IMAP login to disabled accounts
Andrew Daviel <[email protected]> Fri, 4 Mar 2011 14:56:55 -0800 (PST)
| Newsgroups | gmane.mail.imap.uw.c-client |
|---|---|
| Message-ID | <[email protected]> |
We just had some spam sent via our webmail. Turns out we had an account with a blank password but the shell set to /sbin/nologin (RedHat Linux). The webmail client was able to login with random passwords. This seems to be true logging in with Alpine also - random passwords work, but blank ones do not. I suspect that this is standard Linux behaviour and stupidity on our part. However, the ability to login with random passwords that are not checked is a bit bizarre.