Telnet won't recognise new passwords on RH7
 

I have a couple of user accounts on a RedHat 7 system (I don't have root access to this box). I am logging in from a windows box using telnet.

Whenever I change the password on one of these accounts, I can't log in via telnet again. I know telnet is OK, and the new password is OK, because I can telnet onto account A (on which the sysadmin set the password) then, in the telnet window, su to account B (on which I changed the password). I just can't telnet directly to account B. It says "login incorrect" (And the old password has stopped working too). When a sysadmin resets the password, account B is OK for telnet again.

I have been using linux for years and never seen this before. And the sysadmins don't know either.

The server uses local, shadowed passwords (no network login), telnet is started by xinetd, everthing is pretty much out-of-the-box. The passwords here are all alphabetic characters, nothing that can be scrambled by keyboard translations.

So:

What can make a user/password combination OK locally (for su, when I'm already logged in), but not via telnet?

What can break it when I change my own password, but not when root changes it?

any ideas anyone ?

Have you tried the following:

1) login as usera
2) sudo passwd userb

or

2a) su -l
2b) passwd userb

Are you using the same pam modules for telnet and su?

To the same password?

Have you looked through the telnet and pam logs?

Unfortunately I don't have root access, or sudo access to passwd. But thanks for the suggestion.

Not the same password, but both alphabetic.

I can't see these logs, but I can see the pam configuration files. There is not one for telnet, I guess the 'login' file is the relevent one, and they are different. I will suggest to the sysadmins that this may be the problem.

On another forum, I have been told it may be a control character on the end of my (changed) password, but I don't see how I would be able to su with that password if that was the case.

Thanks.

Some systems have pam modules that disallow weak passwords.
Ask root to set the passwd, then make a copy of the hash from /etc/shadow.
Then, change the passwd to the same thing yourself, and look at the hash again.