Package: gnome-system-tools Version: 3.0.0-5 Severity: important Dear Maintainer,
While adding a new user there is no PAM interaction with users-admin, effectively allowing users-admin to disregard all PAM restrictions until the user creation actually takes place. The result is, the new user has a locked account and extra action is required to set a working password. In this specific case libpam-cracklib is configured like this: /etc/pam.d/common-password: password requisite pam_cracklib.so retry=3 minlen=8 difok=3 enforce_for_root When adding a user via adduser, if the password checks defined above fail, a new password is requested. But when the user is added with /usr/bin/users-admin no checks take place. So when the user creation is performed, if the password is weak, PAM creates a ":!:" password field in /etc/shadow, effectively locking the new user out with no warning to the administrator. -- System Information: Debian Release: stretch/sid APT prefers unstable APT policy: (900, 'unstable'), (500, 'stable-updates'), (500, 'testing'), (400, 'stable'), (10, 'experimental') Architecture: amd64 (x86_64) Foreign Architectures: i386 Kernel: Linux 4.6.0-1-amd64 (SMP w/4 CPU cores) Locale: LANG=C.UTF-8, LC_CTYPE=C.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Init: systemd (via /run/systemd/system) Versions of packages gnome-system-tools depends on: ii dconf-gsettings-backend [gsettings-backend] 0.26.0-1 ii libatk1.0-0 2.20.0-1 ii libc6 2.23-5 ii libcairo-gobject2 1.14.6-1+b1 ii libcairo2 1.14.6-1+b1 ii libdbus-1-3 1.10.10-1 ii libgdk-pixbuf2.0-0 2.34.0-1 ii libglib2.0-0 2.48.1-3 ii libgtk-3-0 3.20.9-1 ii liboobs-1-5 3.0.0-3 ii libpango-1.0-0 1.40.1-1 ii libpangocairo-1.0-0 1.40.1-1 ii libpolkit-gobject-1-0 0.105-16 ii policykit-1-gnome 0.105-3 gnome-system-tools recommends no packages. Versions of packages gnome-system-tools suggests: ii gnome-control-center 1:3.20.1-2 ii ntp 1:4.2.8p8+dfsg-1 -- no debconf information
