Subject: Checking for ssh implementation that uses SSH_MSG_USERAUTH_PASSWD_CHANGEREQ

From: [email-masked] (Sheldon Bishov)
Date: Wed, 5 Jan 2005 13:15:27 -0500 (EST)

I'm working to get a client to handle the SSH_MSG_USERAUTH_PASSWD_CHANGEREQ
message for password change on UNIX server, and am checking for 
implementations that support this mechanism. Have tested a few UNIX
implementations, so far none use that message, instead run passwd in a shell
context.  Am starting to check secsh mail archive also.

Thanks in advance.

Sheldon

---

From: Joseph Galbraith <[email-masked]>
Date: Wed, 05 Jan 2005 13:01:43 -0700

> context.  Am starting to check secsh mail archive also.

I'm a little unclear what you are looking for...

If you are looking for a client that handles the
SSH_MSG_USERAUTH_PASSWD_CHANGEREQ, then both our
unix clients and our windows clients do.
(www.vandyke.com)

There is no excuse for a client not handling this message;
and I would consider a client that can't correctly handle
this message out-of-spec.  I'm surprised if you aren't
finding clients that support it.

If you are looking for unix servers that generate this
message, and do the password change, that is a different
story.  I'm not sure you will find one.  The mechanism
for changing a users password varies wildly from one
unix system to another, and isn't always programattically
exposed.

Our windows servers _do_ generate the message as appropraite,
but I don't believe our unix servers do.  (So if you
were looking for something to test a client you are
developing against, the our windows servers might or
might not be an option for you-- if you are developing
a client and need a server to do interop testing with,
contact me privately, off-list.)

Thanks,

Joseph

---

From: Darren Tucker <[email-masked]>
Date: Thu, 06 Jan 2005 08:30:55 +1100

> context.  Am starting to check secsh mail archive also.

I did patches for OpenSSH that did this.  The patch (against OpenSSH 
3.5p1) is still available at the link below.  It should work on AIX and 
platforms using /etc/shadow, but I would not recommend using it in 
production.

I gave up on PASSWD_CHANGEREQ after this patch.  As Joseph pointed out, 
the interface to change a password varies wildly from system to system 
(and rebuilding /etc/shadow like it does seems like a nasty thing to 
do).  The real killer, however, was that to use this for real you would 
also have to support every system's password complexity rules too (eg 
/etc/default/passwd on Solaris) and those vary even more.

http://www.zip.com.au/~dtucker/openssh/openssh-3.5p1-passexpire8.patch

-- 
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4  37C9 C982 80C7 8FF4 FA69
     Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.