Bug 5410

Summary: Linux only checks the first 8 characters of password entered
Product: [Retired] Red Hat Linux Reporter: joel
Component: passwdAssignee: David Lawrence <dkl>
Status: CLOSED NOTABUG QA Contact:
Severity: medium Docs Contact:
Priority: high    
Version: 6.0Keywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 1999-09-28 14:47:52 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description joel 1999-09-28 04:34:25 UTC 
Linux doesn't seem to check the full password string entered
against that password database, or only stores the first 8
letters.  If my password was joelwener1010, entering
joelwene, at a telnet, or e-mail password prompt would be
accepted, and I would be logged into the system.  This can
be a security problem especially if the password is meant to
be long in the first place.

Joel Wener
Comment 1 Bill Nottingham 1999-09-28 14:47:59 UTC 
Standard unix behavior for crypt() password.

Turning on shadow & md5 passwords will solve this.