Skip to content

Non-root on FreeBSD Accepts Good Username but Bad Password #6

Description

@git-blame

If I'm using this module in FreeBSD as a non-root user, a good username but bad password will pass. Note a bad (non-existent) username will fail as expected. As root, the authentication works correctly.

[vagrant@vagrant-bsd93 ~]$ env LOGNAME=vagrant python -m simplepam // bad pwd: foobar
Password:
True
[vagrant@vagrant-bsd93 ~]$ env LOGNAME=foobar python -m simplepam // bad user, bad pwd
Password:
False

I expected that the bad password should fail. Or if root access is required, then all authentication checks as non-root should fail.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions