OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: password file locking
From: Solar Designer (solarfalse.com)
Date: Thu Aug 17 2000 - 01:45:18 CDT

Hi,

In recent Linux distributions, we have at least the following
packages that write to /etc/passwd:

1. pwdb (provides libpwdb, which is used by pam_pwdb).
2. pam_unix (included with Linux-PAM).
3. util-linux (provides chsh, chfn).
4. shadow-utils (provides useradd and the like).

Only #1 and #4 use compatible locking.

All of these are found on at least RH 6.x. pam_unix isn't used by
default, but is often recommended on pam-list and apparently is
going to replace pam_pwdb in RH 7.x.

Solutions?
1. Move to a more consistent system. Bonus: consistent man pages.
2. Patch util-linux, patch pam_unix.
3. Patch util-linux, don't use pam_unix.
4. Use the versions of chsh and chfn provided with shadow-utils
rather than ones provided with util-linux (any particular reason RH
prefers the util-linux versions?). Don't use pam_unix.

Signed,
Solar Designer