[Bug 833253] New: null passwords cannot be created (passwordless and null password account logins rejected KDE and vttys; )

https://bugzilla.novell.com/show_bug.cgi?id=833253 https://bugzilla.novell.com/show_bug.cgi?id=833253#c0 Summary: null passwords cannot be created (passwordless and null password account logins rejected KDE and vttys; ) Classification: openSUSE Product: openSUSE Factory Version: 13.1 Milestone 3 Platform: All OS/Version: Other Status: NEW Severity: Major Priority: P5 - None Component: Basesystem AssignedTo: bnc-team-screening@forge.provo.novell.com ReportedBy: mrmazda@earthlink.net QAContact: qa-bugs@suse.de Found By: --- Blocker: --- Created an attachment (id=551106) --> (http://bugzilla.novell.com/attachment.cgi?id=551106) 13.1m3 y2logs from host big41 To reproduce: 1-install minimal X normally but without creating any regular user(s) 2-set grub cmdline(s) to include 3 parameter 3-set solver.onlyRequires=true in /etc/zypp.conf 4-install minimalist via zypper and set default KDM/KDE (3 and/or 4) 5-create group account (e.g. # groupadd -g 1999 mygroup) 6-create user account (e.g. # useradd -g 1999 -u 1999 myaccount) 7a-delete password (e.g. # passwd -d myaccount), or 7b-set password null (e.g. #passwd myaccount, <ENTER>, <ENTER>) 8-attempt to login with new user account (hostname login: myaccount)(in KDM or vtty) 9-passwd -S myaccount Actual results: 1a-(KDE) {1}-Login failed (normal user) {2}-Login succeeds (root without entering any password) 1b-(vtty) Login incorrect 2-(vtty) login prompt refreshes 3-(passwd -S) myaccount NP 01/01/1970 99999 7 -1 4-attempt to set passwd null (7b above) fails as follows: New: password: BAD PASSWORD: it is WAY too short BAD PASSWORD: is a palindrome Retype new password: No password supplied passwd: Authentication token manipulation error passwd: password unchanged Expected results: 1-(vtty) Last login XXX XXX ## ##:"##:## on ttyX 2-(vtty) Have a lot of fun... 3-(all KDE) login succeeds 4-(passwd -S) myaccount PS 0 99999 7 -1 5-attempt to set null password succeeds Comments: 1-applies also to 12.3 (local hosts gx150 & big41) 2-In pre-12.3 openSUSE versions, deleting password failed too, but setting password null worked. In Fedora 19 (as in previous versions) and Mageia 3 (as in previous versions, and Mandriva, and Mandrake), setting password null fails, but deleting password works. 3-IIRC (I need to verify if I can figure out which systems this applies to), 12.2 systems (at least those with sysvinit-init installed) for which users and null password(s) was/were set and which were upgraded to 12.3 via zypper continue to accept logins. 4-On 2 of the 4 installations, once KDM had been started after the users and passwords had been set and at least one reboot, this bug permanently disappeared, remaining only on hosts gx150 running 13.1 and KDE3, and host big41 running 12.3 and KDE4. 5-As I needed 12.3 to work on big41, I copied relevant lines from /etc/shadow on big41's 12.2, which solved the problem at least so far as allowing logins from null password accounts. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.