Sysadmin password changed with more than 3 consecutive letters/numbers and almost similar password, just adding one single char at the end.
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
StarlingX |
Invalid
|
High
|
Paul-Emile Element |
Bug Description
Sysadmin password changed with more than 3 consecutive letters/numbers and almost similar password, just adding one single char at the end.
The /etc/pam.
Major Sev
Steps to Reproduce
------------------
Login to controller-0 using system admin user.
To change password quality configuration on the controller, edit /etc/pam.
The password quality validation is configured via the first non-comment line:
"password required pam_pwquality.so try_first_pass retry=3 authtok_type= difok=3 minlen=7 lcredit=-1 ucredit=-1 ocredit=-1 dcredit=-1 enforce_for_root debug"
Change the minimum password length by changing the 'minlen' parameter to 9.
Change the minimum number of characters that must change between subseqent passwords by editing the "difok" parameter to 3.
Change least one uppercase character in the password by adding 'ucredit=-1'
Change the password on behalf a user. Sign on to "root" or "su" the "root" account. Type:
$ sudo su
Make sure you are "root" by typing:
$ whoami
Change the password on behalf a user by typing "passwd <user>"
Enter a password with 8 characters, 1 uppercase letter and 1 non-alphanumeric character.
Enter a password with 8 characters, none uppercase letter and 1 non-alphanumeric character.
Enter same old password and add characters until the length reach 9 characters, 1 uppercase letter and 1 non-alphanumeric character.
Expected Behavior
------------------
The system should get back with "BAD PASSWORD: saying you are using more than 3 bytes similar to the old password.
Actual Behavior
----------------
The system is allowing you to change the password with
e.g.
Madawa$ka1
MMMadawa$ka1
MMMMadawa$ka1
MMMMMadawa$ka1
MMMMMadawa$ka122222
MMMMMadawa$
System Configuration
-------
Virtual Multi-node system
Changed in starlingx: | |
status: | New → Triaged |
importance: | Undecided → High |
Changed in starlingx: | |
assignee: | nobody → Paul-Emile Element (paul-emileelement) |
Changed in starlingx: | |
status: | Triaged → Invalid |
information type: | Private Security → Public Security |
reproduced.