up vote 4 down vote favorite
share [g+] share [fb]

Ok, I just got a VPS. I created a new account in linux and set a password lets say 123456789. The problem is, it logs in EVEN if I enter 1234567 :S That is SO bizarre! And yes I checked it by changing the password. I set the password thepassword123 and tried again, and yes its logging in with thepassword. But if I enter something totally different then it doesn't log in.

Any ideas? Tell me if you need more information!

link|improve this question
feedback

2 Answers

up vote 4 down vote

Some authentication methods only rely on a hash of the first X characters (Typically 5-8) of the password.

The above completely depends on the software doing the authentication, the distro of Linux, and the software you are specifically connecting to.

It may very well be working as intended (or working as programmed) for what you're logging into.

link|improve this answer
+1 - just want to add that you'll be able to see what that config looks like (and potentially strengthen it from the defaults) in the /etc/pam.conf file. – Shane Madden Mar 30 '11 at 15:36
If they're using PAM ;-) – Hyppy Mar 30 '11 at 15:38
Heh, fair point! – Shane Madden Mar 30 '11 at 15:39
:) Can't find the pam.conf so its prolly not PAM – gX01 Mar 30 '11 at 17:59
feedback
up vote 2 down vote

http://linux.die.net/man/8/pam_passwdqc

specifically the max option.

The maximum allowed password length. This can be used to prevent users from setting passwords which may be too long for some system services. The value 8 is treated specially: if max is set to 8, passwords longer than 8 characters will not be rejected, but will be truncated to 8 characters for the strength checks and the user will be warned. This is to be used with the traditional DES-based password hashes, which truncate the password at 8 characters.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.