topic Password complexity problem in Operating System - HP-UX

Password complexity problem

John Kelly_3 — Tue, 06 Mar 2007 11:48:06 GMT

On an HP 11.23 Itanium box I have set some password requirements in /etc/default/security
PASSWORD_MIN_UPPER_CASE_CHARS=1
PASSWORD_MIN_LOWER_CASE_CHARS=2
PASSWORD_MIN_DIGIT_CHARS=1
PASSWORD_MIN_SPECIAL_CHARS=1
MIN_PASSWORD_LENGTH=8

I have a user who has tried to set his password to Branw:whol01 and this fails the test giving
"The password entered is not valid. Valid passwords must contain... etc."

This seems to be because the digits are not in the first eight characters. E.g. Bran01w:whol passes.

Is this a bug? Is there a patch?

John Kelly

Re: Password complexity problem

A. Clay Stephenson — Tue, 06 Mar 2007 11:55:10 GMT

It depends upon whether you are running trusted or standard passwords. With standard passwords only the first 8 characters of the plaintext password are significant and you would be wise to observe this convention because then you have passwords that are usable across all flavours of UNIX. If you are rnning a trusted system then you can enable longer passwords and the bigcrypt() function is used to encode the password hashes as opposed to the stanard UNIX crypt() function.

Man security and pwpwd for details.

Re: Password complexity problem

John Kelly_3 — Tue, 06 Mar 2007 11:58:03 GMT

Thanks Clay. It isn't Trusted at the moment but it would seem to make sense to do so with this issue confusing the users.

Thanks

John

Re: Password complexity problem

A. Clay Stephenson — Tue, 06 Mar 2007 12:23:21 GMT

In that case what I would do is modify /tcb/files/auth/system/default and set
u_maxlen#8
so that when combined with your MIN_PASSWORD_LENGTH=8 in /etc/default/security
will make your password be exactly 8 character long and the user messages should then be more meaningful.
The setting in the system_default does assume that you have not explicitly set the u_maxlen value in a given user's file because the individual's setting then takes precedence over the default value.

Re: Password complexity problem

John Kelly_3 — Wed, 07 Mar 2007 10:00:44 GMT

Question answered above. Thanks.