From owner-ssh@clinet.fi Mon Feb 23 10:40:13 1998 Received: from lohi.clinet.fi (majordom@lohi.clinet.fi [194.100.0.7]) by hutcs.cs.hut.fi (8.8.8/8.8.8) with ESMTP id KAA23442; Mon, 23 Feb 1998 10:40:12 +0200 (EET) Received: (from majordom@localhost) by lohi.clinet.fi (8.8.8/8.8.6) id KAA04732 for ssh-outgoing; Mon, 23 Feb 1998 10:38:25 +0200 (EET) X-Authentication-Warning: lohi.clinet.fi: majordom set sender to owner-ssh@clinet.fi using -f Received: from boondoggle.office.aol.com (xlate-113.office.aol.com [204.148.100.113]) by lohi.clinet.fi (8.8.8/8.8.6) with SMTP id WAA03440 for ; Fri, 13 Feb 1998 22:36:19 +0200 (EET) Received: from boondoggle.office.aol.com (boondoggle.office.aol.com [10.2.30.112]) by boondoggle.office.aol.com (950413.SGI.8.6.12/950213.SGI.AUTOCF) via SMTP id PAA11302; Fri, 13 Feb 1998 15:32:10 -0500 Date: Fri, 13 Feb 1998 15:32:10 -0500 (EST) From: Brian Harvell X-Sender: harvell@boondoggle.office.aol.com Reply-To: Brian Harvell To: ssh@clinet.fi Subject: Small bug in osfc2.c Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-ssh@clinet.fi Precedence: bulk It seems there is a small bug in osfc2.c, or at least it doesn't function like Digital documents it. From the Digital documentation ----------------------------------------------------------------------- 7.5.4.1 Aging If you do not want password aging on your system, in the default database set u_exp and u_life to 0, and then (because of the way the default methods of determining length restrictions on passwords work based on the password lifetime) also set u_minlen and u_maxlen to appropriate values for the site. An example entry could be as follows: :u_exp#0:u_life#0:u_minlen#5:u_maxlen#32:\ ---------------------------------------------------------------------- According to this you are supposed to set u_life and u_exp to 0 to turn off password aging. Doing this will cause sshd to think you have an expired password while /bin/login will still let you in. I would think you should test to see if u_life is set or if it equals 0 (Same for u_exp) The patch below does this. It was patched against the ssh-1.2.22 source. Can someone with more osf programming experience verify this? Thanks Brian Brian Harvell harvell@aol.net http://boondoggle.web.aol.com/ echo '[q]sa[ln0=aln256%Pln256/snlbx]sb3135071790101768542287578439snlbxq'|dc *** osfc2.c Tue Jan 20 07:24:06 1998 --- osfc2.c.patched Fri Feb 13 15:20:15 1998 *************** *** 135,141 **** pschg = pr->ufld.fd_schange; if (pr->uflg.fg_template == 0) { /** default template, system values **/ ! if (pr->sflg.fg_lifetime == 1) if (pschg + pr->sfld.fd_lifetime < tnow) return 2; } --- 135,141 ---- pschg = pr->ufld.fd_schange; if (pr->uflg.fg_template == 0) { /** default template, system values **/ ! if (pr->sflg.fg_lifetime == 1 && pr->sfld.fd_lifetime != 0) if (pschg + pr->sfld.fd_lifetime < tnow) return 2; } *************** *** 145,151 **** es = getespwnam(pr->ufld.fd_template); if (es) { ! if (es->uflg->fg_expire == 1) if (pschg + es->ufld->fd_expire < tnow) return 2; /** Login resources **/ --- 145,151 ---- es = getespwnam(pr->ufld.fd_template); if (es) { ! if (es->uflg->fg_expire == 1 && es->ufld->fd_expire != 0) if (pschg + es->ufld->fd_expire < tnow) return 2; /** Login resources **/