the shadow account expiry field *in addition* to editing the password field. Debian patch 494_passwd_lock.
nekral-guest
2007-11-17 16:40:39 +00:00
ae5f08b1cbNew TODO for later.
nekral-guest
2007-11-17 16:27:30 +00:00
5d2ca8b240Do not request a password when a user uses newgrp to switch to her primary group. Debian patch 497_newgrp_primary_group.
nekral-guest
2007-11-17 16:19:00 +00:00
90ef765c2eLog an error if the password entry could not be found (respect LOG_UNKFAIL_ENAB to avoid logging a password). This fixes the Debian bug http://bugs.debian.org/451521
nekral-guest
2007-11-17 16:05:54 +00:00
ca875647b9-b documenation: Use the same notation for the -d argument as in the -d documentation.
nekral-guest
2007-11-17 15:27:12 +00:00
e39a941413Allow the -b option even without the -D option.
nekral-guest
2007-11-17 15:07:59 +00:00
87b5ce3036Use the same error message for the below errors. (option working ONLY if another is specified).
nekral-guest
2007-11-17 14:49:39 +00:00
af045a0733Make usermod -o and -u work independently of the argument order.
nekral-guest
2007-11-17 14:40:54 +00:00
488184394eValidate that two of the -L, -p, and -U options are not used at the same time after the parsing of options. -U used to be allowed after -p or -L, but not before.
nekral-guest
2007-11-17 14:33:26 +00:00
71392cdc8fMake usermod -d and -m work independant of the argument order. Thanks to Justin Pryzby <jpryzby+d@quoininc.com> for the patch. This fixes Debian's bug #451518.
nekral-guest
2007-11-17 14:21:05 +00:00
4aafb131ca* NEWS, lib/nscd.c: Execute nscd -i instead of using the private glibc socket to flush the nscd tables. This comes from the RedHat patch shadow-4.0.16-nscd.c. * lib/commonio.c: Forbid inheritance of the passwd and group files to the spawed processes (like nscd). This comes from the RedHat patch shadow-4.0.17-notInheritFd.patch. * lib/nscd.h: Update header.
nekral-guest
2007-11-17 14:04:05 +00:00
6c2e7c124fRemove remaining return value in update_group.
nekral-guest
2007-11-17 13:48:56 +00:00
24e742d202* src/usermod.c (fail_exit): Add static variables pw_locked, spw_locked, gr_locked, and sgr_locked to indicate which files must be unlocked. * src/usermod.c (open_files, close_files): Open and close the group files as well as the passwd files. This permit to check if the group files modification are allowed before writing the passwd files. * src/usermod.c (grp_update, update_gshadow, update_group): Do not return a status code, but call fail_exit() in case of error. The group files are no more opened and closed in update_gshadow() and update_group(). * src/usermod.c (main): move the call to grp_update between open_files and close_files. * src/usermod.c: Differentiate failure to add a group entry and failure to add a shadow group entry.
nekral-guest
2007-11-17 11:42:47 +00:00
326074388cDifferentiate failure to update a group entry and failure to update a shadow group entry.
nekral-guest
2007-11-17 11:31:06 +00:00
9afe59af3eInform the user if out of memory while updating a group database.
nekral-guest
2007-11-16 23:39:42 +00:00
7ecdf9b71fUpdate the group database before flushing the nscd caches.
nekral-guest
2007-11-16 23:29:41 +00:00
0325483ee4Abort if an error is found while updating the user or group database. No changes will be written in the databases.
nekral-guest
2007-11-16 23:26:56 +00:00
b370e1502eIt is no more needed to check that the user's groups are specified only once in the group file. This is checked by gr_update().
nekral-guest
2007-11-16 23:05:24 +00:00
07c2610170* lib/commonio.c (next_entry_by_name): New function. * NEWS, lib/commonio.c (commonio_update): When an entry is updated, make sure that there are no other entry with the same name. This fixes an infinite loop in userdel and usermod when an (erroneous) group file contains two entries with the same name. (https://bugzilla.redhat.com/show_bug.cgi?id=240915)
nekral-guest
2007-11-16 22:59:14 +00:00
c2ebdc4b5dFix date entry.
