[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Debian secure by default?

On 2008-05-17 17:35 +0200, Digby Tarvin wrote:

> One thing that I find rather hard to justify is that even on an Etch system
> installed from scratch just a few weeks ago, /etc/pam.d/common-password has
>   password   required   pam_unix.so nullok obscure min=4 max=8 md5
> so I can be confidently entering my 200 character uber password thinking
> that it is hacker proof, when all the time debian is truncating it to
> eight characters... :-/

Good catch.  If you're the sysadmin, you should change that.  If not,
convince him to do it.

> Unless you require it for backward compatability (because you are importing
> passwrds from an old (less secure) system) I don't see why you would want
> to limit password length at all? (except, of course, to set a lower limit)

Apparently it is for backward-compatibility, yes.  The limit has been
dropped in pam, so Lenny will come with a better default.


Reply to: