| Summary: | Add some users to the default blacklist | ||
|---|---|---|---|
| Product: | accountsservice | Reporter: | Vincent Untz <vuntz> |
| Component: | general | Assignee: | Matthias Clasen <mclasen> |
| Status: | RESOLVED FIXED | QA Contact: | |
| Severity: | normal | ||
| Priority: | medium | CC: | mbiebl, rstrode |
| Version: | unspecified | ||
| Hardware: | Other | ||
| OS: | All | ||
| Whiteboard: | |||
| i915 platform: | i915 features: | ||
| Attachments: | Also exclude "at" user | ||
|
Description
Vincent Untz
2012-04-02 02:29:16 UTC
we started getting complaints about the mysql users in fedora too: http://www.mail-archive.com/test@lists.fedoraproject.org/msg14147.html Would the proposed solution there ^ work for you cases (looking at the shadow file and filtering out users with "!!" passwords i'm don't really mind expanding the blacklist. I'd just like to find a more scalable solution I guess. pushed a change to add ftp, games, man, and mysql to the blacklist err tried, git.freedesktop.org is down apparently. (In reply to comment #1) > Would the proposed solution there ^ work for you cases (looking at the shadow > file and filtering out users with "!!" passwords I don't really like the idea of opening /etc/shadow, to be honest :-) But otherwise, no objection. Hrm, the users have "*" passwords here, not "!!". Which is slightly different (and unfortunate, as iirc, "*" just means no password while "!!" means no login at all). Created attachment 60234 [details] [review] Also exclude "at" user Another user reported the issue with "at"... pushed, though turns out we already do the /etc/shadow snooping, so we just need to change it to be less specific about what it excludes. (In reply to comment #7) > pushed, though turns out we already do the /etc/shadow snooping, so we just > need to change it to be less specific about what it excludes. See http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=673095 and specifically http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=673095#15 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=673095#20 Allesio has reverted the commit for now, which drops the filtering based on MIN_UID. okay i pushed this: http://cgit.freedesktop.org/accountsservice/commit/?id=8dd2ac2a79636349de5846fab2050a7866f2ddee daemon: be more aggresive at excluding system accounts system accounts sometimes have valid shells, so checking for a valid shell isn't the best way to avoid showing those accounts. This commit changes accountsservice to exclude accounts that have a password hash that doesn't match one of the standard formats. So i'm going to close this bug out. |
Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.