Subject: bug#21318: closed (bug#21318: Fixed)

From: [email-masked] (GNU bug Tracking System)
Date: Tue, 25 Aug 2015 12:43:02 +0000

Your bug report

#21318: Only the first 8 characters of passwords are significant

which was filed against the guix package, has been closed.

The explanation is attached below, along with your original report.
If you require more details, please reply to [email-masked].

-- 
21318: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=21318
GNU Bug Tracking System
Contact [email-masked] with problems

Subject: bug#21318: Fixed
From: 宋文武 <[email-masked]>
To: [email-masked]
Date: Tue, 25 Aug 2015 20:43:50 +0800
List-Id: <debbugs-submit.debbugs.gnu.org>

Fixed in commit 9297065a2b2151636194b2c91e957a3ec0b33532.

Subject: Only the first 8 characters of passwords are significant
From: Mark H Weaver <[email-masked]>
To: [email-masked]
Date: Sat, 22 Aug 2015 01:20:22 -0400
List-Id: <debbugs-submit.debbugs.gnu.org>

yenda on #guix reported that when typing user passwords, only the first
8 characters need to be typed correctly to successfully log in.

DusXMT on #guix mentioned that [GNU/]Linux From Scratch instructs users
to change "#ENCRYPT_METHOD_DES" to "ENCRYPT_METHOD_SHA512" in
etc/login.defs:

  http://www.linuxfromscratch.org/lfs/view/stable/chapter06/shadow.html

I tried modifying both /etc/login.defs and etc/login.defs in our
'shadow' package recipe, and then tried updating my password entry with
'passwd' but it still only pays attention to the first 8 characters.

'strace' reveals that 'passwd' doesn't even look for any file named
"login.defs".

I'm not sure what's going on here, but it would be good to fix it soon.

     Mark