Vulnerability Development mailing list archives

Re: OpenSSH Password Question


From: Erik Tayler <erik () DIGITALOFFENSE NET>
Date: Sat, 9 Dec 2000 06:13:56 -0600

Thank you to everyone on the list for taking time to respond. Several minutes
after my posting, one of my co-workers pointed out this stupidity to me. Not a
bug, not a misconfiguration. Again, thanks for the responses everyone, next
time I'll try to actually think why something is happening before asking the
list.

Erik Tayler

p.s. I believe this constitutes the termination of the thread.

Bill Weiss wrote:

Erik Tayler(erik () DIGITALOFFENSE NET)@Fri, Dec 08, 2000 at 05:23:34AM -0600:
I decided this might be the most appropriate list to send this to, so
here I go.
I will start off with one basic question, does sshd
[SSH-1.99-OpenSSH_2.3.0p1]
permit the use of passwords that are longer than 8 characters? If not,
then ignore
the rest of this e-mail.

For example purposes only, let's say the password to one of my normal
user
accounts is abc123456789. I can log in with any of the following:

    abc12345
    abc123456
    abc1234567
    abc12345678
    abc123456789
    abc1234567890
    abc1234567890A
    abc1234567890AB

You get the picture. This is either the way the server is supposed to
act,
a bug, or a terrible misconfiguration on my part. Any help would be
greatly
appreciated. One thing is for sure, I want the be able to use my
password,
not a truncated version.

What about the system sshd is running on?  Shadown installed, PAM, etc...


Current thread: