Subject: Re: The system allows user entering without full password
To: Sergey <forum_s@bk.ru>
From: Steven M. Bellovin <smb@cs.columbia.edu>
List: tech-security
Date: 12/19/2006 14:56:30
On Tue, 19 Dec 2006 20:27:48 +0500
Sergey <forum_s@bk.ru> wrote:

> 
> > It sounds like you are using the "old" DES encryption for your
> > password hash.  What does your /etc/passwd.conf say?
> 
> default:
>   localcipher = old
>   ypcipher = old
> 
As implied by a previous poster, 'old' is limited to 8-character
passwords.  You have to switch to something else -- I like sha1, though
md5 is fine -- for longer passwords.  (Probably, the passwd.conf man
page should explain such things.)


		--Steve Bellovin, http://www.cs.columbia.edu/~smb