From unknown Sat Jun 21 10:26:42 2025 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Mailer: MIME-tools 5.509 (Entity 5.509) Content-Type: text/plain; charset=utf-8 From: bug#21318 <21318@debbugs.gnu.org> To: bug#21318 <21318@debbugs.gnu.org> Subject: Status: Only the first 8 characters of passwords are significant Reply-To: bug#21318 <21318@debbugs.gnu.org> Date: Sat, 21 Jun 2025 17:26:42 +0000 retitle 21318 Only the first 8 characters of passwords are significant reassign 21318 guix submitter 21318 Mark H Weaver severity 21318 serious thanks From debbugs-submit-bounces@debbugs.gnu.org Sat Aug 22 01:20:53 2015 Received: (at submit) by debbugs.gnu.org; 22 Aug 2015 05:20:53 +0000 Received: from localhost ([127.0.0.1]:34933 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.80) (envelope-from ) id 1ZT1Eb-0007Pn-Gc for submit@debbugs.gnu.org; Sat, 22 Aug 2015 01:20:53 -0400 Received: from eggs.gnu.org ([208.118.235.92]:44872) by debbugs.gnu.org with esmtp (Exim 4.80) (envelope-from ) id 1ZT1EZ-0007Pf-FA for submit@debbugs.gnu.org; Sat, 22 Aug 2015 01:20:51 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ZT1EY-0006sN-BA for submit@debbugs.gnu.org; Sat, 22 Aug 2015 01:20:51 -0400 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on eggs.gnu.org X-Spam-Level: X-Spam-Status: No, score=-0.0 required=5.0 tests=BAYES_20 autolearn=disabled version=3.3.2 Received: from lists.gnu.org ([2001:4830:134:3::11]:45662) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZT1EY-0006sJ-8p for submit@debbugs.gnu.org; Sat, 22 Aug 2015 01:20:50 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:54873) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZT1EX-0001ZO-5l for bug-guix@gnu.org; Sat, 22 Aug 2015 01:20:50 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ZT1ES-0006rf-7U for bug-guix@gnu.org; Sat, 22 Aug 2015 01:20:49 -0400 Received: from world.peace.net ([50.252.239.5]:42793) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZT1ES-0006rY-0I for bug-guix@gnu.org; Sat, 22 Aug 2015 01:20:44 -0400 Received: from [10.1.10.32] (helo=yeeloong) by world.peace.net with esmtpsa (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.72) (envelope-from ) id 1ZT1EL-0007P6-Ui; Sat, 22 Aug 2015 01:20:38 -0400 From: Mark H Weaver To: bug-guix@gnu.org Subject: Only the first 8 characters of passwords are significant Date: Sat, 22 Aug 2015 01:20:22 -0400 Message-ID: <87io876grt.fsf@netris.org> MIME-Version: 1.0 Content-Type: text/plain X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.6.x X-detected-operating-system: by eggs.gnu.org: Error: Malformed IPv6 address (bad octet value). X-Received-From: 2001:4830:134:3::11 X-Spam-Score: -5.0 (-----) X-Debbugs-Envelope-To: submit X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -5.0 (-----) yenda on #guix reported that when typing user passwords, only the first 8 characters need to be typed correctly to successfully log in. DusXMT on #guix mentioned that [GNU/]Linux From Scratch instructs users to change "#ENCRYPT_METHOD_DES" to "ENCRYPT_METHOD_SHA512" in etc/login.defs: http://www.linuxfromscratch.org/lfs/view/stable/chapter06/shadow.html I tried modifying both /etc/login.defs and etc/login.defs in our 'shadow' package recipe, and then tried updating my password entry with 'passwd' but it still only pays attention to the first 8 characters. 