one ID with several set of password ?

[Iqram_1]

Hi,
Posting here after I cant get an answer why there is 1 character in my password on HP-UX machine that can be replaced with another character that make it possible to use several set of password using 1 userID.

ex if I set my password as :
username : iqram
password : Ba||||

This password can be used as Baboon or Babang
this "|" (shift + \) is turning the char as a space that can be fill in with any character as long its using the same number of space.

Is this a security issue or is there why patches to solve this problem.

[Steven E. Protter]

Shalom Iqram,

1 User multiple passwords?

Thats a pretty big security violation. Each user has a numeric user id in the /etc/passwd file which identifies it to the login process.

To have multiple passwords for the same user, you'd need multiple copies of the user. I'm believe at that point the login process would only work for one of the users, probably the one closest to the top of the configuration file.

SEP

[Peter Godron]

Hi,
this does not happen on any of my systems.
Are you running trusted or untrusted? If trusted, check your policies.
As far as I know only the characters which are used by getty may be confusing, such as
#, @, /, !, _, backspace, ^U, ^D, or &

[Iqram_1]

Untrusted

[Iqram_1]

Hi Steven E Protter,
You should read the post.

[Peter Godron]

Hi,
I am also running untrusted. What OS and patch level are you at?
So you are using the "|" as a "wildcard" for passwords? Normally the password security is the tighest of any executable on the system, so I suspect it is something in the setup on your machine. Tricky thing will be to find out what.
Could you provide a log?

[Elmar P. Kolkman]

It is caused by the way HP (and other unixes) check a password. They don't keep the unencrypted passwd anywhere (accept for some application files, like .netrc). They only have an ecnrypted version.

When you (try to) login, the password you type is encrypted and then checked with the encrypted passwd on the system. If they match, the login process continues.

If you wanted these wildcards, it would have to encrypt every possible version to try to match what you want...

[Iqram_1]

what I want to say is, "|" is acting as a wildcard that is dangerous.

[Elmar P. Kolkman]

Sorry, I misunderstood the question.

There is another thing in the encryption used: not all bits of all characters are used in all versions of the encryption. In the older versions, for instanct, only 6 bits where used.

But the effect of your pipe symbols I can't explain... And the effect doesn't show on our systems here. What version of HP-UX are you running ?

[Iqram_1]

[xxxxxx]home/iqram $ uname -a
HP-UX xxxxxx B.11.11 U 9000/869 1472564351 unlimited-user license
[xxxxxx]home/iqram $

[Peter Godron]

Hi,
I have had a good attempt at getting the same behaviour on my machines, but without luck.
Could you please provide a logfile.

[Ralf Seefeldt]

Hello Iqram,

I can neither reproduce this behaviour with an HP-UX 10.20 system.
My system has not been patched for a long time. The most up-to-date patches of each kind are:
PHSS_19981
PHNE_18763
PHKL_24281
PHCO_19780

I do not think, that any patch might cause such a securityhole, but I would not completely rule it out.

I suppose, your system language is US-english. Did you try to reproduce the problem with an other system language?

Defining further passwordrestrictions (like minimum length or possibly forbidden charakter - I do not know, whether this may be a option - will be available only on trusted systems)

I hope you will solve your problem.

Ralf