Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I just created a new user in CentOS 5.6 and run passwd user, providing the password io.6,{9001JIAIua121698aa]]. System says "BAD PASSWORD: it is too simplistic/systematic". Not a big deal (and it does accept it anyway), but I am really interested, how is this too simplistic/systematic?

share|improve this question

closed as off topic by jscott, womble, Jason Berg, Chris S, MDMarra Aug 14 '11 at 4:23

Questions on Server Fault are expected to relate to server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

    
My guess would be a check for repeated characters (00 aa ]]) that doesn't care how long the non-repeating parts of the password are. –  DerfK Aug 14 '11 at 1:46

1 Answer 1

up vote 9 down vote accepted

I could only see a Apple open source implementation, and it seems your password qualify as "too simplistic" in this case. The algorithms are likely to be similar.

The code is

    #define MAXSTEP   4

    i = 0;
    ptr = password;
    while (ptr[0] && ptr[1])
    {
        if ((ptr[1] == (ptr[0] + 1)) || (ptr[1] == (ptr[0] - 1)))
        {
            i++;
        }
        ptr++;
    }

    if (i > MAXSTEP)
    {
        return ("it is too simplistic/systematic");
    }

Basically it takes all characters from the password, and checks if the next character is the current character +/- 1 (characters being one byte).

In the password you provided

  io.6,{9001JIAIua121698aa]]

01, JI, 12, 21 and 98 increment the i counter. MAXSTEP being 4, the it is too simplistic/systematic message is triggered.

The algorithm is not very smart, as it does not take into account the length of the password, and the complexity of the other characters.

share|improve this answer