shadow.passwds.txt

`Date: Fri, 11 Jun 1999 10:11:29 EET  
From: Emils Klotins <[email protected]>  
To: [email protected]  
Subject: useradd -p stores cleartext passwords / shadow-980724  
  
Hello.  
  
Sorry if this is reported already. Didn't find it in Bugtraq archives nor in SuSE support db.  
  
OS: SuSE Linux 6.1  
Program: useradd  
Package: shadow-980724  
  
Problem description:  
'useradd' command has an option '-p password' for specifying password to the newly added user.  
(This option btw, does not appear anywhere in useradd man page)  
If you specify this option along with a password, the password will be stored in /etc/shadow, but  
in cleartext, creating 2 problems:?  
1. The password is stored in cleartext  
2. It of course does not work, for upon login an encrypted version of password is expected to be in  
/etc/shadow.  
  
PS. I could agree that specifying password in command-line can be considered quite dangerous,  
however, if the option is there, it should either work correctly or not be there.  
  
  
  
  
Emils Klotins e-mail: [email protected]  
Systems Manager URL: http://www.usis.bkc.lv/  
USIS Riga 7 Smilsu Str., Riga LV1050, LATVIA  
  
-------------------------------------------------------------------------------  
  
Date: Fri, 11 Jun 1999 16:02:50 -0400  
From: "Roche-Kelly, Edmund B." <[email protected]>  
To: [email protected]  
Subject: Re: useradd -p stores cleartext passwords / shadow-980724  
  
I would think the obvious answer is that the password supplied  
as an argument to -p is the encrypted password, generated  
by any of the mkpasswd utilities.  
  
I agree it's odd that it's not mentioned in the man page.  
  
Ed  
  
-------------------------------------------------------------------------------  
  
Date: Fri, 11 Jun 1999 19:32:03 -0500  
From: James Sneeringer <[email protected]>  
To: [email protected]  
Subject: Re: useradd -p stores cleartext passwords / shadow-980724  
  
On Fri, 11 Jun 1999, Roche-Kelly, Edmund B. wrote:  
|  
| I agree it's odd that it's not mentioned in the man page.  
  
It was added to the man page in version 19990307. SuSE needs to update  
their package. The current version is 19990607, available at  
  
ftp://piast.t19.ds.pwr.wroc.pl/pub/linux/shadow/  
  
-James  
  
`