topic Re: password length without Trusted System in Operating System - HP-UX

password length without Trusted System

MICHAEL_30 — Fri, 14 Feb 2003 17:02:25 GMT

Two Questions: 1. I was told that we can install the patch PHCO_20334 (or better) to be able to have password length requirement without converting to Trusted System. Is this correct? 2. If we can and we set the min_password_length to 8, what will happened to those users with less than 8 chars in length passwords. Thanks!!

Re: password length without Trusted System

Sridhar Bhaskarla — Fri, 14 Feb 2003 17:19:20 GMT

Hi,

1. Yes.

2. From the SR of this patch

//
(SR: 1653307520 CR: JAGab24842)
Password minimum length is hard-wired to be 6 characters
in libpam_unix.1.

Resolution:
libpam_unix.1 now sets the minimum password length to the
user-defined value of the MIN_PASSWORD_LENGTH=N parameter
in the /etc/default/security file. For untrusted systems
"N" can be any value between 6 and 8; for trusted systems
"N" can be any value between 6 and 80. The default value
is 6. This parameter has effect only when a password is
changed. On untrusted systems, this parameter does not
apply to the root user. As an example, create a file
called /etc/default/security, if it does not already
exist, and make it world readable and root write-able.
Add the following line to the file:
MIN_PASSWORD_LENGTH=8
//

This parameter has effect only when a password is changed. So, the users with less than 8 chars passwords should be fine.

-Sri

Re: password length without Trusted System

MICHAEL_30 — Fri, 14 Feb 2003 17:25:03 GMT

Sridhar, Thanks a lot!!!

Re: password length without Trusted System

S.K. Chan — Fri, 14 Feb 2003 17:28:18 GMT

I have not try this but looking at the patch it seems that the minimum password length can be changed in /etc/default/security (after the patch is installed). If your system is untrusted and you've set MIN_PASSWORD_LENGTH (in /etc/default/security) to say 8 and if you got any existing users which has 6 or more chars in their password it should still work ( I think). To play safe what you can do is force all your users to change their password after you've installed the patch.