Subject: Re: The system allows user entering without full password
To: Sergey <forum_s@bk.ru>
From: Steven M. Bellovin <smb@cs.columbia.edu>
List: tech-security
Date: 12/19/2006 14:56:30
On Tue, 19 Dec 2006 20:27:48 +0500
Sergey <forum_s@bk.ru> wrote:
>
> > It sounds like you are using the "old" DES encryption for your
> > password hash. What does your /etc/passwd.conf say?
>
> default:
> localcipher = old
> ypcipher = old
>
As implied by a previous poster, 'old' is limited to 8-character
passwords. You have to switch to something else -- I like sha1, though
md5 is fine -- for longer passwords. (Probably, the passwd.conf man
page should explain such things.)
--Steve Bellovin, http://www.cs.columbia.edu/~smb