Skip to Content.
Sympa Menu

sm-announce - Re: [SM-Announce] [SM-Discuss] SECURITY ISSUE: /etc/login.defs: passwords only recognize 8 chars

sm-announce AT lists.ibiblio.org

Subject: Sm-announce mailing list

List archive

Chronological Thread  
  • From: Arwed von Merkatz <v.merkatz AT gmx.net>
  • To: David Kowis <dkowis AT shlrm.org>
  • Cc: sm-users AT lists.ibiblio.org, sm-announce AT lists.ibiblio.org, sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Announce] [SM-Discuss] SECURITY ISSUE: /etc/login.defs: passwords only recognize 8 chars
  • Date: Fri, 20 Jan 2006 22:02:31 +0100

On Fri, Jan 20, 2006 at 10:24:24AM -0600, David Kowis wrote:
> Hello all,
> The shadow spell has been installing a bogus /etc/login.defs that
> doesn't have MD5_CRYPT_ENAB set.
>
> This vulnerability affects users of ALL grimoires. PAM users, however,
> shouldn't be affected, but it never hurts to check :)
>
> There are currently two solutions:
> 1. Immediately fix your /etc/login.defs :
> change
>
> #MD5_CRYPT_ENAB no
> to
> MD5_CRYPT_ENAB yes
>
> Note that the line is now uncommented.
>
> OR
>
> 2: Wait until later today and "scribe update" then shadow should show up
> in `sorcery queue-security`. Ensure you recast it, if you didn't choose
> the first option.
>
> Either way, enabling this requires the administrator to redo all the
> passwords for the users on this box as it changes the hash that the
> passwords are encrypted with.

stable-rc and test grimoire have been fixed and the tarballs updated.
The stable grimoire was actually not affected by this, we didn't notice
that until the above message was already sent.
To clarify the last sentence above, you don't _have_ to regenerate all
passwords. Old passwords will continue to work fine (limited to 8
characters), newly set ones won't have the limitation to 8 chars.

--
Arwed v. Merkatz Source Mage GNU/Linux developer
http://www.sourcemage.org




Archive powered by MHonArc 2.6.24.

Top of Page