- (dtucker) [auth.c] Check for disabled password expiry on HP-UX Trusted Mode.

2 files changed, 13 insertions, 3 deletions

diff --git a/ChangeLog b/ChangeLog
index 9f5f81f1..e8ca4cac 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,6 @@
+20031015
+ - (dtucker) [auth.c] Check for disabled password expiry on HP-UX Trusted Mode.
+
 20031009
  - (dtucker) [sshd_config.5] UsePAM defaults to "no".  ok djm@
 
@@ -1237,4 +1240,4 @@
  - Fix sshd BindAddress and -b options for systems using fake-getaddrinfo.
    Report from murple@murple.net, diagnosis from dtucker@zip.com.au
 
-$Id: ChangeLog,v 1.2994.2.48 2003/10/09 04:16:47 dtucker Exp $
+$Id: ChangeLog,v 1.2994.2.49 2003/10/15 07:47:43 dtucker Exp $
diff --git a/auth.c b/auth.c
index 46e495ad..f6e87ac3 100644
--- a/auth.c
+++ b/auth.c
@@ -90,6 +90,7 @@ allowed_user(struct passwd * pw)
 #ifdef HAS_SHADOW_EXPIRE
 #define	DAY		(24L * 60 * 60) /* 1 day in seconds */
 	if (!options.use_pam && spw != NULL) {
+		int disabled = 0;
 		time_t today;
 
 		today = time(NULL) / DAY;
@@ -106,13 +107,19 @@ allowed_user(struct passwd * pw)
 			return 0;
 		}
 
-		if (spw->sp_lstchg == 0) {
+#if defined(__hpux) && !defined(HAVE_SECUREWARE)
+		if (iscomsec() && spw->sp_min == 0 && spw->sp_max == 0 &&
+		     spw->sp_warn == 0)
+			disabled = 1;   /* Trusted Mode: expiry disabled */
+#endif
+
+		if (!disabled && spw->sp_lstchg == 0) {
 			logit("User %.100s password has expired (root forced)",
 			    pw->pw_name);
 			return 0;
 		}
 
-		if (spw->sp_max != -1 &&
+		if (!disabled && spw->sp_max != -1 &&
 		    today > spw->sp_lstchg + spw->sp_max) {
 			logit("User %.100s password has expired (password aged)",
 			    pw->pw_name);