topic SAM generated a profane password in Operating System - HP-UX

SAM generated a profane password

MidRange Support — Wed, 18 Oct 2006 14:42:00 GMT

Has anyone encountered a situation where SAM generates a profane user password? Our Service Desk performs user account enables and password resets daily. They have reported that several times over the past 6-8 months, SAM has created a profane user password.

This is the text that came up during the last occurance:

Note (hostname)
The new password for user "c998ax01" is: sh*tdump. The user must enter this password when loggin in the next time.

Note: If you reset the user password, the user is given a temporary password. Not all security policies, such as "minimum password length" and "password history", apply to these passwords, so the user should login as soon as possible and change the password.
[ OK ]

Is there any way to update/fix this issue or has this been encountered/reported by any other user or group using HP-UX 11.x. We are using HP-UX 11.11 in a trusted environment. Any suggestions or thoughts on the issue would be appreciated.

Thanks.

Re: SAM generated a profane password

spex — Wed, 18 Oct 2006 14:50:55 GMT

I think someone at your Service Desk has too much free time on his/her hands.

PCS

Re: SAM generated a profane password

Peter Godron — Thu, 19 Oct 2006 02:23:31 GMT

HI,
I would suggest you get the security policies changed, so that the passwords are system generated or selected from a list by the user.

Re: SAM generated a profane password

Darren Prior — Thu, 19 Oct 2006 04:29:04 GMT

Hi,

I would imagine that SAM bolts 2 dictionary words together to create the initial password. These would be individually checked against the spell(1) command, so this suggests that someone has manually added the words to your dictionary as they don't appear on a couple of systems that I've looked at.

Try typing:

echo house | spell
This should return a prompt as house is in the dictionary. Now try:

echo dgdgdhs | spell
which should return:
dgdgdhs
as it is not in the dictionary. Now try:

echo sh*t | spell (obviously the full word, not with the *)
If it returns the word, then it's been added to your dictionary and I would investigate that further.

regards,

Darren.