topic Re: hpux ftp allows incorrect password in Operating System - HP-UX

hpux ftp allows incorrect password

jesc516 — Tue, 27 Oct 2015 20:05:22 GMT

hello,

i created a group called ftpgroup with one user; ftpuser. i set the default shell for ftpuser in /etc/passwd to /usr/bin/false after creating the file /etc/shells.

i set the password using passwd ftpuser.

i typed in the wrong password in a script i have to downfile a file and modify it and i was able to login. after a few login tests i came to realize that only the first 9 characters of the password are being validated. meaning if the first 9 characters are correct i can type in anything else after and it allows me to login.

the password format is xxxx xxxx xxxx but as long as i type in xxxx xxxx im allowed to login. i can type in xxxx xxxxabcdefgh123 and im allowed to login. the password is a 3 word format with spaces in between. why does this occur?

Re: HP-UX ftp truncates password to 8 chars

Dennis Handly — Wed, 28 Oct 2015 00:58:38 GMT

> I realized that only the first 9 characters of the password are being validated.

The standard passwords are only up to 8 chars long. Not sure how you got 9?

http://h30499.www3.hp.com/t5/tag/long%20passwords/tg-p

http://h30499.www3.hp.com/t5/Security/How-does-one-enable-long-password-on-HP-UX-11-31/m-p/6365595

Re: hpux ftp allows incorrect password

Bill Hassell — Wed, 28 Oct 2015 01:24:37 GMT

>> i set the password using passwd ftpuser.

Standard security is hard limited to 8 characters. The passwd command allows you to set any passwd length but silently throws away everything you typed in after the 8th character. Similalrly, when you login with a long password, everything after 8 characters is silently ignored.

This has been the case for more than 30 years and one of the many reasons to switch to a Trusted System or Shadow Password or other security level for HP-UX.

Re: HP-UX ftp truncates password to 8 chars

jesc516 — Wed, 28 Oct 2015 16:17:52 GMT

my apologies, i meant starting from the 9 character and forward was basically ignored.

im new to hpux administration but i looking into getting certified. i would like to get more hands on as i mostly deal with the windows servers.

thank you