- PAM bugfix. PermitEmptyPassword was being ignored.

 - Fixed PAM config files to allow empty passwords if server does.
 - Explained spurious PAM auth warning workaround in UPGRADING

6 files changed, 13 insertions, 6 deletions

diff --git a/ChangeLog b/ChangeLog
index 9cf245473..575b8b17a 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -4,6 +4,9 @@
  - Removed credits from README to CREDITS file, updated.
  - Added --with-default-path to specify custom path for server
  - Removed #ifdef trickery from acconfig.h into defines.h
+ - PAM bugfix. PermitEmptyPassword was being ignored.
+ - Fixed PAM config files to allow empty passwords if server does.
+ - Explained spurious PAM auth warning workaround in UPGRADING
 
 19991226
  - Enabled utmpx support by default for Solaris
diff --git a/TODO b/TODO
index fffdb1caa..1d07c5c6b 100644
--- a/TODO
+++ b/TODO
@@ -4,9 +4,7 @@
 
 - Better documentation
 
-- Port to other platforms (Finish Solaris support)
-
-- Fix paths in manpages using autoconf
+- Port to other platforms
 
 - Better testing on non-PAM systems
 
diff --git a/UPGRADING b/UPGRADING
index 854bd2294..526d5789e 100644
--- a/UPGRADING
+++ b/UPGRADING
@@ -53,3 +53,6 @@ These are generated because OpenSSH first tries to determine whether a
 user needs authentication to login (e.g. empty password). Unfortunatly
 PAM likes to log all authentication events, this one included.
 
+If it annoys you too much, set "PermitEmptyPasswords no" in 
+sshd_config. This will quiet the error message at the expense of
+disabling logins to accounts with no password set.
diff --git a/packages/redhat/sshd.pam b/packages/redhat/sshd.pam
index 26dcb34d9..9ec42469e 100644
--- a/packages/redhat/sshd.pam
+++ b/packages/redhat/sshd.pam
@@ -1,5 +1,5 @@
 #%PAM-1.0
-auth       required     /lib/security/pam_pwdb.so shadow nodelay
+auth       required     /lib/security/pam_pwdb.so shadow nodelay nullok
 auth       required     /lib/security/pam_nologin.so
 account    required     /lib/security/pam_pwdb.so
 password   required     /lib/security/pam_cracklib.so
diff --git a/sshd.c b/sshd.c
index e3596de50..761ed52c0 100644
--- a/sshd.c
+++ b/sshd.c
@@ -11,7 +11,7 @@
  */
 
 #include "includes.h"
-RCSID("$Id: sshd.c,v 1.43 1999/12/26 03:04:33 damien Exp $");
+RCSID("$Id: sshd.c,v 1.44 1999/12/26 23:45:54 damien Exp $");
 
 #ifdef HAVE_POLL_H
 # include <poll.h>
@@ -242,6 +242,9 @@ int do_pam_auth(const char *user, const char *password)
 {
         int pam_retval;
         
+        if ((options.permit_empty_passwd == 0) && (password[0] == '\0')
+                return 0;
+
         pampasswd = password;
         
         pam_retval = pam_authenticate((pam_handle_t *)pamh, 0);
diff --git a/sshd.pam.generic b/sshd.pam.generic
index cf5af3024..11e620dea 100644
--- a/sshd.pam.generic
+++ b/sshd.pam.generic
@@ -1,5 +1,5 @@
 #%PAM-1.0
-auth       required     /lib/security/pam_unix.so shadow nodelay
+auth       required     /lib/security/pam_unix.so shadow nodelay nullok
 auth       required     /lib/security/pam_nologin.so
 account    required     /lib/security/pam_unix.so
 password   required     /lib/security/pam_cracklib.so