[Pkg-shadow-devel] Bug#495831: Bug#495831: Entering non-existant username at login prompt causes error message

[Christian Perrier]

Quoting Tim Rørstrøm (timroerstroem at gmail.com):
> Package: login
> Version: 1:4.1.1-3
> Severity: grave
> Tags: security
> Justification: user security hole
> 
> At the console login prompt, entering a username which does not exist on the system, will immediately show an error message, thus revealing that the username is in fact non-existant on the system. This dramatically reduces the time it would take to brute-force your way into a user's account.


Could you please send the content of /etc/pam.d/login ?

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 197 bytes
Desc: Digital signature
Url : http://lists.alioth.debian.org/pipermail/pkg-shadow-devel/attachments/20080821/522277fd/attachment.pgp