'strace' reveals that 'passwd' doesn't even look for any file named "login.defs". I'm not sure what's going on here, but it would be good to fix it soon. Mark From debbugs-submit-bounces@debbugs.gnu.org Sat Aug 22 01:23:39 2015 Received: (at control) by debbugs.gnu.org; 22 Aug 2015 05:23:39 +0000 Received: from localhost ([127.0.0.1]:34939 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.80) (envelope-from ) id 1ZT1HH-0007UN-0c for submit@debbugs.gnu.org; Sat, 22 Aug 2015 01:23:39 -0400 Received: from world.peace.net ([50.252.239.5]:59678) by debbugs.gnu.org with esmtp (Exim 4.80) (envelope-from ) id 1ZT1HF-0007UE-4c for control@debbugs.gnu.org; Sat, 22 Aug 2015 01:23:37 -0400 Received: from [10.1.10.32] (helo=yeeloong) by world.peace.net with esmtpsa (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.72) (envelope-from ) id 1ZT1H9-0007QN-Rv; Sat, 22 Aug 2015 01:23:31 -0400 From: Mark H Weaver To: control@debbugs.gnu.org Date: Sat, 22 Aug 2015 01:23:14 -0400 Message-ID: <87egiv6gn1.fsf@netris.org> MIME-Version: 1.0 Content-Type: text/plain X-Spam-Score: 2.0 (++) X-Spam-Report: Spam detection software, running on the system "debbugs.gnu.org", has identified this incoming email as possible spam. The original message has been attached to this so you can view it (if it isn't spam) or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: severity 21318 serious thanks [...] Content analysis details: (2.0 points, 10.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 1.8 MISSING_SUBJECT Missing Subject: header 0.2 NO_SUBJECT Extra score for no subject X-Debbugs-Envelope-To: control X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: 2.0 (++) X-Spam-Report: Spam detection software, running on the system "debbugs.gnu.org", has identified this incoming email as possible spam. The original message has been attached to this so you can view it (if it isn't spam) or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: severity 21318 serious thanks [...] Content analysis details: (2.0 points, 10.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 1.8 MISSING_SUBJECT Missing Subject: header 0.2 NO_SUBJECT Extra score for no subject severity 21318 serious thanks From debbugs-submit-bounces@debbugs.gnu.org Sat Aug 22 10:31:22 2015 Received: (at 21318) by debbugs.gnu.org; 22 Aug 2015 14:31:22 +0000 Received: from localhost ([127.0.0.1]:35282 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.80) (envelope-from ) id 1ZT9pK-0006Iu-Gg for submit@debbugs.gnu.org; Sat, 22 Aug 2015 10:31:22 -0400 Received: from mail-pa0-f52.google.com ([209.85.220.52]:35430) by debbugs.gnu.org with esmtp (Exim 4.80) (envelope-from ) id 1ZT9pH-0006Il-K1 for 21318@debbugs.gnu.org; Sat, 22 Aug 2015 10:31:20 -0400 Received: by pacdd16 with SMTP id dd16so63867635pac.2 for <21318@debbugs.gnu.org>; Sat, 22 Aug 2015 07:31:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=from:to:subject:in-reply-to:references:user-agent:date:message-id :mime-version:content-type; bh=PnrMVH66zB83qddg8uREqp1NaoSC37LFmaT1/xlIQpo=; b=MlKz8n9W8nLATOajQJJV+vmbuzrbv3SqOHppn97QUABY1yB6OYGh0vuCpdzZNLIkY2 