<br><font size=2 face="sans-serif">Package: login</font>
<br><font size=2 face="sans-serif">Version: 1:4.0.3-31sarge5</font>
<br>
<br><font size=2 face="sans-serif">I configured password aging on a freshly
Installation of Sarge.</font>
<br><font size=2 face="sans-serif">When I use ssh to log into an user account
with an expired password, </font>
<br><font size=2 face="sans-serif">I'm forced to change the password like
this:</font>
<br>
<br><font size=2 face="sans-serif"> Using username "westphal".</font>
<br><font size=2 face="sans-serif"> Linux wiesel 2.6.8-2-386 #1 Thu
May 19 17:40:50 JST 2005 i686 GNU/Linux</font>
<br><font size=2 face="sans-serif"> Last login: Tue Aug 2 09:08:16
2005 from 10.222.16.227</font>
<br><font size=2 face="sans-serif"> WARNING: Your password has expired.</font>
<br><font size=2 face="sans-serif"> You must change your password
now and login again!</font>
<br><font size=2 face="sans-serif"> Changing password for westphal</font>
<br><font size=2 face="sans-serif"> (current) UNIX password:</font>
<br><font size=2 face="sans-serif"> New UNIX password:</font>
<br><font size=2 face="sans-serif"> Retype new UNIX password:</font>
<br>
<br><font size=2 face="sans-serif">This is the expected behaviour. It even
works for a direct login into </font>
<br><font size=2 face="sans-serif">the root account (sshd configured to
"PermitRootLogin yes".) </font>
<br>
<br><font size=2 face="sans-serif">However, when I try to "su"
to an expired root account, it refuses </font>
<br><font size=2 face="sans-serif">to change the password: </font>
<br>
<br><font size=2 face="sans-serif"> root@wiesel:~# passwd -x 10 -i
99999 root</font>
<br>
<br><font size=2 face="sans-serif"> westphal@wiesel:~$ su -</font>
<br><font size=2 face="sans-serif"> Password:</font>
<br><font size=2 face="sans-serif"> You are required to change your
password immediately (password aged)</font>
<br><font size=2 face="sans-serif"> su: Authentication token is no
longer valid; new one required.</font>
<br><font size=2 face="sans-serif"> Sorry.</font>
<br><font size=2 face="sans-serif"> </font>
<br><font size=2 face="sans-serif">On a system where "su" is
the only way to become root, this would</font>
<br><font size=2 face="sans-serif">mean a locked out root account. Imagine
a remote system with </font>
<br><font size=2 face="sans-serif">sshd configured to "PermitRootLogin
no" and no direct console access.</font>
<br>
<br><font size=2 face="sans-serif">Here is my configuration file /etc/pam.d/su,
with @includes removed</font>
<br><font size=2 face="sans-serif">for clarity:</font>
<br>
<br><font size=2 face="sans-serif"> auth sufficient
pam_rootok.so</font>
<br><font size=2 face="sans-serif"> auth required
pam_unix.so nullok_secure</font>
<br><font size=2 face="sans-serif"> account required
pam_unix.so</font>
<br><font size=2 face="sans-serif"> password required
pam_unix.so use_authtok nullok</font>
<br><font size=2 face="sans-serif"> session required
pam_unix.so</font>
<br><font size=2 face="sans-serif"> </font>
<br><font size=2 face="sans-serif">The expected behaviour would be to immediately
request the user to</font>
<br><font size=2 face="sans-serif">change the password like for the direct
logins. </font>
<br>
<br><font size=2 face="sans-serif">Looking in su.c I found the following
comment:</font>
<br>
<br><font size=2 face="sans-serif"> /*</font>
<br><font size=2 face="sans-serif"> * Check to see if the account
is expired. root gets to ignore any</font>
<br><font size=2 face="sans-serif"> * expired accounts, but
normal users can't become a user with an</font>
<br><font size=2 face="sans-serif"> * expired password.</font>
<br><font size=2 face="sans-serif"> */</font>
<br>
<br><font size=2 face="sans-serif">IMHO this implementation of su confuses
"expired" (passwd -e user) </font>
<br><font size=2 face="sans-serif">and "inactive" (passwd -l
user) passwords. An expired password is not</font>
<br><font size=2 face="sans-serif">invalid, it is just marked for an immediate
change. I see no reason </font>
<br><font size=2 face="sans-serif">why su should deny access to such an
account.</font>
<br>
<br>
<br>
<br><font size=2 face="sans-serif">Regard,</font>
<br><font size=2 face="sans-serif"><br>
Mit freundlichen Grüßen,<br>
<br>
Volker Westphal<br>
SO NSD Design,Build,Implement&Run<br>
Security Services Financial Customers<br>
IBM Business Services GmbH<br>
... an IBM Global Services Company<br>
--------------------------------------<br>
Wilhelm-Fay-Straße 30 - 34, 65936 Frankfurt<br>
Tel.: +49 (0) 69/6645-5056<br>
E-Mail: volker.westphal@de.ibm.com</font>