- PAM bugfix. PermitEmptyPassword was being ignored.

 - Fixed PAM config files to allow empty passwords if server does.
 - Explained spurious PAM auth warning workaround in UPGRADING

diff --git a/ChangeLog b/ChangeLog
index 9cf2454731d29be241b81676b4b5195364b2c3e9..575b8b17aaf54de9e79cd6ea65abaa6ea86e504f 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -4,6 +4,9 @@
  - Removed credits from README to CREDITS file, updated.
  - Added --with-default-path to specify custom path for server
  - Removed #ifdef trickery from acconfig.h into defines.h
+ - PAM bugfix. PermitEmptyPassword was being ignored.
+ - Fixed PAM config files to allow empty passwords if server does.
+ - Explained spurious PAM auth warning workaround in UPGRADING
 
 19991226
  - Enabled utmpx support by default for Solaris

diff --git a/TODO b/TODO
index fffdb1caa6cc5c39190a8745d73b723853c6a86a..1d07c5c6b86b6e389fcb759e53424505e20612d3 100644 (file)
--- a/TODO
+++ b/TODO
@@ -4,9 +4,7 @@
 
 - Better documentation
 
-- Port to other platforms (Finish Solaris support)
-
-- Fix paths in manpages using autoconf
+- Port to other platforms
 
 - Better testing on non-PAM systems
 

diff --git a/UPGRADING b/UPGRADING
index 854bd2294db7c514b97f9d21d0a9f75e5591bce4..526d5789ea1f961e2831858f91686f98f47805ac 100644 (file)
--- a/UPGRADING
+++ b/UPGRADING
@@ -53,3 +53,6 @@ These are generated because OpenSSH first tries to determine whether a
 user needs authentication to login (e.g. empty password). Unfortunatly
 PAM likes to log all authentication events, this one included.
 
+If it annoys you too much, set "PermitEmptyPasswords no" in 
+sshd_config. This will quiet the error message at the expense of
+disabling logins to accounts with no password set.

diff --git a/packages/redhat/sshd.pam b/packages/redhat/sshd.pam
index 26dcb34d9e944401738a49b8ad243c9c9f815de8..9ec42469e20ae8e46b3441a80af0ce6cc0ba59af 100644 (file)
--- a/packages/redhat/sshd.pam
+++ b/packages/redhat/sshd.pam
@@ -1,5 +1,5 @@
 #%PAM-1.0
-auth       required     /lib/security/pam_pwdb.so shadow nodelay
+auth       required     /lib/security/pam_pwdb.so shadow nodelay nullok
 auth       required     /lib/security/pam_nologin.so
 account    required     /lib/security/pam_pwdb.so
 password   required     /lib/security/pam_cracklib.so

diff --git a/sshd.c b/sshd.c
index 46a327f868bfcdd9fbba40ea4e8f39727898b95e..f3169078b6b11de65875aec5c8cd8b3ba70abbef 100644 (file)
--- a/sshd.c
+++ b/sshd.c
@@ -242,6 +242,9 @@ int do_pam_auth(const char *user, const char *password)
 {
        int pam_retval;
        
+       if ((options.permit_empty_passwd == 0) && (password[0] == '\0')
+               return 0;
+
        pampasswd = password;
        
        pam_retval = pam_authenticate((pam_handle_t *)pamh, 0);

diff --git a/sshd.pam.generic b/sshd.pam.generic
index cf5af30248a91160785d73b765a99e3d7a4ddc4a..11e620dea41c25fdec0d56f98ae703f452dc18ea 100644 (file)
--- a/sshd.pam.generic
+++ b/sshd.pam.generic
@@ -1,5 +1,5 @@
 #%PAM-1.0
-auth       required     /lib/security/pam_unix.so shadow nodelay
+auth       required     /lib/security/pam_unix.so shadow nodelay nullok
 auth       required     /lib/security/pam_nologin.so
 account    required     /lib/security/pam_unix.so
 password   required     /lib/security/pam_cracklib.so