topic Re: Password Length in Operating System - HP-UX

Password Length

Dirk Moolman — Fri, 11 Aug 2006 10:27:12 GMT

I also have another question regarding passwords on my version B10:20.

Some of my accounts have short passwords (5 characters, alphabetic only. When I try to change the passwords, I am not allowed to use 5 characters any longer. How can I force the use of 5 characters - how did the previous admin do this ?

Dirk

Re: Password Length

Pete Randall — Fri, 11 Aug 2006 10:31:37 GMT

The root use can make the password change and use any length he wants.

Pete

Re: Password Length

AndyMueller — Fri, 11 Aug 2006 10:34:16 GMT

Dirk,

why not just go with a bit more system security and use 8 alphanumeric and numeric numbers? Seems anymore, you can't make a system secure enough. Is this system running in trusted mode?

Andy

Re: Password Length

Dirk Moolman — Fri, 11 Aug 2006 10:41:58 GMT

I am logging in as root, but I am still not allowed to create 5 character passwords, which is strange to me.

I do not want to give away too much detail about my system, for security reasons, but we have cases unfortunately where we need the 5 char passwords.

I also do not know if the system is trusted or not. I had a look under /tcb, but I don't know what to look for, and cannot tell if the system is trusted or not.

Re: Password Length

AndyMueller — Fri, 11 Aug 2006 10:49:17 GMT

run: /usr/lbin/getprpw and it will tell you if the system is trusted or not.

Re: Password Length

Dirk Moolman — Fri, 11 Aug 2006 10:52:25 GMT

Nope, mine is not - thanks

Re: Password Length

AndyMueller — Fri, 11 Aug 2006 10:57:38 GMT

Dirk, man passwd, your answer might be with MIN_PASSWORD_LENGTH variable

On an untrusted system, only the first eight characters of a password are significant.

+ On an untrusted system, passwords of non-root users must have at
least six characters. On a trusted system, passwords of all users must have at least six characters. This restriction on the
password length can be increased to a value larger than six. Refer to the security(4) manual page for detailed information on
configurable parameters that affect the behavior of this command.
The parameter to select the minimum password length is MIN_PASSWORD_LENGTH

Re: Password Length

Dirk Moolman — Fri, 11 Aug 2006 11:09:53 GMT

My apologies for asking so many questions, I just have a lot to do in a very short time (work overload) -

the man page says:
"The minimum password length depends on several parameters that the system administrator sets in the authentication databases."

Where can I read more about the authentication of passwords, and the authentication databases ?

Re: Password Length

Dirk Moolman — Fri, 11 Aug 2006 11:12:33 GMT

PS. I do not have any system administration documentation - is there a URL where I can download pdf versions of the HP manuals ?

Any help appreciated

Re: Password Length

Pete Randall — Fri, 11 Aug 2006 11:13:35 GMT

In a non-trusted system, the only "authentication database" that I'm aware of is /etc/default/security. Check there for MIN_PASSWORD_LENGTH and do a man on security.

Pete

Re: Password Length

AndyMueller — Fri, 11 Aug 2006 11:13:37 GMT

Dirk,

try a : man security
somewhere there appears to be a place where you can set the password lenght, I'm just not sure where.
/etc/default/security maybe?

Re: Password Length

Patrick Wallek — Fri, 11 Aug 2006 11:24:18 GMT

Dirk,

For documentation:

http://docs.hp.com/

For HP-UX 10.20 specific docs:

http://docs.hp.com/en/oshpux10.x.html

A lot of the docs are available in either HTML or PDF format.

Re: Password Length

Sp4admin — Fri, 11 Aug 2006 17:10:42 GMT

Hi Dirk,

Like Pete said. use the /etc/default/security file.
PASSWORD_MIN_UPPER_CASE_CHARS=2
PASSWORD_MIN_LOWER_CASE_CHARS=2
PASSWORD_MIN_DIGIT_CHARS=2
PASSWORD_MIN_SPECIAL_CHARS=2
PASSWORD_HISTORY_DEPTH=10
MIN_PASSWORD_LENGTH=9

sp,

Re: Password Length

Bill Hassell — Fri, 11 Aug 2006 18:37:30 GMT

All the manuals for HP-UX are located at:

docs.hp.com

NOTE: version 10.20 has been obsolete and unsupported since 2001 so many of the manuals will have details that do not apply to your old software. The /etc/default/security file will have no effect at all unless you have applied all the security patches for 10.20. Now your system is trusted IF there is a /tcb directory -- if not, then you have a standard system. Root should be able to change any user's password to 5 characters -- the previous admin may have created a script that uses usermod.sam or something similar. What error message do you get when you type:

passwd userlogin

Also, does your site use an NIS server for centralized passwords?

Re: Password Length

doug hosking — Fri, 11 Aug 2006 19:22:12 GMT

The submitter indicated that the systems were running 10.20. /etc/default/security did not exist until after 11.00 shipped. (It was first created in the August, 1998 release of 11.00 to control variables related to the password history mechanism.) I don't believe those changes were ever backported to 10.20 systems, though 10.20 has been out of support for so long that it's mostly irrelevant now.

Generally speaking, the design philosophy has been to not force restrictions like this upon superusers, since they could always bypass them by using vi directly on the passwd file or other configuration files, and are more likely to break something by doing so.

Re: Password Length

Dirk Moolman — Mon, 14 Aug 2006 02:57:16 GMT

Thank you everyone for the replies, I do appreciate it.
I also assumed that this was an old version of HP, when I read the man pages which were very limited.

I will download the documentation, and read up about this version a bit. And I think Doug is right - I do not have the file /etc/default/security on this system.

Thanks again

Re: Password Length

Dirk Moolman — Mon, 14 Aug 2006 08:35:12 GMT

My apologies, this is actually a trusted system. I downloaded most of the 10.x documentation, and now understand the /tcb/files/auth structure

Re: Password Length

Dirk Moolman — Mon, 14 Aug 2006 10:03:18 GMT

Info I found (also not available on my version):

o MIN_PASSWORD_LENGTH
(introduced in 11.00 via PHCO_24390)