DECwindows screen lock and PWDMIX

[Galen Tackett]

In AUTHORIZE I have set /FLAG=PWDMIX for my acccount, and I set a password that has a period in the middle.

Now, if the DECwindows session lock activates (by clicking the lock button or due to inactivity) I can't unlock it! It tells me my password is invalid and generates a security audit. Yet I am able to log in elsewhere with exactly the same password. (The status show in the audit is %LOGIN-F-INVPWD.)

I have found that I can temporarily fix this by resetting my password via AUTHORIZE. This works even if I set it to the same password I was already using. Yet once the screen lock activates, the problem happens all over again.

I am running VMS V7.3-2 and DECwindows V1.3-1 with all the ECOs that were available as of about May 14th.

Maybe the DECwindows screen lock is getting tripped up by examining the password itself, rather than letting VMS do this?

[Willem Grooters]

Sounds a bug to me. It wouldn't mind on what screen the password is entered, and checks should be done against UAF (using VMS routines, obviously).
Perhaps the period in the middle isn't counted as valid?

Willem

[Ian Miller.]

I have a vague memory that this is a known bug but you will have to ask hp to be sure.

[Galen Tackett]

Sigh...

I only wish we had a software contract so that I could report it to HP officially.

As it is we're waiting on government people who manage ours, and from my perspective (rather far removed, I admit) they seem less than infinitesimally interested in doing anything.

[David Jones_21]

Doesn't appear to be a problem in VMS 8.2.

[Galen Tackett]

I don't have access to the patch yet but will check on V8.2 to see if it's okay there.