GNU bug report logs - #21318
Only the first 8 characters of passwords are significant

Previous Next

To add a comment to this bug, you must first unarchive it, by sending
a message to control AT debbugs.gnu.org, with unarchive 21318 in the body.
You can then email your comments to 21318 AT debbugs.gnu.org in the normal way.

Toggle the display of automated, internal messages from the tracker.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Mark H Weaver <mhw <at> netris.org>
To: bug-guix <at> gnu.org
Subject: Only the first 8 characters of passwords are significant
Date: Sat, 22 Aug 2015 01:20:22 -0400

yenda on #guix reported that when typing user passwords, only the first
8 characters need to be typed correctly to successfully log in.

DusXMT on #guix mentioned that [GNU/]Linux From Scratch instructs users
to change "#ENCRYPT_METHOD_DES" to "ENCRYPT_METHOD_SHA512" in
etc/login.defs:

  http://www.linuxfromscratch.org/lfs/view/stable/chapter06/shadow.html

I tried modifying both /etc/login.defs and etc/login.defs in our
'shadow' package recipe, and then tried updating my password entry with
'passwd' but it still only pays attention to the first 8 characters.

'strace' reveals that 'passwd' doesn't even look for any file named
"login.defs".

I'm not sure what's going on here, but it would be good to fix it soon.

     Mark

Message #10 received at 21318 <at> debbugs.gnu.org (full text, mbox):

From: 宋文武 <iyzsong <at> gmail.com>
To: Mark H Weaver <mhw <at> netris.org>, 21318 <at> debbugs.gnu.org
Subject: Re: bug#21318: Only the first 8 characters of passwords are
 significant
Date: Sat, 22 Aug 2015 22:32:03 +0800

Mark H Weaver <mhw <at> netris.org> writes:

> yenda on #guix reported that when typing user passwords, only the first
> 8 characters need to be typed correctly to successfully log in.
>
> DusXMT on #guix mentioned that [GNU/]Linux From Scratch instructs users
> to change "#ENCRYPT_METHOD_DES" to "ENCRYPT_METHOD_SHA512" in
> etc/login.defs:
>
>   http://www.linuxfromscratch.org/lfs/view/stable/chapter06/shadow.html
>
> I tried modifying both /etc/login.defs and etc/login.defs in our
> 'shadow' package recipe, and then tried updating my password entry with
> 'passwd' but it still only pays attention to the first 8 characters.
>
> 'strace' reveals that 'passwd' doesn't even look for any file named
> "login.defs".
Yeah, when login using PAM (our case), login.defs is not used.
>
> I'm not sure what's going on here, but it would be good to fix it soon.
It turn out that add a 'sha512' to the argument of password pam entry do
the trick,  patch sent :-)

Message #13 received at 21318 <at> debbugs.gnu.org (full text, mbox):

From: 宋文武 <iyzsong <at> gmail.com>
To: 21318 <at> debbugs.gnu.org
Subject: bug#21318: Fixed
Date: Tue, 25 Aug 2015 20:39:50 +0800

Fixed in commit 9297065a2b2151636194b2c91e957a3ec0b33532.

Message #18 received at 21318-done <at> debbugs.gnu.org (full text, mbox):

From: 宋文武 <iyzsong <at> gmail.com>
To: 21318-done <at> debbugs.gnu.org
Subject: bug#21318: Fixed
Date: Tue, 25 Aug 2015 20:43:50 +0800

Fixed in commit 9297065a2b2151636194b2c91e957a3ec0b33532.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.