Bug 5656 - shadow configured for short passwords by default
Summary: shadow configured for short passwords by default
Status: RESOLVED FIXED
Alias: None
Product: Security
Classification: Runtime
Component: security (show other bugs)
Version: unspecified
Hardware: All Multiple
: Medium major
Target Milestone: 1.6 M2
Assignee: Paul Eggleton
QA Contact:
URL:
Whiteboard:
Depends on:
Blocks:
 
Reported: 2013-12-11 16:32 UTC by Paul Eggleton
Modified: 2013-12-13 15:51 UTC (History)
2 users (show)

See Also:
OS type for building Yocto: ---
Type of Regression: ---
Verified:
Documentation change: No (bug/feature does not impact docs)

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Paul Eggleton 2013-12-11 16:32:55 UTC 
It seems that if shadow is installed, it is configured (via the default version of /etc/login.defs) to use DES encryption, which means only the first 8 characters of passwords are actually used. It seems that all that is necessary to do to fix this is to set ENCRYPT_METHOD in /etc/login.defs to some other value (e.g. MD5). Given that this 8-character limit is not present if your image doesn't have shadow installed and therefore uses busybox's version of passwd/login, we should probably change our default configuration of shadow unless there is a good reason not to.