3Hfm2tUvQ0g7EqkQFGFNGmKds41EH7RyGTo4NN1pxePh359Ii5iDXerk6RJNlErx1c9b 155Ni4PdGdljmYO+UffjuyD3MgARzau8qWNnnnOniFlw9invFyH4O+Xo9e4L6y5BVAJW 5Rkznc6KJ7pSKMjddEOG58GLiY1FUhYjZSj0O0ptdm5CPxV7VVam7ZCB3hWqDLSTsgnd W1vX/gTtv+m/xkLj8ksl3NHZ5wivXBky07URB94lN2+sNbYqiy1sAbHhI2ysOAZNcFAI 1VYA== X-Received: by 10.68.244.137 with SMTP id xg9mr28408081pbc.27.1440253878940; Sat, 22 Aug 2015 07:31:18 -0700 (PDT) Received: from localhost ([108.61.250.36]) by smtp.gmail.com with ESMTPSA id t15sm11348969pbs.10.2015.08.22.07.31.17 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sat, 22 Aug 2015 07:31:18 -0700 (PDT) From: =?utf-8?B?5a6L5paH5q2m?= To: Mark H Weaver , 21318@debbugs.gnu.org Subject: Re: bug#21318: Only the first 8 characters of passwords are significant In-Reply-To: <87io876grt.fsf@netris.org> References: <87io876grt.fsf@netris.org> User-Agent: Notmuch/0.19 (http://notmuchmail.org) Emacs/24.5.1 (x86_64-unknown-linux-gnu) Date: Sat, 22 Aug 2015 22:32:03 +0800 Message-ID: <87lhd3iecc.fsf@gmail.com> MIME-Version: 1.0 Content-Type: text/plain X-Spam-Score: -0.7 (/) X-Debbugs-Envelope-To: 21318 X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -0.7 (/) Mark H Weaver writes: > yenda on #guix reported that when typing user passwords, only the first > 8 characters need to be typed correctly to successfully log in. > > DusXMT on #guix mentioned that [GNU/]Linux From Scratch instructs users > to change "#ENCRYPT_METHOD_DES" to "ENCRYPT_METHOD_SHA512" in > etc/login.defs: > > http://www.linuxfromscratch.org/lfs/view/stable/chapter06/shadow.html > > I tried modifying both /etc/login.defs and etc/login.defs in our > 'shadow' package recipe, and then tried updating my password entry with > 'passwd' but it still only pays attention to the first 8 characters. > > 'strace' reveals that 'passwd' doesn't even look for any file named > "login.defs". Yeah, when login using PAM (our case), login.defs is not used. > > I'm not sure what's going on here, but it would be good to fix it soon. It turn out that add a 'sha512' to the argument of password pam entry do the trick, patch sent :-) From debbugs-submit-bounces@debbugs.gnu.org Tue Aug 25 08:38:52 2015 Received: (at 21318) by debbugs.gnu.org; 25 Aug 2015 12:38:52 +0000 Received: from localhost ([127.0.0.1]:37646 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.80) (envelope-from ) id 1ZUDV6-0001jI-Ew for submit@debbugs.gnu.org; Tue, 25 Aug 2015 08:38:52 -0400 Received: from mail-pa0-f53.google.com ([209.85.220.53]:35933) by debbugs.gnu.org with esmtp (Exim 4.80) (envelope-from ) id 1ZUDV4-0001j9-MU for 21318@debbugs.gnu.org; Tue, 25 Aug 2015 08:38:51 -0400 Received: by padfo6 with SMTP id fo6so6528968pad.3 for <21318@debbugs.gnu.org>; Tue, 25 Aug 2015 05:38:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=from:to:subject:user-agent:date:message-id:mime-version :content-type; bh=FdHAB1qWwBB9+GAnw++pxWiS7YsszYM0o6vm0b/b5xs=; b=cdNeZEtcVC13LP6NWvzE/zNiGN4mIJ3ZSQN8XvBYVdMGlNP6KHBRM9HoV9JA385yoR zNSSClqDBIF16Rly1IKRDYnlyX3YFLgEBfLWvKio+5fTu1Eoz5+P4vk7l37FTxTd+E9H 6lCHtmTejeeCqOoQYtIFjO4PhrI6LozycFvwhzDcCOJ7j34RschezVXOTxCmA3qqNvJL 1SLDxXRrwr97+2CJtaPMp3OqlivwPLoAilIdjEuZAD65mTB5f7GjRqHU3P7qOWNRFc0d PdW5lsg3oRiqOHgGGPKrU24nLae/ChMM0juQTEEBv33H6BHdngPTCm1OXWzHLbpKrqcQ knNw== X-Received: by 10.68.239.69 with SMTP id vq5mr56299007pbc.111.1440506329681; Tue, 25 Aug 2015 05:38:49 -0700 (PDT) Received: from localhost ([108.61.127.84]) by smtp.gmail.com with ESMTPSA id if9sm20913593pbc.89.2015.08.25.05.38.47 for <21318@debbugs.gnu.org> (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 25 Aug 2015 05:38:48 -0700 (PDT) From: =?utf-8?B?5a6L5paH5q2m?