Re: pserver login fails on 9 char passwords

[Mäkeläinen Juha]

-----Alkuperäinen viesti-----
Lähettäjä: Brian Murphy [mailto:brian@murphy.dk] 
Lähetetty: 29. maaliskuuta 2004 13:46
Vastaanottaja: Mäkeläinen Juha
Kopio: bug-cvs@gnu.org
Aihe: Re: pserver login fails on 9 char passwords


Mäkeläinen Juha wrote:

>This problem was found when using cvs-1.11.11 server on HP-UX and 
>wincvs client.
>
>If user password is 9 chars long, the crypted password from client is 
>13 characters but password got from HP-UX secure password system is 24 
>characters. The server.c module can not handle that.

...  

Have you tried using the PAM in the 1.12 versions?

/Brian

  No; we are trying to use a stable version and very straightforward solutions 
for out production group.

  I am not much aware of the possibilities of PAM, I have only glimsed 
http://www.cvshome.org/docs/manual/cvs-1.12.2/cvs_2.html . Is it something 
which can be easily installed in any server?


Mark D. Baushke wrote:
> Your patch makes me uncomfortable because it may be possible to
> choose a password that is encrypted with the same salt as the
> found_passwd and happens to encode to a substring of the real
> found_passwd without being a valid password on the system.
>
> I would rather understand what HP/UX is doing to the found_password
> such that it is so much longer than the crypted password.

  Yes, I would be nice if HP would fix this.

  This kinds of risk may propably be considered moderate in our company's LAN, 
but of course this kind of paranoia is your job. Still I think it should be 
quite difficult to guess one of those passwords. When using shorter passwords 
(<9 chars), isn't it equally easy to guess them?


 -- Juha