Date: Fri, 11 Jun 1999 10:11:29 EET
From: Emils Klotins <emils@mail.usis.bkc.lv>
To: BUGTRAQ@netspace.org
Subject: useradd -p stores cleartext passwords / shadow-980724

Hello.

Sorry if this is reported already. Didn't find it in Bugtraq archives nor in SuSE support db.

OS: SuSE Linux 6.1
Program: useradd
Package: shadow-980724

Problem description:
'useradd' command has an option '-p password' for specifying password to the newly added user.
(This option btw, does not appear anywhere in useradd man page)
If you specify this option along with a password, the password will be stored in /etc/shadow, but
in cleartext, creating 2 problems:?
1. The password is stored in cleartext
2. It of course does not work, for upon login an encrypted version of password is expected to be in
/etc/shadow.

PS. I could agree that specifying password in command-line can be considered quite dangerous,
however, if the option is there, it should either work correctly or not be there.




Emils Klotins       e-mail: emils@mail.usis.bkc.lv
Systems Manager     URL: http://www.usis.bkc.lv/
USIS Riga           7 Smilsu Str., Riga LV1050, LATVIA

-------------------------------------------------------------------------------

Date: Fri, 11 Jun 1999 16:02:50 -0400
From: "Roche-Kelly, Edmund B." <Edmund.B.Roche-Kelly@FMR.COM>
To: BUGTRAQ@netspace.org
Subject: Re: useradd -p stores cleartext passwords / shadow-980724

I would think the obvious answer is that the password supplied
as an argument to -p is the encrypted password, generated
by any of the mkpasswd utilities.

I agree it's odd that it's not mentioned in the man page.

Ed

-------------------------------------------------------------------------------

Date: Fri, 11 Jun 1999 19:32:03 -0500
From: James Sneeringer <jvs@OCSLINK.COM>
To: BUGTRAQ@netspace.org
Subject: Re: useradd -p stores cleartext passwords / shadow-980724

On Fri, 11 Jun 1999, Roche-Kelly, Edmund B. wrote:
|
| I agree it's odd that it's not mentioned in the man page.

It was added to the man page in version 19990307.  SuSE needs to update
their package.  The current version is 19990607, available at

ftp://piast.t19.ds.pwr.wroc.pl/pub/linux/shadow/

-James