Index: shadow-4.5/libmisc/chkname.c

===================================================================

--- shadow-4.5.orig/libmisc/chkname.c

+++ shadow-4.5/libmisc/chkname.c

@@ -47,27 +47,46 @@

 #include "chkname.h"

 static bool is_valid_name (const char *name)

-{

+{      

 	/*

-	 * User/group names must match [a-z_][a-z0-9_-]*[$]

-	 */

-	if (('\0' == *name) ||

-	    !((('a' <= *name) && ('z' >= *name)) || ('_' == *name))) {

+         * User/group names must match gnu e-regex:

+         *    [a-zA-Z0-9_.][a-zA-Z0-9_.-]{0,30}[a-zA-Z0-9_.$-]?

+         *

+         * as a non-POSIX, extension, allow "$" as the last char for

+         * sake of Samba 3.x "add machine script"

+         *

+         * Also do not allow fully numeric names or just "." or "..".

+         */

+	int numeric;

+

+	if ('\0' == *name ||

+	    ('.' == *name && (('.' == name[1] && '\0' == name[2]) ||

+			      '\0' == name[1])) ||

+	    !((*name >= 'a' && *name <= 'z') ||

+	      (*name >= 'A' && *name <= 'Z') ||

+	      (*name >= '0' && *name <= '9') ||

+	      *name == '_' ||

+	      *name == '.')) {

 		return false;

 	}

+	numeric = isdigit(*name);

+

 	while ('\0' != *++name) {

-		if (!(( ('a' <= *name) && ('z' >= *name) ) ||

-		      ( ('0' <= *name) && ('9' >= *name) ) ||

-		      ('_' == *name) ||

-		      ('-' == *name) ||

-		      ( ('$' == *name) && ('\0' == *(name + 1)) )

+		if (!((*name >= 'a' && *name <= 'z') ||

+		      (*name >= 'A' && *name <= 'Z') ||

+		      (*name >= '0' && *name <= '9') ||

+		      *name == '_' ||

+		      *name == '.' ||

+		      *name == '-' ||

+		      (*name == '$' && name[1] == '\0')

 		     )) {

 			return false;

 		}

+		numeric &= isdigit(*name);

 	}

-	return true;

+	return !numeric || getenv("SHADOW_ALLOW_ALL_NUMERIC_USER") != NULL;

 }

 bool is_valid_user_name (const char *name)

Index: shadow-4.5/man/groupadd.8.xml

===================================================================

--- shadow-4.5.orig/man/groupadd.8.xml

+++ shadow-4.5/man/groupadd.8.xml

@@ -256,10 +256,14 @@

    <refsect1 id='caveats'>

      <title>CAVEATS</title>

      <para>

-       Groupnames must start with a lower case letter or an underscore,

-       followed by lower case letters, digits, underscores, or dashes.

-       They can end with a dollar sign.

-       In regular expression terms: [a-z_][a-z0-9_-]*[$]?

+       Groupnames may contain only lower and upper case letters, digits,

+       underscores, or dashes. They can end with a dollar sign.

+

+       Dashes are not allowed at the beginning of the groupname.

+       Fully numeric groupnames and groupnames . or .. are

+       also disallowed.

+

+       In regular expression terms: [a-zA-Z0-9_.][a-zA-Z0-9_.-]*[$]?

      </para>

      <para>

        Groupnames may only be up to &GROUP_NAME_MAX_LENGTH; characters long.

Index: shadow-4.5/man/useradd.8.xml

===================================================================

--- shadow-4.5.orig/man/useradd.8.xml

+++ shadow-4.5/man/useradd.8.xml

@@ -633,10 +633,16 @@

     </para>

     <para>

-      Usernames must start with a lower case letter or an underscore,

-      followed by lower case letters, digits, underscores, or dashes.

-      They can end with a dollar sign.

-      In regular expression terms: [a-z_][a-z0-9_-]*[$]?

+      Usernames may contain only lower and upper case letters, digits,

+      underscores, or dashes. They can end with a dollar sign.

+

+      Dashes are not allowed at the beginning of the username.

+      Fully numeric usernames and usernames . or .. are

+      also disallowed. It is not recommended to use usernames beginning

+      with . character as their home directories will be hidden in

+      the <command>ls</command> output.

+

+      In regular expression terms: [a-zA-Z0-9_.][a-zA-Z0-9_.-]*[$]?

     </para>

     <para>

       Usernames may only be up to 32 characters long.