Package: login
Version: 1:4.0.18.1-11
Severity: normal
Hi,
when logging in with an unknown user name,
the login is immediately rejected with 'Login incorrect'.
I suppose this is bad for security as it allows to
more easily guess valid user names.
IIRC, last time i consciously checked this (some time ago)
it was not possible to distinguish between
- username wrong
- password wrong
- username and password wrong
Regards, ingo
Here a screen dump of a successful and a failed attempt:
Ctrl-Alt-Delete for system halt
Linux 2.6.22.5 (tty2)
noo login: ingo
Password:
Last login: Thu Sep 20 17:13:11 CEST 2007 on tty2
Linux noo 2.6.22.5 #3 Sun Aug 26 16:55:43 CEST 2007 i686
The programs included with the Debian GNU/Linux system are free
software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
No mail.
noo:~ % exit
Ctrl-Alt-Delete for system halt
Linux 2.6.22.5 (tty2)
noo login: asdf
Login incorrect
noo login:
-- System Information:
Debian Release: lenny/sid
APT prefers unstable
APT policy: (500, 'unstable'), (1, 'experimental')
Architecture: i386 (i686)
Kernel: Linux 2.6.22.5
Locale: LANG=C, LC_CTYPE=C (charmap=ANSI_X3.4-1968)
Shell: /bin/sh linked to /bin/bash
Versions of packages login depends on:
ii libc6 2.6.1-5 GNU C Library: Shared libraries
ii libpam-modules 0.99.7.1-4 Pluggable Authentication Modules f
ii libpam-runtime 0.99.7.1-4 Runtime support for the PAM librar
ii libpam0g 0.99.7.1-4 Pluggable Authentication Modules l
login recommends no packages.
-- debconf-show failed
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
