NetBSD Problem Report #936

From gnats  Sun Apr  2 13:08:22 1995
Received: from pain.lcs.mit.edu (pain.lcs.mit.edu [128.52.46.239]) by sun-lamp.cs.berkeley.edu (8.6.10/8.6.10) with ESMTP id NAA03456 for <gnats-bugs@sun-lamp.cs.berkeley.edu>; Sun, 2 Apr 1995 13:08:21 -0700
Message-Id: <199504020620.QAA14587@zen.void.oz.au>
Date: Sun, 2 Apr 1995 16:20:57 +1000
From: "Simon J. Gerraty" <sjg@zen.void.oz.au>
Reply-To: sjg@zen.void.oz.au
To: gnats-bugs@NetBSD.ORG
Subject: allow login to force password change
X-Send-Pr-Version: 3.2

>Number:         936
>Category:       bin
>Synopsis:       patch to allow login to force password change on initial login.
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    bin-bug-people
>State:          closed
>Class:          change-request
>Submitter-Id:   net
>Arrival-Date:   Sun Apr 02 13:20:07 +0000 1995
>Closed-Date:    Sat Aug 16 13:47:26 +0000 1997
>Last-Modified:  Sat Aug 16 13:48:40 +0000 1997
>Originator:     Simon J. Gerraty
>Release:        Mar27 -current
>Organization:
Zen Programming...
>Environment:

System: NetBSD zen.void.oz.au 1.0A NetBSD 1.0A (ZEN) #0: Wed Mar 29 22:56:59 EST 1995 root@zen.void.oz.au:/d2/current/src/sys/arch/i386/compile/ZEN i386


>Description:

The patch below adds support to login(1) for a "magic" change date
that means expire on next login.  This is useful for newly added
accounts or for simply forcing users to change their passwords after
some security event...

Note: if the user authenticated via S/Key they are only warned about
the need for password change as it makes no sense to make a user enter
a password from an insecure terminal.
>How-To-Repeat:

>Fix:

*** login/login.c.old	Sun Apr  2 13:05:35 1995
--- login/login.c	Sun Apr  2 15:52:47 1995
***************
*** 83,88 ****
--- 83,89 ----
  int	 rootterm __P((char *));
  void	 sigint __P((int));
  void	 sleepexit __P((int));
+ void	do_chpass __P((void));
  char	*stypeof __P((char *));
  void	 timedout __P((int));
  int	 pwcheck __P((char *, char *, char *, char *));
***************
*** 112,117 ****
--- 113,128 ----
  struct	passwd *pwd;
  int	failures;
  char	term[64], *envinit[1], *hostname, *username, *tty;
+ #ifdef SKEY
+ int	used_skey = 0;
+ #endif
+ 
+ #ifndef IMEDIATE_CHANGE
+ # define IMEDIATE_CHANGE 1
+ #endif
+ #ifndef WARN_DAYS
+ # define WARN_DAYS 7				/* give 1 week warning */
+ #endif

  int
  main(argc, argv)
***************
*** 128,133 ****
--- 139,145 ----
  	char *domain, *p, *salt, *ttyn;
  	char tbuf[MAXPATHLEN + 2], tname[sizeof(_PATH_TTY) + 10];
  	char localhost[MAXHOSTNAMELEN];
+ 	int need_chpass = 0;

