- (stevesk) [auth.c] Shadow account and expiration cleanup. Now

[openssh.git] / auth.c

diff --git a/auth.c b/auth.c
index a9f981d18e1bfd7a39b0a357a8e023acbdc1e9c6..2f1979cfa97b03fe57a4e7a832690fdd2a1b0b8f 100644 (file)
--- a/auth.c
+++ b/auth.c
@@ -80,18 +80,35 @@ allowed_user(struct passwd * pw)
        if (!pw || !pw->pw_name)
                return 0;
 
+#define        DAY             (24L * 60 * 60) /* 1 day in seconds */
        spw = getspnam(pw->pw_name);
        if (spw != NULL) {
-               int days = time(NULL) / 86400;
+               time_t today = time(NULL) / DAY;
+               debug3("allowed_user: today %d sp_expire %d sp_lstchg %d"
+                   " sp_max %d", (int)today, (int)spw->sp_expire,
+                   (int)spw->sp_lstchg, (int)spw->sp_max);
 
-               /* Check account expiry */
-               if ((spw->sp_expire >= 0) && (days > spw->sp_expire))
+               /*
+                * We assume account and password expiration occurs the
+                * day after the day specified.
+                */
+               if (spw->sp_expire != -1 && today > spw->sp_expire) {
+                       log("Account %.100s has expired", pw->pw_name);
                        return 0;
+               }
 
-               /* Check password expiry */
-               if ((spw->sp_lstchg >= 0) && (spw->sp_max >= 0) &&
-                   (days > (spw->sp_lstchg + spw->sp_max)))
+               if (spw->sp_lstchg == 0) {
+                       log("User %.100s password has expired (root forced)",
+                           pw->pw_name);
                        return 0;
+               }
+
+               if (spw->sp_max != -1 &&
+                   today > spw->sp_lstchg + spw->sp_max) {
+                       log("User %.100s password has expired (password aged)",
+                           pw->pw_name);
+                       return 0;
+               }
        }
 #else
        /* Shouldn't be called if pw is NULL, but better safe than sorry... */