password encryption algorithm

[Tong Hu_1]

What kind of encrytion algorithms are used for the trusted and the untrusted password?

[RAC_1]

The DES alogorithms is used for trusted/untrusted mode. The makekey command (which in turn calls crypt) can be used to prepare crypted string. The password basically consists of a hash and salt chars (used for encryptiion)
When a password is entered, a hash is matched and user authenticated if it matches.

Anil

[Tong Hu_1]

how could I eliminate the encrypted password strings more than 13 characters?

Thanks

[Patrick Wallek]

The only way I can think of to do that would be to use shorter passwords. A longer password equals a longer encrypted string.

I'm not sure why you would want that though.

[RAC_1]

I do not think that you can control that. While setting a password (non-trusted mode), your max pasword char length is 8 chars. While you can set password char length more than 8 chars in trusted mode, your applications shoould be able to understant it. Rather stick to 8 chars password char length.

man passwd for details.

Anil

[Tong Hu_1]

Sorry for the ambiguous question, I am asking about the encrypted password string in tcb files. Since we are trying to synchronize the encrypted password between the Sun servers and HP servers. Some of the encrpted password strings from HP are more than 13 characters, which won't work on Sun servers.

[Patrick Wallek]

Sounds like a jobs for NIS+ or LDAP or something other than just scripts.

[Bill Hassell · Accepted solution]

The password is always encrypted to exactly 13 characters as long as it it 8 chars or less in length. If the system is not Trusted, then pasword characters longer than 8 are silently ignored. In a Trusted system, long passwords are allowed but can easily be limited with system security policies. Run SAM and change the system security policy to 8 character maximum.

NOTE: This only affects new passwords. All existing long passwords must be changed. You can search the /tcb directory for long passwords and notify those users to change.

[Tong Hu_1]

Thanks for all your help.

[Tong Hu_1]

One more extra question, if you can help please. Why Solaris doesn't care the password length, it always encrypt the password to 13 char length?

Thanks

[Bill Hassell]

Try typing the first 8 characters correctly and then adding random characters for 9 and beyond. I think you'll find that Solaris, just like HP-UX (untrusted), silently ignores characters 9 and above. Solaris is only encrypting the first 8, thus the 13 chars in /etc/passwd.

[Tong Hu_1]

Thanks, you are the best.