  	(void)signal(SIGALRM, timedout);
  	(void)alarm(timeout);
***************
*** 349,359 ****
  	if (pwd->pw_change || pwd->pw_expire)
  		(void)gettimeofday(&tp, (struct timezone *)NULL);
  	if (pwd->pw_change)
! 		if (tp.tv_sec >= pwd->pw_change) {
  			(void)printf("Sorry -- your password has expired.\n");
  			sleepexit(1);
  		} else if (pwd->pw_change - tp.tv_sec <
! 		    2 * DAYSPERWEEK * SECSPERDAY && !quietlog)
  			(void)printf("Warning: your password expires on %s",
  			    ctime(&pwd->pw_change));
  	if (pwd->pw_expire)
--- 361,373 ----
  	if (pwd->pw_change || pwd->pw_expire)
  		(void)gettimeofday(&tp, (struct timezone *)NULL);
  	if (pwd->pw_change)
! 		if (pwd->pw_change == IMEDIATE_CHANGE) {
! 			need_chpass = 1;
! 		} else if (tp.tv_sec >= pwd->pw_change) {
  			(void)printf("Sorry -- your password has expired.\n");
  			sleepexit(1);
  		} else if (pwd->pw_change - tp.tv_sec <
! 		    WARN_DAYS * DAYSPERWEEK * SECSPERDAY && !quietlog)
  			(void)printf("Warning: your password expires on %s",
  			    ctime(&pwd->pw_change));
  	if (pwd->pw_expire)
***************
*** 361,367 ****
  			(void)printf("Sorry -- your account has expired.\n");
  			sleepexit(1);
  		} else if (pwd->pw_expire - tp.tv_sec <
! 		    2 * DAYSPERWEEK * SECSPERDAY && !quietlog)
  			(void)printf("Warning: your account expires on %s",
  			    ctime(&pwd->pw_expire));

--- 375,381 ----
  			(void)printf("Sorry -- your account has expired.\n");
  			sleepexit(1);
  		} else if (pwd->pw_expire - tp.tv_sec <
! 		    WARN_DAYS * DAYSPERWEEK * SECSPERDAY && !quietlog)
  			(void)printf("Warning: your account expires on %s",
  			    ctime(&pwd->pw_expire));

***************
*** 457,462 ****
--- 471,480 ----
  	else
  		(void) setuid(pwd->pw_uid);

+ 	/* wait until we are un-privileged */
+ 	if (need_chpass)
+ 		do_chpass();
+ 	
  	execlp(pwd->pw_shell, tbuf, 0);
  	err(1, "%s", pwd->pw_shell);
  }
***************
*** 471,477 ****
  			fprintf(stderr, "You have no s/key. ");
  			return 1;
  		} else {
! 			return skey_authenticate(user);
  		}
  	}
  #endif
--- 489,499 ----
  			fprintf(stderr, "You have no s/key. ");
  			return 1;
  		} else {
! 			int ret = skey_authenticate(user);
! 
! 			if (ret == 0)
! 				used_skey = 1;
! 			return ret;
  		}
  	}
  #endif
***************
*** 675,678 ****
--- 697,718 ----
  {
  	(void)sleep(5);
  	exit(eval);
+ }
+ 
+ void
+ do_chpass()
+ {
+ #ifdef SKEY
+ 	/*
+ 	 * if user logged on using skey, don't make them
+ 	 * type a password in...
+ 	 */
+ 	if (used_skey) {
+ 		(void)printf("Warning: your password has expired, change it as soon as possible.\n");
+ 		return;
+ 	}
+ #endif
+ 	(void)printf("Your password has expired, chose a new one.\n");
+ 	if (system("passwd") != 0)
+ 		sleepexit(1);
  }
>Release-Note:
>Audit-Trail:

From: "Simon J. Gerraty" <sjg@zen.void.oz.au>
To: gnats-bugs@netbsd.org, gnats-admin@netbsd.org
Subject: Re: bin/936: allow login to force password change 
Date: Mon, 03 Apr 1995 11:44:40 +1000


 The patch has a bug - the * DAYSPERWEEK should be removed and
 WARN_DAYS upped to 14. 

 --sjg
State-Changed-From-To: open->closed 
State-Changed-By: lukem 
State-Changed-When: Sat Aug 16 06:47:26 PDT 1997 
State-Changed-Why:  
I've added this functionality to login(1) based on your patch. 
Eventually the pw_class stuff should be investigated, as it would 
allow finer grained control of this stuff. For now, this patch is 
useful - thanks! 
>Unformatted:

Home	PR Database Search