[Bug 1927078] Re: Don't allow useradd to use fully numeric names

Wed Jul 21 16:48:52 UTC 2021

The verification passed for hirsute.

jawn-smith at lvm:~$ apt-cache policy passwd
passwd:
  Installed: 1:4.8.1-1ubuntu8
  Candidate: 1:4.8.1-1ubuntu8.1
  Version table:
     1:4.8.1-1ubuntu8.1 500
        500 http://us.archive.ubuntu.com/ubuntu hirsute-proposed/main amd64 Packages
 *** 1:4.8.1-1ubuntu8 500
        500 http://us.archive.ubuntu.com/ubuntu hirsute/main amd64 Packages
        100 /var/lib/dpkg/status
jawn-smith at lvm:~$ sudo useradd 123
jawn-smith at lvm:~$ grep "^123" /etc/passwd
123:x:1001:1001::/home/123:/bin/sh
jawn-smith at lvm:~$ sudo userdel 123
jawn-smith at lvm:~$ sudo apt install passwd
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
The following packages will be upgraded:
  passwd
1 upgraded, 0 newly installed, 0 to remove and 45 not upgraded.
Need to get 793 kB of archives.
After this operation, 298 kB disk space will be freed.
Get:1 http://us.archive.ubuntu.com/ubuntu hirsute-proposed/main amd64 passwd amd64 1:4.8.1-1ubuntu8.1 [793 kB]
Fetched 793 kB in 0s (1,711 kB/s)
(Reading database ... 188906 files and directories currently installed.)
Preparing to unpack .../passwd_1%3a4.8.1-1ubuntu8.1_amd64.deb ...
Unpacking passwd (1:4.8.1-1ubuntu8.1) over (1:4.8.1-1ubuntu8) ...
Setting up passwd (1:4.8.1-1ubuntu8.1) ...
Processing triggers for man-db (2.9.4-2) ...
jawn-smith at lvm:~$ useradd 123
useradd: invalid user name '123'
jawn-smith at lvm:~$ grep "^123" /etc/passwd
jawn-smith at lvm:~$

** Tags removed: verification-needed-hirsute
** Tags added: verification-done-hirsute

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to shadow in Ubuntu.
https://bugs.launchpad.net/bugs/1927078

Title:
  Don't allow useradd to use fully numeric names

Status in shadow package in Ubuntu:
  Fix Released
Status in shadow source package in Focal:
  Fix Committed
Status in shadow source package in Groovy:
  Won't Fix
Status in shadow source package in Hirsute:
  Fix Committed
Status in shadow source package in Impish:
  Fix Released

Bug description:
  [Impact]

   * If a fully numeric username is created, it will cause
     problems with systemd. One example is that the user with
     this type of name can log in, but loginctl will not create
     a session for them.
   * This can also cause users to be unable to log in to a gdm
     environment

  [Test Case]

   * `useradd 123` (this command should succeed)
   * `userdel 123` to clean up the user that was just added
   * Install `shadow` from -proposed
   * `useradd 123` should now fail

  [Regression Potential]
   * If there were a logic error in the fix, it is possible
     that valid usernames would now be disallowed.
   * Many test cases have been added to ensure this is not
     the case, and --badnames would still provide a work-around
   * [racb] Users may have scripts that are currently using numeric usernames and these scripts will break as a consequence of this deliberate change in stable Ubuntu releases. However, based on the discussion in the bug, we think this is preferable to leaving such users with unstable behaviour such as systemd's behaviour described.

  [Original Description]

  Fully numeric names support in Ubuntu is inconsistent in Focal onwards
  because systemd does not like them[1] but are still allowed by default
  by useradd, leaving the session behavior in hands of the running
  applications. Two examples:

  1. After creating a user named "0", the user can log in via ssh or
  console but loginctl won't create a session for it:

  root at focal:/home/ubuntu# useradd -m 0
  root at focal:/home/ubuntu# id 0
  uid=1005(0) gid=1005(0) groups=1005(0)

  ..

  0 at 192.168.122.6's password:
  Welcome to Ubuntu 20.04.2 LTS (GNU/Linux 5.8.0-48-generic x86_64)

  Last login: Thu Apr  8 16:17:06 2021 from 192.168.122.1
  $ loginctl
  No sessions.
  $ w
   16:20:09 up 4 min,  1 user,  load average: 0.03, 0.14, 0.08
  USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
  0        pts/0    192.168.122.1    16:17    0.00s  0.00s  0.00s w

  And pam-systemd shows the following message:

  Apr 08 16:17:06 focal sshd[1584]: pam_unix(sshd:session): session opened for user 0 by (uid=0)
  Apr 08 16:17:06 focal sshd[1584]: pam_systemd(sshd:session): pam-systemd initializing
  Apr 08 16:17:06 focal sshd[1584]: pam_systemd(sshd:session): Failed to get user record: Invalid argument

  2. With that same username, every successful authentication in gdm
  will loop back to gdm again instead of starting gnome, making the user
  unable to login.

  Making useradd fail (unless --badnames is set) when a fully numeric
  name is used will make the default OS behavior consistent.

  [Other info]

  - Upstream does not support fully numeric usernames
  - useradd has a --badnames parameter that would still allow the use of these type of names

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/shadow/+bug/1927078/+subscriptions