From c27bc66a8cc79ed2985796c7807bbc404544ae86 Mon Sep 17 00:00:00 2001 From: Damien Miller Date: Fri, 30 Oct 2026 19:33:20 +1100 Subject: [PATCH] fix arguable off-by-one in password expiry check Old behaviour was to allow upto and including the expiry day, but this changes it to allow upto but _not_ including which apparently matches some other tools and libraries (e.g. Linux-PAM pam_unix.so). Anthropic ANT-2026-V1VNLWUV --- auth-shadow.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/auth-shadow.c b/auth-shadow.c index 81b31b56e..f9a79e03c 100644 --- a/auth-shadow.c +++ b/auth-shadow.c @@ -44,8 +44,9 @@ extern struct sshbuf *loginmsg; /* - * For the account and password expiration functions, we assume the expiry - * occurs the day after the day specified. + * For the password expiration function, we assume the expiry occurs the + * day after the day specified. An account is expired from the day given + * by sp_expire onward, matching chage(1), login(1) and pam_unix(8). */ /* @@ -66,7 +67,7 @@ auth_shadow_acctexpired(struct spwd *spw) if (spw->sp_expire == -1) { debug3("account expiration disabled"); - } else if (daysleft < 0) { + } else if (daysleft <= 0) { logit("Account %.100s has expired", spw->sp_namp); return 1; } else if (daysleft <= spw->sp_warn) {