Bug 652 - PermitEmptyPasswords option silently ignored
Summary: PermitEmptyPasswords option silently ignored
Status: CLOSED FIXED
Alias: None
Product: Portable OpenSSH
Classification: Unclassified
Component: Build system (show other bugs)
Version: 3.7.1p1
Hardware: All Solaris
: P2 normal
Assignee: OpenSSH Bugzilla mailing list
URL:
Keywords:
: 678 (view as bug list)
Depends on:
Blocks:
 
Reported: 2003-09-17 21:43 AEST by Stephen Usher
Modified: 2004-04-14 12:24 AEST (History)
1 user (show)

See Also:


Attachments
Fix empty password auth (637 bytes, patch)
2003-09-18 18:19 AEST, Damien Miller
no flags Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Stephen Usher 2003-09-17 21:43:36 AEST
Having upgraded to 3.7.1p1 from 3.6.1p2 using the following configure options:-

./configure --sysconfdir=/etc --with-rsh=/usr/ucb/rsh --with-xauth=/usr/openwin/
bin/xauth --with-default-path=/bin:/usr/ucb:/usr/bin:/usr/local/bin --with-ipv4-
default --with-ssl-dir=/usr/local/ssl

I've discovered that sshd silently ignores the PermitEmptyPasswords option in
the config file.

Researching further, it seems that the only place the option is referenced after
being set in auth-passwd.c, line 70 where the password has already been
requested from the user.

Unfortunately, even if a user merely hits RETURN at the passowrd prompt (s)he is
given the authentication fails for an account without a password.

If the functionality for NULL passwords has been removed on purpose then this
should be noted in the documentation and the configuration option should be
removed. Otherwise, this bug shold be fixed.
Comment 1 Hans Rakers 2003-09-18 00:50:53 AEST
I can confirm this problem on Slackware 8.0 aswell. 3.7p1 compiled with
following options:

CFLAGS="-O2 -march=i386 -mcpu=i686 -Wall" ./configure --prefix=/usr
--sysconfdir=/etc/ssh --without-pam --with-md5-passwords --with-tcp-wrappers   
        
--with-default-path=/usr/local/sbin:/usr/sbin:/sbin:/usr/local/bin:/usr/bin:/bin
--with-ipv4-default --with-privsep-path=/var/empty --with-privsep-user=sshd
i386-slackware-linux

PasswordAuthentication yes
PermitEmptyPasswords yes

user with empty password keeps getting password prompt. 

To fix the problem i temporarily reverted back to 3.6.1p2 with patch from
http://marc.theaimsgroup.com/?l=openssh-unix-dev&m=106378044112153&w=2

will gather some more debug info later
Comment 2 Damien Miller 2003-09-18 18:19:35 AEST
Created attachment 424 [details]
Fix empty password auth

Its a bug. Try this attached patch or wait for the next portable release.
Comment 3 Damien Miller 2003-09-18 21:32:37 AEST
*** Bug 678 has been marked as a duplicate of this bug. ***
Comment 4 Damien Miller 2004-04-14 12:24:19 AEST
Mass change of RESOLVED bugs to CLOSED