Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 3 down vote favorite

I just created a new user in CentOS 5.6 and run passwd user, providing the password io.6,{9001JIAIua121698aa]]. System says "BAD PASSWORD: it is too simplistic/systematic". Not a big deal (and it does accept it anyway), but I am really interested, how is this too simplistic/systematic?

share|improve this question
My guess would be a check for repeated characters (00 aa ]]) that doesn't care how long the non-repeating parts of the password are. – DerfK Aug 14 '11 at 1:46

closed as off topic by jscott, womble, Jason Berg, Chris S♦, MDMarra Aug 14 '11 at 4:23

Questions on Server Fault are expected to relate to professional server, networking, or related infrastructure administration within the scope defined in the FAQ. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about closed questions here.

1 Answer

up vote 9 down vote accepted

I could only see a Apple open source implementation, and it seems your password qualify as "too simplistic" in this case. The algorithms are likely to be similar.

The code is 

    #define MAXSTEP   4

    i = 0;
    ptr = password;
    while (ptr[0] && ptr[1])
    {
        if ((ptr[1] == (ptr[0] + 1)) || (ptr[1] == (ptr[0] - 1)))
        {
            i++;
        }
        ptr++;
    }

    if (i > MAXSTEP)
    {
        return ("it is too simplistic/systematic");
    }

Basically it takes all characters from the password, and checks if the next character is the current character +/- 1 (characters being one byte).

In the password you provided

  io.6,{9001JIAIua121698aa]]

01, JI, 12, 21 and 98 increment the i counter. MAXSTEP being 4, the it is too simplistic/systematic message is triggered.

The algorithm is not very smart, as it does not take into account the length of the password, and the complexity of the other characters.

share|improve this answer