Subject: Password Policy

From: Thomas Neshite <[email-masked]>
Date: Thu, 10 Jun 1999 13:56:25 -0400 (EDT)

Howdy!

 Using Version wu-2.4(4) on HPUX 10.10.

 First things first: when my regular user accounts have passwords
 greater than 8 characters, the ftpd will not log them in. Change
 that users password to 8 chars or less, no problem. What could be
 causing this? Is this normal?

 Second, what are the password policies for wuftp? How can I
 configure them?

 Any help is greatly appreciated.

 tjn

---

From: Gregory A Lundberg <[email-masked]>
Date: Thu, 10 Jun 1999 14:21:19 -0400 (EDT)

On Thu, 10 Jun 1999, Thomas Neshite wrote:

> First things first:

OK.  First, before you do anything else today, you need to upgrade.  The
version you are running is so old and so insecure you might as well post
the IP address and root password (but you don't really have to because
crackers can get root access on the machine just as easily without them).

> when my regular user accounts have passwords greater than 8
> characters, the ftpd will not log them in. Change that users password
> to 8 chars or less, no problem. What could be causing this? Is this
> normal?

Don't know if it's normal on HP/UX.  Do the longer passwords work for
telnet?  If so, then, no, I'd say it's not normal.

What could be causing it?  Probably one of the thousands of bugs in the
version you're running.  Nobody's reported a similar problem with 2.5.0.

> Second, what are the password policies for wuftp?

It has none.

> How can I configure them?

You cannot.

The daemon uses whatever password handling functions you system has.  So I
guess you can 'configure' them.  All you need is vi and big brassy ...

-- 

Gregory A Lundberg              Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195

---

From: [email-masked] (Albert Lunde)
Date: Thu, 10 Jun 1999 14:01:23 CDT

> > to 8 chars or less, no problem. What could be causing this? Is this

Long passwords are what the references to bigcrypt() in the HP-UX code 
are supposed to deal with; but I haven't tried to test this for
some time.. 

--
    Albert Lunde                      [email-masked]

---

From: Thomas Neshite <[email-masked]>
Date: Thu, 10 Jun 1999 15:03:08 -0400 (EDT)

Eeek!

 Ok. Any squirreliness to watch out for when building for hpux?

 Thanks for the help, Greg.

 tjn