Passwords have to be two characters in length

[Tom Wolf_3]

Hello all.
I have an HP-UX 11.23 ia64 system with trusted computing base (TCB) enabled. Because of a requirement for the application running on this server, the password for certain accounts can only be two characters in length. Is there a way to change the minimum password length to two characters?

I tried adjusting MIN_PASSWORD_LENGTH=2 in the /etc/default/security file but received the following error when we attempted to set an account password to two characters:

Invalid MIN_PASSWORD_LENGTH in /etc/default/security - valid range is 6-80
Password too short - must be at least 6 characters


So, is there a way with either a trusted or un-trusted system, to set passwords to a minimum of two characters in length? I don't think the "passwd" command will permit passwords of that length.

Please provide guidance on this.

Thanks in advance.

Tom Wolf

[Patrick Wallek · Accepted solution]

>>Please provide guidance on this.

My initial reaction is to go back to the application vendor and tell them to get their act together. With all the emphasis on security a requirement like that is ludicrous.

According to the 'passwd' man page, the minimum length is set to 6. You can increase the minimum length, but it appears that you cannot decrease the minimum length to fewer than 6 characters.

Relevant section of the passwd man page:

On an untrusted system, passwords of nonâ root users must have at least six characters. On a trusted system, passwords of all users must have at least six characters. This restriction on the password length can be increased to a value larger than six. Refer to the security(4) manual page for detailed information on configurable attributes that affect the behavior of this command. The attribute to select the minimum password length is
MIN_PASSWORD_LENGTH