Bug 4979 - problems with non-us ascii in passwords
problems with non-us ascii in passwords
Product: Red Hat Linux
Classification: Retired
Component: passwd (Show other bugs)
i386 Linux
medium Severity medium
: ---
: ---
Assigned To: David Lawrence
: Security
Depends On:
  Show dependency treegraph
Reported: 1999-09-08 05:36 EDT by Niels Walet
Modified: 2008-05-01 11:37 EDT (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 1999-09-20 13:56:53 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Niels Walet 1999-09-08 05:36:21 EDT
It seems that when using a pound sign in the middle of a
password, the password effectively terminates over there.
One can logon with the any password containing in its
initial part the password up to and including the pound
sign, followed by any other string.
This is a high security risk! Pam password checking seems to
look at the whole password, it is just the authetication
part that doesn't seem to work right
Comment 1 Niels Walet 1999-09-08 05:41:59 EDT
Actually, usin a $ sign gives rise to the same problem!
(i.e. setting password to FFFFF$GGGGG allows su using FFFFF$ as
Comment 2 Niels Walet 1999-09-08 06:42:59 EDT
I have found the solution to my passwd problem: on upgrade to rh6.0
my /etc/pam.d/passwd file was written incorrectly. Copying one from
a fresh install solved the problem. So a warning to all of you: when
upgrading change the last line of the file to
password   required     /lib/security/pam_pwdb.so use_authtok nullok
md5 shadowon further checking this seems to be due to a problem with systems
upgraded to 6.0 only - freshly installed systems don't have trhe
problem. The length of the stored passwords in the /etc/shadow files
on the upgraded systems is much smaller than those on the freshly
installed one. It seems that the symbol issue is moot, it is just a
length issue around 8 characters of the password are used, the rest
are ignored!
Comment 3 Michael K. Johnson 1999-09-20 13:56:59 EDT
Simply running the authconfig program will allow you to
select md5 passwords on an upgraded system.  We do not change
the default on old systems in order to manage backwards compatibility

Note You need to log in before you can comment on or make changes to this bug.