topic Re: maximum password length error from tcb when user changes password in Operating System - HP-UX

maximum password length error from tcb when user changes password

Steve Blackwell — Thu, 17 Aug 2006 05:39:14 GMT

All,

I have a rp7410 running 11.11, which is trusted and uses a tcb database.

When a user goes to change his password he gets the following error and the password change does not stick.

ERROR: Failed to update USER huggemr
Password's length exceeds the maximum length defined in tcb

Below is the output from getprpw for that user.

uid=1204, bootpw=NO, audid=24, audflg=1, mintm=-1, maxpwln=-1, exptm=-1, lftm=-1, spwchg=Fri Jul 21 18:27:16 2006, upwchg=-1, acctexp=-1, llog=-1, expwarn=-1, usrpick=DFT, syspnpw=DFT, rstrpw=DFT, nullpw=DFT, admnum=-1, syschpw=DFT, sysltpw=DFT, timeod=-1, slogint=Thu Aug 17 09:27:06 2006, ulogint=Wed Aug 16 12:00:42 2006, sloginy=pts/tq, culogin=-1, uloginy=pts/to, umaxlntr=-1, alock=NO, lockout=0000000

Does anyone have any idea's what the problem is?

Cheers

Steve

Re: maximum password length error from tcb when user changes password

Pete Randall — Thu, 17 Aug 2006 05:45:02 GMT

Steve,

How long a password are they trying to enter? According to the man page:

"Passwords can be greater than eight characters, but it is recommended that they be less than 40 characters. System warnings are displayed if passwords lengths are either too long or short. The system administrator can specify a maximum password length guideline for the system generated options (random syllables, random characters, and random letters). The actual maximum password length depends upon several parameters in the authentication database and in the algorithm."

Pete

Re: maximum password length error from tcb when user changes password

Peter Godron — Thu, 17 Aug 2006 05:47:56 GMT

Steve,
check:
/tcb/files/auth/system/default
and
/tcb/files/auth/h/huggemr

I think the -1 value for maxpwln means 'undefined'

Re: maximum password length error from tcb when user changes password

Jaime Bolanos Rojas. — Thu, 17 Aug 2006 06:41:41 GMT

Steve,

You might want to modify your setting with this command modprdef

Also take a look at this thread for more info:

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=990550&admit=-682735245+1155814780993+28353475

Regards,

Jaime.

Re: maximum password length error from tcb when user changes password

Steve Blackwell — Thu, 17 Aug 2006 09:35:32 GMT

All,

I have been doing some testing and it seems the problem is with the parameter u_maxlen in the /tcb/files/auth/system/default file.

As I understand it this parameter relates to the system generated passwords and not the user defined password.

But anyway if I set the value of this parameter to anything above 8 then the error message goes away and the user can set his password.

Cheers

Steve

Re: maximum password length error from tcb when user changes password

Steven E. Protter — Thu, 17 Aug 2006 10:05:34 GMT

Shalom,

Perhaps a conflict with /etc/default/security

SEP

Re: maximum password length error from tcb when user changes password

John Kittel — Thu, 17 Aug 2006 18:21:08 GMT

FWIW: I think you have mostly solved your own mystery. You're almost correct about u_maxlen. Your users won't be able to set passwords longer than this value. But see man prpwd for explanation of u_maxlen. The way I read it, it is max length of passwords, regardless of how generated, not (just) of system generated passwords. What caused you to think it was only for system generated passwords?