Solaris 10 big password issue!

dsschanze · 05-30-2005, 10:54 PM

Hi,
I don't know if any other users of Solaris 10 have discovered this, but there seems to be an exploit when using an "_" in your password. For example, if you password is "florida_19", all you would have to type is "florida_" or any combination: "florida_*" and it will give you access to the account.

Give me a reply if you have noticed this...or if there is a fix for it.

-Derek

Maidros · 05-31-2005, 12:26 AM

The default Solaris password is limited to eight alphanumeric characters.

I am not sure if there is a fix though.

jlliagre · 05-31-2005, 01:55 AM

There's no fix as there is no bug, Solaris password management has no built-in limitation, it's the underlying pam module configuration that set its requirements.
The default traditional unix crypt algorithm is based on a 56 bits hash, hence more than 8 characters are useless.

If you want support for longer passwords, you can change the crypt algorithm by setting CRYPT_DEFAULT=1 in /etc/security/policy.conf and uncommenting CRYPT_ALGORITHMS_DEPRECATE=__unix__ , or use a different pam module (e.g. LDAP).