Password complexity problem

[John Kelly_3]

On an HP 11.23 Itanium box I have set some password requirements in /etc/default/security
PASSWORD_MIN_UPPER_CASE_CHARS=1
PASSWORD_MIN_LOWER_CASE_CHARS=2
PASSWORD_MIN_DIGIT_CHARS=1
PASSWORD_MIN_SPECIAL_CHARS=1
MIN_PASSWORD_LENGTH=8

I have a user who has tried to set his password to Branw:whol01 and this fails the test giving
"The password entered is not valid. Valid passwords must contain... etc."

This seems to be because the digits are not in the first eight characters. E.g. Bran01w:whol passes.

Is this a bug? Is there a patch?

John Kelly

[A. Clay Stephenson · Accepted solution]

It depends upon whether you are running trusted or standard passwords. With standard passwords only the first 8 characters of the plaintext password are significant and you would be wise to observe this convention because then you have passwords that are usable across all flavours of UNIX. If you are rnning a trusted system then you can enable longer passwords and the bigcrypt() function is used to encode the password hashes as opposed to the stanard UNIX crypt() function.

Man security and pwpwd for details.

[John Kelly_3]

Thanks Clay. It isn't Trusted at the moment but it would seem to make sense to do so with this issue confusing the users.

Thanks

John

[A. Clay Stephenson]

In that case what I would do is modify /tcb/files/auth/system/default and set
u_maxlen#8
so that when combined with your MIN_PASSWORD_LENGTH=8 in /etc/default/security
will make your password be exactly 8 character long and the user messages should then be more meaningful.
The setting in the system_default does assume that you have not explicitly set the u_maxlen value in a given user's file because the individual's setting then takes precedence over the default value.

[John Kelly_3]

Question answered above. Thanks.