topic Re: DECwindows screen lock and PWDMIX in Operating System - OpenVMS

DECwindows screen lock and PWDMIX

Galen Tackett — Thu, 26 May 2005 07:25:57 GMT

In AUTHORIZE I have set /FLAG=PWDMIX for my acccount, and I set a password that has a period in the middle.

Now, if the DECwindows session lock activates (by clicking the lock button or due to inactivity) I can't unlock it! It tells me my password is invalid and generates a security audit. Yet I am able to log in elsewhere with exactly the same password. (The status show in the audit is %LOGIN-F-INVPWD.)

I have found that I can temporarily fix this by resetting my password via AUTHORIZE. This works even if I set it to the same password I was already using. Yet once the screen lock activates, the problem happens all over again.

I am running VMS V7.3-2 and DECwindows V1.3-1 with all the ECOs that were available as of about May 14th.

Maybe the DECwindows screen lock is getting tripped up by examining the password itself, rather than letting VMS do this?

Re: DECwindows screen lock and PWDMIX

Willem Grooters — Fri, 27 May 2005 07:22:26 GMT

Sounds a bug to me. It wouldn't mind on what screen the password is entered, and checks should be done against UAF (using VMS routines, obviously).
Perhaps the period in the middle isn't counted as valid?

Willem

Re: DECwindows screen lock and PWDMIX

Ian Miller. — Sat, 28 May 2005 16:12:31 GMT

I have a vague memory that this is a known bug but you will have to ask hp to be sure.

Re: DECwindows screen lock and PWDMIX

Galen Tackett — Tue, 31 May 2005 12:18:52 GMT

Sigh...

I only wish we had a software contract so that I could report it to HP officially.

As it is we're waiting on government people who manage ours, and from my perspective (rather far removed, I admit) they seem less than infinitesimally interested in doing anything.

Re: DECwindows screen lock and PWDMIX

David Jones_21 — Mon, 13 Jun 2005 17:49:19 GMT

Doesn't appear to be a problem in VMS 8.2.

Re: DECwindows screen lock and PWDMIX

Galen Tackett — Thu, 30 Jun 2005 03:17:26 GMT

I don't have access to the patch yet but will check on V8.2 to see if it's okay there.