From be2ac1d1b164ad716c7ba3fe0bfe81dbf5991235 Mon Sep 17 00:00:00 2001
From: Joachim Wiberg <troglobit@gmail.com>
Date: Sun, 25 Apr 2021 21:43:39 +0200
Subject: [PATCH] sulogin: handle no password and locked account (treated as no
 pwd)

This patch does two things:

 1. A system with a root account that has no password is now
    allowed to login without password, as one expects.
 2. A systems with a locked root account, is treated as (1).

The latter of the two may very well turn out to be a really bad idea.
Much angst have been poured into it, yet the end decision is to allow
access.

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
---
 src/sulogin.c | 23 ++++++++++++++++++-----
 1 file changed, 18 insertions(+), 5 deletions(-)

diff --git a/src/sulogin.c b/src/sulogin.c
index 9094ccd6..d5629505 100644
--- a/src/sulogin.c
+++ b/src/sulogin.c
@@ -56,7 +56,8 @@ static int get_passwd(struct passwd *pw)
 		if (!ptr)
 			break;
 
-		if (strlen(ptr) > 1)
+		/* x : password in /etc/shadow, see passwd(5) */
+		if (ptr[0] != 'x')
 			pw->pw_passwd = strdup(ptr);
 
 		break;			/* done, check it */
@@ -131,9 +132,20 @@ int main(void)
 	if (get_passwd(&pw))
 		err(1, "reading credentials for UID 0");
 
-	/* is login disabled, not much we can do */
-	if (strlen(pw.pw_passwd) == 1)
-		goto done;		/* likely one of: "x!*" */
+	switch (pw.pw_passwd[0]) {
+	case '*': case '!':	/* login disabled, allow */
+		printf("The %s account is locked, allowing entry.\n", pw.pw_name);
+		/* fallthrough */
+	case 0:			/* no password at all? */
+		printf("Press enter for maintenance.");
+		getchar();
+		goto nopass;
+
+	case '$': /* md5/shaN or similar, original DES not supported */
+		break;
+	default:
+		break;
+	}
 
 	if (tcgetattr(1, &old) < 0)
 		goto done;		/* failed reading tty */
@@ -153,7 +165,7 @@ int main(void)
 		size_t i = 0;
 		char *passwd;
 
-		printf("Give %s password for maintenance: ", pw.pw_name);
+		printf("Give %s password for maintenance (Ctrl-D to continue): ", pw.pw_name);
 		do {
 			int ch;
 
@@ -171,6 +183,7 @@ int main(void)
 		passwd = crypt(pwd, pw.pw_passwd);
 		if (passwd && !strcmp(passwd, pw.pw_passwd)) {
 			tcsetattr(1, TCSANOW, &old);	/* restore tty */
+		nopass:
 			freepw(&pw);
 
 			return sh();