diff -up shadow-4.1.5.1/libmisc/chkname.c.goodname shadow-4.1.5.1/libmisc/chkname.c --- shadow-4.1.5.1/libmisc/chkname.c.goodname 2009-07-13 00:24:45.000000000 +0200 +++ shadow-4.1.5.1/libmisc/chkname.c 2018-04-24 16:32:40.970529916 +0200 @@ -49,25 +49,44 @@ static bool is_valid_name (const char *name) { /* - * User/group names must match [a-z_][a-z0-9_-]*[$] - */ - if (('\0' == *name) || - !((('a' <= *name) && ('z' >= *name)) || ('_' == *name))) { + * User/group names must match gnu e-regex: + * [a-zA-Z0-9_.][a-zA-Z0-9_.-]{0,30}[a-zA-Z0-9_.$-]? + * + * as a non-POSIX, extension, allow "$" as the last char for + * sake of Samba 3.x "add machine script" + * + * Also do not allow fully numeric names or just "." or "..". + */ + int numeric; + + if ('\0' == *name || + ('.' == *name && (('.' == name[1] && '\0' == name[2]) || + '\0' == name[1])) || + !((*name >= 'a' && *name <= 'z') || + (*name >= 'A' && *name <= 'Z') || + (*name >= '0' && *name <= '9') || + *name == '_' || + *name == '.')) { return false; } + numeric = isdigit(*name); + while ('\0' != *++name) { - if (!(( ('a' <= *name) && ('z' >= *name) ) || - ( ('0' <= *name) && ('9' >= *name) ) || - ('_' == *name) || - ('-' == *name) || - ( ('$' == *name) && ('\0' == *(name + 1)) ) + if (!((*name >= 'a' && *name <= 'z') || + (*name >= 'A' && *name <= 'Z') || + (*name >= '0' && *name <= '9') || + *name == '_' || + *name == '.' || + *name == '-' || + (*name == '$' && name[1] == '\0') )) { return false; } + numeric &= isdigit(*name); } - return true; + return !numeric || getenv("SHADOW_ALLOW_ALL_NUMERIC_USER") != NULL; } bool is_valid_user_name (const char *name) diff -up shadow-4.1.5.1/man/groupadd.8.xml.goodname shadow-4.1.5.1/man/groupadd.8.xml --- shadow-4.1.5.1/man/groupadd.8.xml.goodname 2012-05-25 13:45:27.000000000 +0200 +++ shadow-4.1.5.1/man/groupadd.8.xml 2012-09-19 18:43:53.492160653 +0200 @@ -259,10 +259,14 @@ CAVEATS - Groupnames must start with a lower case letter or an underscore, - followed by lower case letters, digits, underscores, or dashes. - They can end with a dollar sign. - In regular expression terms: [a-z_][a-z0-9_-]*[$]? + Groupnames may contain only lower and upper case letters, digits, + underscores, or dashes. They can end with a dollar sign. + + Dashes are not allowed at the beginning of the groupname. + Fully numeric groupnames and groupnames . or .. are + also disallowed. + + In regular expression terms: [a-zA-Z0-9_.][a-zA-Z0-9_.-]*[$]? Groupnames may only be up to &GROUP_NAME_MAX_LENGTH; characters long. diff -up shadow-4.1.5.1/man/useradd.8.xml.goodname shadow-4.1.5.1/man/useradd.8.xml --- shadow-4.1.5.1/man/useradd.8.xml.goodname 2012-05-25 13:45:29.000000000 +0200 +++ shadow-4.1.5.1/man/useradd.8.xml 2012-09-19 18:43:53.493160675 +0200 @@ -366,7 +366,7 @@ - Do no create the user's home directory, even if the system + Do not create the user's home directory, even if the system wide setting from /etc/login.defs () is set to yes. @@ -654,10 +654,16 @@ - Usernames must start with a lower case letter or an underscore, - followed by lower case letters, digits, underscores, or dashes. - They can end with a dollar sign. - In regular expression terms: [a-z_][a-z0-9_-]*[$]? + Usernames may contain only lower and upper case letters, digits, + underscores, or dashes. They can end with a dollar sign. + + Dashes are not allowed at the beginning of the username. + Fully numeric usernames and usernames . or .. are + also disallowed. It is not recommended to use usernames beginning + with . character as their home directories will be hidden in + the ls output. + + In regular expression terms: [a-zA-Z0-9_.][a-zA-Z0-9_.-]*[$]? Usernames may only be up to 32 characters long.