OMG Can't believe this, I ran into this exact thing at my last job. We discovered a security vuln in several of our services because we were accepting unsanitized usernames, but since we and doing things with them (passing them to scripts etc.) but only after passing them to useradd/usermod etc so we thought they were safe, and of course you could put in things like ";" and "&", ">" etc and do whatever you want. I discovered that debian DISABLED the username sanity checks and could not believe it. anyway I installed a patched version as well as sanitized input and other stuff to resolve the issue.