Password format policy question

[Stephen Hayter_1]

Hi,

I want to assign a user a specific password on a trusted 11i server. Say this password is 'abcdef' and through SAM I try and modify the users password, it complains with:

"password must contain at least two alphabetic characters and at least one numeric or special character".

I thought that if I went into SAM and set "Enable restrictions rules = No" in the password format policies section, I could have this password, but it seems not. Any idea why this is and what does the "Enable restrictions rules" box affect?

Thanks

Stephe

[Jean-Louis Phelix]

hi,

This box makes sam look for some additionnal controls like password must not be pronounceable and must not exist in a dictionnary, but it doen't change the rules to build a password.

Regards.

PS : did you try changing it using the command line (ie "passwd login") ?

[Cheryl Griffin · Accepted solution]

Use Restriction Rules:
New passwords are run through spell to verify that they are not ordinary words that appear in common dictionaries. This reduces vulnerability to password cracking programs.

For a system to comply with trusted security standards, there is no way around the requirement of containing at least two alphabetic characters and at least one numeric or special character.

See man passwd

[Stephen Hayter_1]

Hi Jean-Louis,

Yes I tried from the command linec using 'passwd' which did the same thing.

Thanks for the other info too.

Regards.

[Christopher McCray_1]

Hello,

The "at least one number or special character" is the default minimum for a trusted system. So, just make the passwd abcde1.

Hope this helps

Chris

[Stephen Hayter_1]

One other thing I did notice about this, was that if I reset the user's password from SAM, the new password it generates was all alphabetic!

Thanks for all replies.

[Christopher McCray_1]

Hello, again,

Yes, you are correct. If you ask sam to reset the user's passwd, it does create an all-alphabetic string, BUT, this passwd must be changed at first login afterward. You you use the "modify user's password" option, sam is assuming that you are changing it as permanent, until the expiration time, therefore the restriction rules apply.

Hope this clarifies

Chris