I just changed the password for root with 'passwd' to, for example, from 'qwerty' to 'qwertyasdf'; I basically just added more characters to the end of the current password.

The next time I logged into root, I mistakenly typed in the old password (qwerty).. however.. it was accepted, and I was able to log in.. so I logged out, and then tried to login again with the 'qwertyasdf' password, and it also accepted it.

So, I tried to log in again as root but this time with the password as 'qwertyasdfkjnqweoin' (etc, just garbage after the 'password') and it let me in.. so then I tried to find what the shortest password I could enter was, and it turned out to be 'qwert'.. basically, it was the old password I had been using for a very long time, minus the last character.

I then changed the root password to something that did not use the previous password; '1234567', and it, expectedly, denied the previous 'qwerty' password, and also denied '1234567kjsdkfbdfgb' (and some garbage after the password). Just as I would expect.

With another account on the machine that was using the same 'qwerty' password, its the same case.. I can type in *whatever* after the 'real' password.. and changing it with anything that includes the original password has no effect.

I've also tried to delete the password, with 'passwd -d', and change it to no avail.

I then also changed the password to '1q2w3e4r5t6y7u8i9o0p', tried to log in, and it allowed anything beyond '1q2w3e4r'...

If you are logging into this machine via a text login, then I believe you are seeing the 8-character limit that is imposed on passwords. You can type in anything you want after the first 8 characters of your password and it will accept it. I find this a good way to vent some steam from time to time... you know ... like 'passwordihatemyboss' or 'passwordheissuchanidiot'. Have fun with it!

If you're using shadowed passwords, passwd should accept over 8 chars. Grep your /etc/pam.d/{passwd,login} for "shadow" to find out.

Ah, thanks.. not being shadowed was it

Can you tell me which distribution+release this is that doesn't use shadow passwds by default, btw? Would be good to know.

This is on a Mandrake 8.1 system. When installing, theres an option that asks how the security should be setup and I think anything less than the 'paranoid' setting doesn't enable shadow passwords.
Sorry about the late reply..