passwd bugs with special characters?

[Alex Feng]

Hi everybody,

Has anyone else noticed this bug or feature?

1. login as root.
2. perform passwd user1
3. specify password of "harris#$" for example
4. The user "user1" is not able to login through telnet saying password is not correct.

However, if user2 does a su to user1 and enters this new password, they are able su into user1.

I had no problems doing the above 4 steps with other passwords such as "harris123"

I tried this on PA RISC 11.11 and Itanium 11.23
both had this problem.

[Patrick Wallek · Accepted solution]

Have a look at the warning section of the password man page:

WARNINGS
Avoid password characters which have special meaning to the tty driver, such as # (erase) and @ (kill). You may not be able to login with these characters.

[Alex Feng]

Thanks for the quick response Patrick. It looks like we must avoid those characters.

[Bill Hassell]

>> However, if user2 does a su to user1 and enters this new password, they are able su into user1.

To explain this a bit more:

When you first login, the defaults for special characters are defined in the TTY driver, specifically, # is the erase character (NOT backspace) and @ is defined as a line cancel. When you login, the (archaic and prehistoric) defaults are overridden by an stty command in /etc/profile and $HOME/.profile. So the special meaning for these characters is changed once you are logged in.

As a general rul]e, special characters are problematic on every system, mostly because there are different rules for different systems. If you stay with alpha-numerics and mixed case, you should be fine all virtually all systems.