session: deny access if password login is disabled

The special characters '!' and '*' in /etc/shadow are
used to disable password login for a specific account.

The character 'x' has no special meaning, but should not
be interpreted as an empty password.

However, rpcd did treat these special characters like no
password was set, which allows access even though the account
is disabled.

By removing the additional checks for these characters, the
encrypted password string is passed to crypt, which returns NULL
if the salt has an invalid format and therefore access is denied.

Fixes: FS#2634
Signed-off-by: Fabian Bläse <fabian@blaese.de>
(cherry picked from commit 3df62bcebd2caff47506ccffb42df8d2d2123c06)

diff --git a/session.c b/session.c
index 13a2ef36224d122e59b40440b757b30bb29ee3e0..908e2984e7c16247bb03510a20986a56980ed57c 100644 (file)
--- a/session.c
+++ b/session.c
@@ -795,7 +795,7 @@ rpc_login_test_password(const char *hash, const char *password)
        char *crypt_hash;
 
        /* password is not set */
-       if (!hash || !*hash || !strcmp(hash, "!") || !strcmp(hash, "x"))
+       if (!hash || !*hash)
        {
                return true;
        }