Red Hat Bugzilla – Bug 4979
problems with non-us ascii in passwords
Last modified: 2008-05-01 11:37:51 EDT
It seems that when using a pound sign in the middle of a password, the password effectively terminates over there. One can logon with the any password containing in its initial part the password up to and including the pound sign, followed by any other string. This is a high security risk! Pam password checking seems to look at the whole password, it is just the authetication part that doesn't seem to work right
Actually, usin a $ sign gives rise to the same problem! (i.e. setting password to FFFFF$GGGGG allows su using FFFFF$ as password!)
I have found the solution to my passwd problem: on upgrade to rh6.0 my /etc/pam.d/passwd file was written incorrectly. Copying one from a fresh install solved the problem. So a warning to all of you: when upgrading change the last line of the file to password required /lib/security/pam_pwdb.so use_authtok nullok md5 shadowon further checking this seems to be due to a problem with systems upgraded to 6.0 only - freshly installed systems don't have trhe problem. The length of the stored passwords in the /etc/shadow files on the upgraded systems is much smaller than those on the freshly installed one. It seems that the symbol issue is moot, it is just a length issue around 8 characters of the password are used, the rest are ignored!
Simply running the authconfig program will allow you to select md5 passwords on an upgraded system. We do not change the default on old systems in order to manage backwards compatibility correctly.