Re: System password authentication

Mike Ayers wrote:

>	This peanut would like a pointer to the rest of this thread, please, as I would like to be sure of what we're discussing here.
>
>
>  
>
Line 5654 and on of src/server.c (trunk) goes like this:

    if (password && *password)
    {
    /* user exists and has no system password, but we got
       one as parameter */
    host_user = xstrdup (username);
    goto handle_return;
    }

This check is in the section where the user has a blank system password,
the password variable is the password recieved from the user via pserver.

This check then says if the user has a blank system password then any
non blank password will authenticate her. Probably this test should be
removed and the user should be authenticated with any password, even
a blank one. As an alternative the user could be refused entry with a blank
system password, this would also increase security and there shouldn't
be too many people relying on this feature.

/Brian