Security Issue?

[Sylvie Vezina]

Hi,
(Problem is same with Unix 10.20 and 11.0) I use root id. and my password has 10 digits. But I'm able to connect even thought I entered only 8 first digits??????

Can I apply patch or do something to resolve it?

Thank you

[Victor BERRIDGE]

Hi,
Wait and see someone to confirm, but for a compatibility purpose - Only the 8 first characters are taken in account
So all is normal

All the best
Victor

[Hai Nguyen_1]

Please see this thread.

http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0x786f1cc6003bd6118fff0090279cd0f9,00.html

Hai

[Elena Leontieva]

Hope this helps:
How can the HP-UX system be configured in that way that users have to use a
password with at least 8 characters?
CONFIGURATION
HP-UX 11.00
PHCO_20334 or later installed
RESOLUTION
With patch PHCO_20334 there was a additional parameter introduced:

MIN_PASSWORD_LENGTH

This parameter can be changed in the /etc/default/security file.

MIN_PASSWORD_LENGTH=8 means that users have to use a password with at least 8
characters. This file can be created on all 11.00 systems not only on trusted
systems. Within 11i the specific part of the manpage looks like this:

On an untrusted system, passwords of non-root users must have at
least six characters. On a trusted system, passwords of all
users must have at least six characters. This restriction on the
password length can be increased to a value larger than six.
Refer to the security(4) manual page for detailed information on
configurable parameters that affect the behavior of this command.
The parameter to select the minimum password length is

MIN_PASSWORD_LENGTH=N

This parameter controls the minimum length of new passwords.
It is not applicable to the root user on a untrusted system.

For untrusted systems N can be any value from 6 to 8.
For trusted systems N can be any value from 6 to 80.

Default value: MIN_PASSWORD_LENGTH=6

[Pete Randall]

On a non-trusted HP-UX system, only the first 8 characters are recognised.


Pete