Bugzilla – Bug 144725
improve check for palindroms in passwords
Last modified: 2006-12-09 15:22:01 UTC
When the check for complicate passwords (palindrom) is enabled using yast (security options), it is still possible to create users with passwords like "xxxxx" - which shouldn't be possible and which isn't possible using the "passwd"-command on the console.
but you get a warning or not?
Depends. When I want to use "xxxxx" as password, I get the warning that I'm using only minor letters. But using "XXXXX" as password is accepted without any warning. (And using the passwd command, "XXXXX" is refuesed.)
The maintainer should decide...
What do you have in /etc/security/pam_pwcheck.conf? Did you check both options in security module? For this, you need "Check New Passwords".
I'll attach the .conf file. No, "Check New Passwords" isn't enabled. However, at least for the "passwd" command these two options works completly independend the one from the other in SUSE 10.0. I don't know what is the desired behavior, but at least "passwd" behaves different to yast user administration, and that's confusing.
Created attachment 64855 [details] desired conf file
Enable "Check New Passwords" in Security settings to get requested behaviour - this will start using cracklib library for checking new passwords. The checks for lower case letters, palindroms etc. is done internaly in yast and could be imporved -> Stano.
later.
re
Fixed in yast2-users-2.13.19 for SL10.2 and SLE10SP1.
Verified in 10.2 final.
Closing.