Re: expired passwords

Chris Kottaridis wrote:
When I run:

$ passwd -e <username>

To expire a password for a user and then try to log back in for that
user it says that I need to update my password. and then I get back to
the login prompt.

You are required to change your password immediately (root enforced)

I am expecting that it will ask to make a new password:

login: adm1
password: *******
WARNING: Your password has expired
You must change your password now and login again!
Changing password for adm1
Old password:
Enter the new password (minimum of 5, maximum of 8 characters)
Please use a combination of upper and lower case letters and numbers
New password:
Re-enter new password:
Password changed.

The man page for login implies I should be able to set it at login time:

--------------------------------
If password aging has been enabled for your account, you may be
prompted for a new password before proceeding. You will be forced to
provide your old password and the new password before continuing.
Please refer to passwd(1) for more information.
--------------------------------

Am I doing something wrong from a sysadmin point of view or is there
some compile option that needs to be used to get the behavior that I
want ?

no you are not. This is down to the order in which login uses PAM to check/change your password:
1. Do you know the (current) password for this account?
2. If so, We know who you are (and that you are entitled to use this account) and can check your account details to set up your session.
Once this is done, it becomes apparent that your password has expired and needs changing.
3. We then go through the normal password changing routine.


what exactly were you expecting to happen?

You type in an account name and immediately get told that the password has expired?
This is a security flaw, as it immediately exposes the fact that you have typed in a valid account name (you could be anyone trying to login).
Instead the system tries to authenticate you first - you are *always* prompted for a password. If this fails, you (as a possible attacker) don't actually know if you typed an incorrect username or an incorrect password. (or failed for some other reason). All you get is 'login incorrect'

Regards,

Stuart
--
Stuart Sears RHCA etc.

--
fedora-list mailing list
fedora-list@xxxxxxxxxx
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list

Relevant Pages

  • Re: Unable to change domain password when logged in as local user
    ... all the user accounts "user must change password at next logon". ... Administrator account and created its password to match that person's ... login & password is the same as the domain login & pwd, ... I enter the username and password, ...
    (microsoft.public.windows.server.active_directory)
  • Re: /etc/default/passwd and SSH
    ... SYNOPSIS: Description of "Password Aging" ... The warn field is the number of days of warning the user gets on login ... the expire field perform very distinct functions that are in no way related. ... The account should be disabled after a week so that it can not ...
    (Focus-SUN)
  • [Full-disclosure] Dexia website security alert
    ... A few days ago I sent a mail to the Dexia bank about ... one is for the online banking account and one ... The problem with the "members' login" was that ... encryption and b) if you enter a bad username or password both ...
    (Full-Disclosure)
  • Dexia website security alert
    ... A few days ago I sent a mail to the Dexia bank about their ... one is for the online banking account and one is for some ... The problem with the "members' login" was that a) it was ... selected the wrong login by mistake your username and password were ...
    (Security-Basics)
  • Dexia website security alert
    ... A few days ago I sent a mail to the Dexia bank about their ... one is for the online banking account and one is for some ... The problem with the "members' login" was that a) it was ... selected the wrong login by mistake your username and password were ...
    (Bugtraq)