topic Re: Security Issue? in Operating System - HP-UX

Security Issue?

Sylvie Vezina — Fri, 06 Jun 2003 16:30:54 GMT

Hi,
(Problem is same with Unix 10.20 and 11.0) I use root id. and my password has 10 digits. But I'm able to connect even thought I entered only 8 first digits??????

Can I apply patch or do something to resolve it?

Thank you

Re: Security Issue?

Victor BERRIDGE — Fri, 06 Jun 2003 16:33:44 GMT

Hi,
Wait and see someone to confirm, but for a compatibility purpose - Only the 8 first characters are taken in account
So all is normal

All the best
Victor

Re: Security Issue?

Hai Nguyen_1 — Fri, 06 Jun 2003 16:37:05 GMT

Please see this thread.

http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0x786f1cc6003bd6118fff0090279cd0f9,00.html

Hai

Re: Security Issue?

Elena Leontieva — Fri, 06 Jun 2003 16:39:05 GMT

Hope this helps:
How can the HP-UX system be configured in that way that users have to use a
password with at least 8 characters?
CONFIGURATION
HP-UX 11.00
PHCO_20334 or later installed
RESOLUTION
With patch PHCO_20334 there was a additional parameter introduced:

MIN_PASSWORD_LENGTH

This parameter can be changed in the /etc/default/security file.

MIN_PASSWORD_LENGTH=8 means that users have to use a password with at least 8
characters. This file can be created on all 11.00 systems not only on trusted
systems. Within 11i the specific part of the manpage looks like this:

On an untrusted system, passwords of non-root users must have at
least six characters. On a trusted system, passwords of all
users must have at least six characters. This restriction on the
password length can be increased to a value larger than six.
Refer to the security(4) manual page for detailed information on
configurable parameters that affect the behavior of this command.
The parameter to select the minimum password length is

MIN_PASSWORD_LENGTH=N

This parameter controls the minimum length of new passwords.
It is not applicable to the root user on a untrusted system.

For untrusted systems N can be any value from 6 to 8.
For trusted systems N can be any value from 6 to 80.

Default value: MIN_PASSWORD_LENGTH=6

Re: Security Issue?

Pete Randall — Fri, 06 Jun 2003 16:41:43 GMT

On a non-trusted HP-UX system, only the first 8 characters are recognised.

Pete