RE: SCO OpenServer 5.0.5 authenticates locked accounts

This older version of SCO doesn't support PAM.

However, I was able to finally get this working. Basically the issue was
that the configure.ac file had defined DISABLE_SHADOW, but we are indeed
using shadow passwords. I caught this early on but if I removed this
definition I could never get ssh to compile due to errors in xcrypt.c.

Finally, I added the following two lines to the top of auth.c, leaving
the DISABLE_SHADOW definition in place in configure.ac.

#define USE_SHADOW
#define LOCKED_PASSWD_PREFIX "*LK*"

Locked accounts are now getting receiving permission denied which is
expected.

-----Original Message-----
From: Venkatachalam, Saravanakumar [mailto:saravan@ti.com] 
Sent: Wednesday, April 19, 2006 12:58 AM
To: Powell, Scott
Cc: secureshell@securityfocus.com
Subject: Re: SCO OpenServer 5.0.5 authenticates locked accounts

Scott,

How about using PAM ? I'm not sure if SCO OpenServer 5.0.5 has PAM
support.

regards,
saravan
Powell, Scott wrote:
> I have noticed that SSH compiled for SCO OpenServer 5.0.5 is
> authenticating locked accounts. I have tried re-compiling the latest
> portable version, 4.3p2, as well as some older versions. I also tried
a
> Skunkware version supplied by SCO. All of these are authenticating
> locked accounts. I even messed around in configure.ac and added
> AC_DEFINE(LOCKED_PASSWD_STRING, "*LK*") to the *-*-sco3.2v5*
definitions
> (locked accounts have a *LK* in the shadow file as a prefix to the
> encrypted password hash.
>
> Does anyone have any recommendations or workarounds?
>
> Thanks,
> Scott
>
>