Date: Mon, 19 Sep 2005 20:40:17 +0300 From: Giorgos Keramidas <keramida@ceid.upatras.gr> To: Ceri Davies <ceri@submonkey.net>, Gavin Atkinson <gavin.atkinson@ury.york.ac.uk>, src-committers@freebsd.org, cvs-src@freebsd.org, cvs-all@freebsd.org Subject: Re: cvs commit: src/share/man/man5 passwd.5 Message-ID: <20050919174017.GA38329@flame.pc> In-Reply-To: <20050919165219.GB4124@submonkey.net> References: <200509181540.j8IFe2LR042274@repoman.freebsd.org> <20050918200104.F89636@ury.york.ac.uk> <20050918203109.GA1419@flame.pc> <20050918222401.GQ441@submonkey.net> <20050919122020.GA1759@flame.pc> <20050919165219.GB4124@submonkey.net>
next in thread | previous in thread | raw e-mail | index | archive | help
On 2005-09-19 17:52, Ceri Davies <ceri@submonkey.net> wrote: > > What I'm getting at is that some operating systems allow a special *FOO > string in their (equivalent of) master.passwd file in order to indicate > that sshd should not allow users with that string in their entry to log > in. > > For example, Solaris uses the string *NP* to indicate that a user has no > password - password authentication is therefore disabled for that user, > disallowing su, password-based ssh access, etc. Cron jobs, key-based > auth, etc. continue to work. It also supports *LK* which indicates that > an account is locked: in this case, cron jobs for the user will not be > run and ssh access is denied altogether. > > The ssh bit works because OpenSSH knows that it should be looking for > the string *LK* and denying access if it is there. Search for > LOCKED_PASSWD_STRING in src/crypto/openssh/auth.c. > > What I'm wondering is why OpenSSH doesn't know about *LOCKED*; previous > discussions that I've had indicate that this is because we (the FreeBSD > project) haven't decided that *LOCKED* is canonical enough yet. Right. This is exactly why I didn't even attempt to document anything to that effect. I'm not sure what to write about, so I don't write something that is wrong :)
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20050919174017.GA38329>