topic Re: Password problems in Operating System - HP-UX

Password problems

Matt Rieman — Tue, 22 Jul 2003 16:25:14 GMT

Hi,

After converting our HP-UX 11.00 system to a Trusted System, and having our users change their passwords, the system allows users with more complex passwords (for example, J0shu@T@y10r) to only login once. When they logoff, then try to log back on, they get an "incorrect login" error message.

When I reset their password to something more simple (for example, eaton1) it works fine. We are using the default password and account security settings. What is causing this? Any help would be greatly appreciated.

Thanks,

Matt

Re: Password problems

Steven E. Protter — Tue, 22 Jul 2003 16:27:35 GMT

There are still certain special characters that should not be used in passwords. Tell the users to stop doing that.

Also as a backup if the long password doesn't work, try the first 8 characters.

SEP

Re: Password problems

Matt Rieman — Tue, 22 Jul 2003 16:33:10 GMT

Thanks, any idea exactly which characters shouldn't be used, or where I can get a list?

Re: Password problems

James R. Ferguson — Tue, 22 Jul 2003 16:35:43 GMT

Hi Matt:

The characters to avoid are those listed in the 'getty' man pages, notably:

#, @, /, !, _, backspace, ^U, ^D, or &

Regards!

...JRF...

Re: Password problems

Martin Johnson — Tue, 22 Jul 2003 16:41:52 GMT

There are at least 2 special characters that I know of that should not be used in a password:

# = Erases the previous character
@ = Erases the whole line

There may be others, but I know of these 2.

HTH
Marty

Re: Password problems

Jeff Schussele — Tue, 22 Jul 2003 16:51:21 GMT

Hi Matt,

Well for sure any chars that have meaning to the tty driver - such as @ # \ ^ etc.

If you do an
stty -a
you'll see what chars have special meaning to tty. Definitely don't use those even though they may be chars as some term definitions don't use the - just the char.

Also look at /tcb/files/auth/system/default file & note the entry for u_maxlen (default is 10) or go into SAM -> Auditing & Security -> System Security Policies -> Password Format Policies & note the max PW length.
Then inform the users to NOT exceed the length.
The system will only encrypt that number of chars when the user enters the PW, but will interpret ALL the chars when they enter it for decryption & that can throw off the result & cause a PW mismatch.

HTH,
Jeff