Subject: RE: Long passwords not working with ftpd

From: Al Longyear <[email-masked]>
Date: Thu, 10 Aug 1995 16:26:16 -0700

A common client for ftp is the Berkeley ftp program. This program calls the 
'getpass()' function which is local to the client's system. This is 
different than using telnet which will call getpass() on the server's 
system.

The Berkeley getpass() function limits the password to eight characters. It 
truncates the password at that point. After all, who would want a password 
longer than eight characters? (sic.)

The solution is to not use the normal logon sequence and to use the 'user' 
and 'pass' functions directly. The 'pass' function will not limit you to 
eight characters, but it will echo the password on the display.

Alternately, limit yourself to eight characters for a shadowed password or 
convince all of your real users to not use the Berkley getpass() function 
ftp clients. There are other implementations of getpass() which don't limit 
you to eight characters. Your Linux system uses one.

The sequence for ftp would normally resemble something like:

$ ftp -n my.host.system
Connected to my.host.system
220 my.host.system FTP server ready.
ftp>quote user TheUserName
331 Password required for TheUserName.
ftp>quote pass TheUsersRealLongPasswordWhichWillBeSeen
230 User TheUserName logged in.
ftp>

Don't be tempted to use the 'user' command directly. This will only lead 
you into using the getpass() function again.

----------
From: 	Greg Gallagher[SMTP:[email-masked]]
Sent: 	Thursday, August 10, 1995 8:30 AM
To: 	[email-masked]

just recently I changed my Linux system, running 1.2.x, which is
shadowded with the shadow-3.3.1(-2) package.  I was running fine, and
recompiled the ftpd for shadow support when I shadowded.  No problem.
Now I've recompiled the shadow-3.3.1 package so DOUBLE (or something) is
defined, letting shadowded passwords be up to 16 characters.  Well, it
works fine for login, but now you cannot ftp in if your password is
greater than 8.  Did I miss some definition or patch for this?  Is this a
known problem or what?