common-auth still carries nullok #13

New issue

Open

opened 2026-09-29 00:36:21 -03:00 by marcos-mendez · 0 comments

marcos-mendez commented

2026-09-29 00:36:21 -03:00

(Migrated from github.com)

Follow-up to #12.

/etc/pam.d/common-auth on a built core carries pam_unix.so nullok (Debian's default, from /usr/share/pam-configs/unix). #12 removes nullok from Webmin's own stack only.

On libpam 1.7 (Debian 13), measured with the real module in tests/pam-unix.bats: through a stack with nullok, an account whose field is empty or U6aMy0wojraho (the crypt of the empty string) is authenticated with any password, without being asked. #12 makes the build write *, which closes that for root, but any other account that ever carries an empty field is open through every service that includes common-auth (login, su, and so on).

Removing it is not a sed on common-auth: pam-auth-update regenerates that file from the profiles on every PAM package upgrade, so the change has to be a profile (or a diverted /usr/share/pam-configs/unix) that survives it, with a test that runs pam-auth-update and asks the real module afterwards.

Follow-up to #12. `/etc/pam.d/common-auth` on a built core carries `pam_unix.so nullok` (Debian's default, from `/usr/share/pam-configs/unix`). #12 removes `nullok` from Webmin's own stack only. On libpam 1.7 (Debian 13), measured with the real module in `tests/pam-unix.bats`: through a stack with `nullok`, an account whose field is empty or `U6aMy0wojraho` (the crypt of the empty string) is authenticated with any password, without being asked. #12 makes the build write `*`, which closes that for root, but any other account that ever carries an empty field is open through every service that includes common-auth (login, su, and so on). Removing it is not a `sed` on `common-auth`: `pam-auth-update` regenerates that file from the profiles on every PAM package upgrade, so the change has to be a profile (or a diverted `/usr/share/pam-configs/unix`) that survives it, with a test that runs `pam-auth-update` and asks the real module afterwards.