- Community Home
- >
- Servers and Operating Systems
- >
- Operating Systems
- >
- Operating System - HP-UX
- >
- Simple question
Categories
Company
Local Language
Forums
Discussions
Forums
- Data Protection and Retention
- Entry Storage Systems
- Legacy
- Midrange and Enterprise Storage
- Storage Networking
- HPE Nimble Storage
Discussions
Forums
Discussions
Discussions
Discussions
Forums
Discussions
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
- BladeSystem Infrastructure and Application Solutions
- Appliance Servers
- Alpha Servers
- BackOffice Products
- Internet Products
- HPE 9000 and HPE e3000 Servers
- Networking
- Netservers
- Secure OS Software for Linux
- Server Management (Insight Manager 7)
- Windows Server 2003
- Operating System - Tru64 Unix
- ProLiant Deployment and Provisioning
- Linux-Based Community / Regional
- Microsoft System Center Integration
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Community
Resources
Forums
Blogs
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Printer Friendly Page
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
08-18-2005 08:59 AM
08-18-2005 08:59 AM
Simple question
I guess this is a very simple questions, but then i was asked this question at an interview, i could not answer it.
Q: Why should unix passwords be 8 or less charecters in length?
I know that passwords can be nore that 8 characters in lenght, but in cases where its more than 8 characters it ignores all characters after 8 characters.... why is that?
Eg. if your password is 1234567890 and you enter only 12345678 it will still let you in...
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
08-18-2005 09:05 AM
08-18-2005 09:05 AM
Re: Simple question
it is a limitation of of the hashing (or encrypting) algorithm on the untrusted systems I presume.
UNIX because I majored in cryptology...
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
08-18-2005 09:08 AM
08-18-2005 09:08 AM
Re: Simple question
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
08-18-2005 09:10 AM
08-18-2005 09:10 AM
Re: Simple question
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
08-18-2005 09:21 AM
08-18-2005 09:21 AM
Re: Simple question
U are right, i cheched this on 2 old machines (10.20) the trusted one took in all the characters of the password before letting u in and the non trusted one let you in even if u entered the first 8 characters...
But do u know why this 8 character limitation on older system? I was asked thisquestion in an interview and want to be prepared with the answer in any future interviews..
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
08-18-2005 09:26 AM
08-18-2005 09:26 AM
Re: Simple question
I am sure it was a bit limitation in the hash algorithem, probably at the time or when the origional code was written either 8 was enough or that was all the bits there were. Never, until recently did anyone bother to change the code.
We will wait until the HPUX guru's of all guru's shows up to select the right answer, I am sure Bill H. will have it. 10 points only the the correct one. 2 points for guessing.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
08-18-2005 09:39 AM
08-18-2005 09:39 AM
Re: Simple question
This subject matter is too rich for my blood to be perfectly honest. Maybe Bill or Clay know the answer by heart or point us all to a document where it gets explained in deeper detail.
But as far as I know, 8 characters is the limitation coming from the old password hashing/encrypting algorithm. Why 8 chars and not 16, I don't know.
UNIX because I majored in cryptology...
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
08-18-2005 07:07 PM
08-18-2005 07:07 PM
Re: Simple question
Now why does the crypt command only accept 8 characters?
while i'm just guessing at this, I'd say the 8 character limit is a hold over from early unix implementations. These early implemenations used a 12-bit salt and limited passwords to 8 characters. In the 1970's with 8-bit 1Mhz cpus, a 12 bit salt was considered good enough for most purposes, i.e. speed and connectivity was more desirable then security. And, at the time, a brute force attack would take quite awhile with the computers of the time.
But, now days disk storage has become cheap enough that an attacker can precomute encryptions of millions of common passwords, including all 4096 possible salt variations for each password, and store the precomputed values on a single portable hard drive. And, an attacker with a larger budget can build a disk farm with all 6 character passwords and most common 7 and 8 character passords stored in encrypted form, for all 4096 possible salts.
Although, it could be because the crypt command uses a salted DES algorithm to encrypt a constant string. DES keys are 56 bits long, ascii is a 7 bit code; and 8 times 7 is 56.