OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Re: passwd authentication bug

From: Allen Briggs (briggsnetbsd.org)
Date: Tue Jul 03 2007 - 15:08:52 CDT

On Tue, Jul 03, 2007 at 10:06:01PM +0200, Zafer Aydogan wrote:
> # passwd foobar
> Changing password for foobar.
> Unable to change auth token: failed to recover old authentication token
>
> instead of displaying that the user doesn't exists.

Isn't this intentional?
To not provide information about which users exist or not. Granted, for
root, it's not a big deal, but do we really need a separate code path
for that?

-allen

--
Allen Briggs | http://www.ninthwonder.com/~briggs/ | briggsninthwonder.com