From 48066453165711514dd1ad039097807aa0576558 Mon Sep 17 00:00:00 2001 From: Balint Reczey Date: Mon, 25 Sep 2023 17:15:46 +0200 Subject: [PATCH] debian/NEWS: Fix false claim about PREVENT_NO_AUTH affecting authentication Also drop setting PREVENT_NO_AUTH in shipped login.defs. Closes: #1041547 --- debian/NEWS | 8 ++++++++ debian/login.defs | 8 -------- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/debian/NEWS b/debian/NEWS index a5948c99..a41043e3 100644 --- a/debian/NEWS +++ b/debian/NEWS @@ -1,3 +1,11 @@ +shadow (1:4.13+dfsg1-2) unstable; urgency=medium + + The previous entry falsely states that PREVENT_NO_AUTH in /etc/login.defs + affects authentication. The historical default of letting all users with + empty password field in without authentication is still in effect. + + -- Balint Reczey Mon, 25 Sep 2023 17:04:09 +0200 + shadow (1:4.11.1+dfsg1-0exp1) experimental; urgency=medium Login now prevents an empty password field to be interpreted as diff --git a/debian/login.defs b/debian/login.defs index bc129779..142e5b05 100644 --- a/debian/login.defs +++ b/debian/login.defs @@ -337,14 +337,6 @@ NONEXISTENT /nonexistent # #GRANT_AUX_GROUP_SUBIDS yes -# -# Prevents an empty password field to be interpreted as "no authentication -# required". -# Set to "yes" to prevent for all accounts -# Set to "superuser" to prevent for UID 0 / root (default) -# Set to "no" to not prevent for any account (dangerous, historical default) -PREVENT_NO_AUTH superuser - # # Select the HMAC cryptography algorithm. # Used in pam_timestamp module to calculate the keyed-hash message