= To: 21318@debbugs.gnu.org Subject: bug#21318: Fixed User-Agent: Notmuch/0.19 (http://notmuchmail.org) Emacs/24.5.1 (x86_64-unknown-linux-gnu) Date: Tue, 25 Aug 2015 20:39:50 +0800 Message-ID: <876143y221.fsf@gmail.com> MIME-Version: 1.0 Content-Type: text/plain X-Spam-Score: -0.7 (/) X-Debbugs-Envelope-To: 21318 X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -0.7 (/) Fixed in commit 9297065a2b2151636194b2c91e957a3ec0b33532. From debbugs-submit-bounces@debbugs.gnu.org Tue Aug 25 08:42:52 2015 Received: (at 21318-done) by debbugs.gnu.org; 25 Aug 2015 12:42:52 +0000 Received: from localhost ([127.0.0.1]:37651 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.80) (envelope-from ) id 1ZUDYy-0001pA-5o for submit@debbugs.gnu.org; Tue, 25 Aug 2015 08:42:52 -0400 Received: from mail-pa0-f46.google.com ([209.85.220.46]:33034) by debbugs.gnu.org with esmtp (Exim 4.80) (envelope-from ) id 1ZUDYv-0001p2-RL for 21318-done@debbugs.gnu.org; Tue, 25 Aug 2015 08:42:50 -0400 Received: by pacti10 with SMTP id ti10so50181687pac.0 for <21318-done@debbugs.gnu.org>; Tue, 25 Aug 2015 05:42:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=from:to:subject:user-agent:date:message-id:mime-version :content-type; bh=FdHAB1qWwBB9+GAnw++pxWiS7YsszYM0o6vm0b/b5xs=; b=PgchpqfFnXePSiEY93YkkX1DQpZYn8oHwXinko9oc9MuExRaE9LcDg+bdSztTQhS0d Ab93kgydIOJajMO3RG7EEbkYxWKcdm/lF/B0l05Qt+bHPwbl40GJWfyfcyZReR8LG0vn yF3eqycyvIpLgBUyRAehc9MwJQW1iVbwThq0ptsKVaA9tk8CPQZ3glwqMywx33uysfDc 02HH/5jtRl7SPGdFuxJVZSaA1RCGU6BP/EsgCgLF7OsisN/2s1/t98we1CNwzKaGsSey MHcsDTJnOcfC/dMfE6F9iIXbIT8Uy2t11QuYy7InGOIVj1pl/Lm6nnRbzAcZLfYfLr0h a8YA== X-Received: by 10.68.178.36 with SMTP id cv4mr56007967pbc.161.1440506568954; Tue, 25 Aug 2015 05:42:48 -0700 (PDT) Received: from localhost ([108.61.127.84]) by smtp.gmail.com with ESMTPSA id c12sm20997951pdk.47.2015.08.25.05.42.47 for <21318-done@debbugs.gnu.org> (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 25 Aug 2015 05:42:47 -0700 (PDT) From: =?utf-8?B?5a6L5paH5q2m?= To: 21318-done@debbugs.gnu.org Subject: bug#21318: Fixed User-Agent: Notmuch/0.19 (http://notmuchmail.org) Emacs/24.5.1 (x86_64-unknown-linux-gnu) Date: Tue, 25 Aug 2015 20:43:50 +0800 Message-ID: <8737z7y1vd.fsf@gmail.com> MIME-Version: 1.0 Content-Type: text/plain X-Spam-Score: -0.7 (/) X-Debbugs-Envelope-To: 21318-done X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -0.7 (/) Fixed in commit 9297065a2b2151636194b2c91e957a3ec0b33532. From unknown Sat Jun 21 10:26:42 2025 Received: (at fakecontrol) by fakecontrolmessage; To: internal_control@debbugs.gnu.org From: Debbugs Internal Request Subject: Internal Control Message-Id: bug archived. Date: Wed, 23 Sep 2015 11:24:04 +0000 User-Agent: Fakemail v42.6.9 # This is a fake control message. # # The action: # bug archived. thanks # This fakemail brought to you by your local debbugs # administrator