It seems that when using a pound sign in the middle of a
password, the password effectively terminates over there.
One can logon with the any password containing in its
initial part the password up to and including the pound
sign, followed by any other string.
This is a high security risk! Pam password checking seems to
look at the whole password, it is just the authetication
part that doesn't seem to work right
Actually, usin a $ sign gives rise to the same problem!
(i.e. setting password to FFFFF$GGGGG allows su using FFFFF$ as
I have found the solution to my passwd problem: on upgrade to rh6.0
my /etc/pam.d/passwd file was written incorrectly. Copying one from
a fresh install solved the problem. So a warning to all of you: when
upgrading change the last line of the file to
password required /lib/security/pam_pwdb.so use_authtok nullok
md5 shadowon further checking this seems to be due to a problem with systems
upgraded to 6.0 only - freshly installed systems don't have trhe
problem. The length of the stored passwords in the /etc/shadow files
on the upgraded systems is much smaller than those on the freshly
installed one. It seems that the symbol issue is moot, it is just a
length issue around 8 characters of the password are used, the rest
Simply running the authconfig program will allow you to
select md5 passwords on an upgraded system. We do not change
the default on old systems in order to manage backwards compatibility