Determine appropriate salt for invalid users.

When sshd is processing a non-PAM login for a non-existent user it uses
the string from the fakepw structure as the salt for crypt(3)ing the
password supplied by the client.  That string has a Blowfish prefix, so on
systems that don't understand that crypt will fail fast due to an invalid
salt, and even on those that do it may have significantly different timing
from the hash methods used for real accounts (eg sha512).  This allows
user enumeration by, eg, sending large password strings.  This was noted
by EddieEzra.Harari at verint.com (CVE-2016-6210).

To mitigate, use the same hash algorithm that root uses for hashing
passwords for users that do not exist on the system.  ok djm@

1 files changed, 8 insertions, 4 deletions

diff --git a/auth-passwd.c b/auth-passwd.c
index 63ccf3cab..530b5d4f7 100644
--- a/auth-passwd.c
+++ b/auth-passwd.c
@@ -193,7 +193,7 @@ int
 sys_auth_passwd(Authctxt *authctxt, const char *password)
 {
         struct passwd *pw = authctxt->pw;
-        char *encrypted_password;
+        char *encrypted_password, *salt = NULL;
 
         /* Just use the supplied fake password if authctxt is invalid */
         char *pw_password = authctxt->valid ? shadow_pw(pw) : pw->pw_passwd;
@@ -202,9 +202,13 @@ sys_auth_passwd(Authctxt *authctxt, const char *password)
         if (strcmp(pw_password, "") == 0 && strcmp(password, "") == 0)
                 return (1);
 
-        /* Encrypt the candidate password using the proper salt. */
-        encrypted_password = xcrypt(password,
-            (pw_password[0] && pw_password[1]) ? pw_password : "xx");
+        /*
+         * Encrypt the candidate password using the proper salt, or pass a
+         * NULL and let xcrypt pick one.
+         */
+        if (authctxt->valid && pw_password[0] && pw_password[1])
+                salt = pw_password;
+        encrypted_password = xcrypt(password, salt);
 
         /*
          * Authentication is accepted if the encrypted passwords