nekral-guest
2007-11-16 22:33:59 +00:00
449f17385a* libmisc/salt.c: Make sure the salt string is terminated at the right place (either 8th, or 11th position). * NEWS, src/chgpasswd.c, src/chpasswd.c: The protocol + salt does not need 15 chars. No need for a temporary buffer. This change the fix committed on 2007-11-10. The salt provided to pw_encrypt could have been too long.
nekral-guest
2007-11-16 19:02:00 +00:00
e163c5fe9cFix typo: missing / in <placeholder-1/>. This caused the gpasswd title to be incomplete in the French manpage.
nekral-guest
2007-11-16 14:10:29 +00:00
f55e00dc4eAdd support for uClibc with no l64a().
nekral-guest
2007-11-16 12:36:21 +00:00
e0edb7db17Add support for systems with no innetgr(). On those systems, username with an @ will be treated like any other username (i.e. lookup in the local database for an user with an @). Thanks to Mike Frysinger for the patch.
nekral-guest
2007-11-16 11:32:42 +00:00
8d527f156dDeclare the child and pid variable at the beginning of a block. This fixes a compilation issue with gcc 2.95. The intent is the same as Gentoo's patch shadow-4.0.12-gcc2.patch.
nekral-guest
2007-11-14 13:46:15 +00:00
15f43716c1Add a variable to set the suid permissions. This should simplify Gentoo's patch shadow-4.0.11.1-perms.patch.
nekral-guest
2007-11-14 13:32:25 +00:00
b2120265fdAdded the subversion svn:keywords property (Id) for proper identification.
nekral-guest
2007-11-10 23:46:11 +00:00
fb3b2ddbffRestore the ignore patterns from the previous repository.
nekral-guest
2007-11-10 23:34:37 +00:00
0f09d5378aUpdate the PO files.
nekral-guest
2007-11-10 22:36:37 +00:00
f9de15fdcfDon't ask for a password if there are no group passwords. Just directly give up. This comes from the Fedora's patch shadow-4.0.13-newgrpPwd.patch, and seems to be the only part with an effect.
nekral-guest
2007-11-10 18:54:40 +00:00
1bdb92706eFix chpasswd and chgpasswd stack overflow. Based on Fedora's shadow-4.0.18.1-overflow.patch.
nekral-guest
2007-11-10 18:48:23 +00:00
6a051e1544Allow non numerical group identifier to be specified with useradd's -g option. Applied Debian patch 397_non_numerical_identifier. Thanks also to Greg Schafer <gschafer@zip.com.au>.
nekral-guest
2007-11-10 15:51:38 +00:00
6a73df0b18Update the release date.
nekral-guest
2007-10-28 15:36:14 +00:00
8609e24880Update the version number to 4.0.18.2 and the gettext version to 0.16.
nekral-guest
2007-10-27 23:22:11 +00:00
4bb174fa8cRemove the generate_translations.mak inclusion. This file does not exist and will be introduced later when the Debian patch 409_man_generate_from_PO will be included.
nekral-guest
2007-10-27 23:19:32 +00:00
a8856cbfbdRemove a plural form. nplurals=1 for japanese. Moreover, msgstr[0] was identical to msgstr[1].
nekral-guest
2007-10-27 23:18:08 +00:00
16285e6768Add support for 2 new resource limits. Thanks to Justin Bronder for the patch. This was reported in the Debian bug #442334. This only impact shadow when it is not compiled with PAM support.
nekral-guest
2007-10-27 19:45:21 +00:00
93acdeb8ffDocument all gpasswd.1 options separately. This clarify the gpasswd.1 manpages (reported in debian bug #445480).
nekral-guest
2007-10-27 14:00:31 +00:00