From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [45.144.208.40]) by lore.proxmox.com (Postfix) with ESMTPS id 49A791FF0B3 for ; Fri, 25 Sep 2026 11:22:03 +0200 (CEST) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id 516B221660; Fri, 25 Sep 2026 11:22:02 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=dualfroz.com; s=dkim; t=1790328118; h=from:subject:date:message-id:to:mime-version: content-transfer-encoding; bh=rUpTAiUFTz5g7MUzJQZkS+4uTl5KX3edBcn/akYHw7U=; b=Dh/jqwsNVrdgk7DvRIdr8MeYhnn5ha7/l5cclLw3d0UJfNUhbj9p1baRQnc40/cVcTKqGD WNM+rn8J2Bii94hNSyOw8Wo5eF7JgHb7KDob3T2IXG1foD4yDhRx4UiobqNbApLWWw3as6 SAmh+fEBROeuV/cG+g1xEumznJ9VfWxvoBAq7YQGP5eZx7ogXkwmQjB/xoyvESd9hzK/DY iSAWi+TH3m/6UdSxxU4+IPZbVRk/z7uUH1tZ8vYqaUk1IjwcwZaDbYTP3YCtmblT2AP8se e1R1hQBuTNlTrEyI1dFkTgmSeAm09e1k/T5MHdtDxHknDMsTduSmGYzNTnfNoA== From: Michal Fox To: pve-devel@lists.proxmox.com Subject: [PATCH access-control] fix #8053: auth: accept "0" as password for pam and pve realms Date: Fri, 25 Sep 2026 09:21:57 +0000 Message-ID: <20260925092157.7-1-me@dualfroz.com> X-Mailer: git-send-email 2.47.3 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Last-TLS-Session-Version: TLSv1.3 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.249 Adjusted score from AWL reputation of From: address DKIM_SIGNED 0.1 Message has a DKIM or DK signature, not necessarily valid DKIM_VALID -0.1 Message has at least one valid DKIM or DK signature DKIM_VALID_AU -0.1 Message has a valid DKIM or DK signature from author's domain DKIM_VALID_EF -0.1 Message has a valid DKIM or DK signature from envelope-from domain DMARC_PASS -0.1 DMARC pass policy SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: SYRQ2XFE2EU7ULWSFSQNYFVKWUSKUCR3 X-Message-ID-Hash: SYRQ2XFE2EU7ULWSFSQNYFVKWUSKUCR3 X-MailFrom: me@dualfroz.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Both plugins rejected the password with a plain boolean check, and in Perl the string "0" is false. So a user whose password is "0" could never log in, getting a generic authentication failure. Only reject undefined or empty passwords. Signed-off-by: Michal Fox --- src/PVE/Auth/PAM.pm | 2 +- src/PVE/Auth/PVE.pm | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/PVE/Auth/PAM.pm b/src/PVE/Auth/PAM.pm index 8586da5..11750c5 100755 --- a/src/PVE/Auth/PAM.pm +++ b/src/PVE/Auth/PAM.pm @@ -25,7 +25,7 @@ sub authenticate_user { my ($class, $config, $realm, $username, $password) = @_; # user (www-data) need to be able to read /etc/passwd /etc/shadow - die "no password\n" if !$password; + die "no password\n" if !defined($password) || $password eq ''; # PAM modules may temporarily override $SIG{CHLD}, causing SIGCHLDs from # RESTEnvironment workers to be lost. Running the PAM interaction in a fork diff --git a/src/PVE/Auth/PVE.pm b/src/PVE/Auth/PVE.pm index ab439a8..ca0fae7 100755 --- a/src/PVE/Auth/PVE.pm +++ b/src/PVE/Auth/PVE.pm @@ -73,7 +73,7 @@ sub options { sub authenticate_user { my ($class, $config, $realm, $username, $password) = @_; - die "no password\n" if !$password; + die "no password\n" if !defined($password) || $password eq ''; my $shadow_cfg = cfs_read_file($shadowconfigfile); -- 2.43.0