Bug 5410 - Linux only checks the first 8 characters of password entered
Linux only checks the first 8 characters of password entered
Product: Red Hat Linux
Classification: Retired
Component: passwd (Show other bugs)
All Linux
high Severity medium
: ---
: ---
Assigned To: David Lawrence
: Security
Depends On:
  Show dependency treegraph
Reported: 1999-09-28 00:34 EDT by joel
Modified: 2008-05-01 11:37 EDT (History)
0 users

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 1999-09-28 10:47:52 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description joel 1999-09-28 00:34:25 EDT
Linux doesn't seem to check the full password string entered
against that password database, or only stores the first 8
letters.  If my password was joelwener1010, entering
joelwene, at a telnet, or e-mail password prompt would be
accepted, and I would be logged into the system.  This can
be a security problem especially if the password is meant to
be long in the first place.

Joel Wener
Comment 1 Bill Nottingham 1999-09-28 10:47:59 EDT
Standard unix behavior for crypt() password.

Turning on shadow & md5 passwords will solve this.

Note You need to log in before you can comment on or make changes to this bug.