password restrictions on the console

[jdcarroll15]

We have systems running 11i v2 and v3 in trusted mode (TCB is not enabled). We have implemented the shadow password file on all of these systems and have set minimum characteristics for passwords (min_len=8, min_upper=1, min_lower=1, min_digits=1, min_special=1). I have set an account password that meets all the above minimum values and am able to log into a terminal session to those servers with that password. The pw I assigned to the account is "zaq1@WSX" (without the quotes). But when I try to log into the console with the account and this pw, the login fails. If I change the pw to Hello!23 then I can log into the console with that account.

Im not aware of any kind of restrictions for passwords with logging into the console, but it sure looks like there are some. I don't even know what I should be looking for at this point to figure out why one password will work and another will not - only at the console. We do have the /etc/securetty file in place and it contains one entry only - console, but as far as I understand the concept of the file - it only effects where root can sign in to.

Any ideas on what I can look at, or check into?

[Bill Hassell · Accepted solution]

Very old problem with HP-UX. Avoid using @ or # in passwords. The default stty setting for @ is to cancel the current input line while the # character erases the previous character. This has been true for HP-UX since the mid 1980's. Several years ago, a special device file was created (/dev/ttyconf) which can be used to set (some) new default values. This command:

stty erase "^H" kill "^U" intr "^C" eof "^D" < /dev/ttyconf

And now all tty and pty devices will have the 'expected' settings. NOTE: the /dev/console device and any already-opened devices will not inherit the new login settings until a reboot. You'll need to create a start script in /sbin/init.d to set the stty values before the console is opened.

[jdcarroll15]

Thank you for the reply. That is what I was looking for.