Re: System password authentication

[Brian Murphy]

Mike Ayers wrote:

>         This peanut would like a pointer to the rest of this thread, please, as 
> I would like to be sure of what we're discussing here.
>
>
>  
Line 5654 and on of src/server.c (trunk) goes like this:

   if (password && *password)
   {
   /* user exists and has no system password, but we got
      one as parameter */
   host_user = xstrdup (username);
   goto handle_return;
   }

This check is in the section where the user has a blank system password,
the password variable is the password recieved from the user via pserver.

This check then says if the user has a blank system password then any
non blank password will authenticate her. Probably this test should be
removed and the user should be authenticated with any password, even
a blank one. As an alternative the user could be refused entry with a blank
system password, this would also increase security and there shouldn't
be too many people relying on this feature.

/Brian