http://bugzilla.novell.com/show_bug.cgi?id=535617 User urwald@gmx-topmail.de added comment http://bugzilla.novell.com/show_bug.cgi?id=535617#c1 --- Comment #1 from Tim Fechtner 2009-09-14 02:13:08 MDT --- Same in M7 -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=535617 User urwald@gmx-topmail.de added comment http://bugzilla.novell.com/show_bug.cgi?id=535617#c3 Tim Fechtner changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |NEW Info Provider|urwald@gmx-topmail.de | --- Comment #3 from Tim Fechtner 2009-09-14 06:03:38 MDT --- Hm, actually I've set the min length through YaST to 4, and the result is: password: minlen=4 However, when I enter a password with 5 letters, I get an error that the password is too short: Changing password for <name>. Contraseña anterior: Nueva contraseña: Vuelva a escribir la nueva contraseña: CONTRASEÑA INCORRECTA: Es demasiado corta. passwd: Error de manipulación del testigo de autenticación Furthermore, after boot, by default the checkbox "check new passwords" is diabled in YaST (what would be quite bad when it would have any effect - but it hasn't any effect, passwords are checked nevertheless). Furthermore, there seems to be no possibility to disable simplicity check (as at least the checkbox "check new passwords" hasn't any effect, and an extra checkbox is no longer available). -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=535617 User mc@novell.com added comment http://bugzilla.novell.com/show_bug.cgi?id=535617#c5 Michael Calmer changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |NEW Info Provider|mc@novell.com | --- Comment #5 from Michael Calmer 2009-09-14 06:52:49 MDT --- (In reply to comment #4)

(In reply to comment #3)

...

Hm, actually I've set the min length through YaST to 4, and the result is:

password: minlen=4

However, when I enter a password with 5 letters, I get an error that the password is too short:

Michael, can you comment this?

After looking into the code I found out that the absolute minimal length of a password is "5". All numbers entered below 5 will be set to 5. # define CO_MIN_LENGTH_BASE 5 opt->min_length = strtol(*argv+7,&ep,10); if (!ep || (opt->min_length < CO_MIN_LENGTH_BASE)) opt->min_length = CO_MIN_LENGTH_BASE; Maybe the yast module should allow only numbers >= 5 here. -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=535617 User urwald@gmx-topmail.de added comment http://bugzilla.novell.com/show_bug.cgi?id=535617#c7 --- Comment #7 from Tim Fechtner 2009-09-14 07:19:38 MDT --- (In reply to comment #4)

If "check new passwords" is checked, it means that additional cracklib tests will be used, not that there won't be checkes at all.

If this is the case, the UI is buggy: When I disable the checkbox "check new passwords", than the spinbox for "minimal password length" and the corresponding label get disabled. This behaviour gives the user to understand, that any check of password lenght is disabled now! -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=535617 User urwald@gmx-topmail.de added comment http://bugzilla.novell.com/show_bug.cgi?id=535617#c9 --- Comment #9 from Tim Fechtner 2009-09-14 07:27:03 MDT --- (In reply to comment #4)

Hm, true, this is a bug in YaST. Workaround is: first change the minimum length to 5, than uncheck the checkbox....

Hm, so UI (see comment #7) could be correct, but because of a bug the disabling of all checks works only if min length was set to 5 before. -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=535617 User mc@novell.com added comment http://bugzilla.novell.com/show_bug.cgi?id=535617#c11 --- Comment #11 from Michael Calmer 2009-09-14 07:45:33 MDT --- Things changing. In the past we use pam_pwcheck for these things. Now we use the official pam_cracklib. This module allows only a minimal length of a password of 5 characters. It makes sense to check this also in pam-config. If you want passwords with less characters, you should think about disabling pam_cracklib and all password checks. Jiri: does yast support disabling of pam_cracklib? -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=535617 User urwald@gmx-topmail.de added comment http://bugzilla.novell.com/show_bug.cgi?id=535617#c13 --- Comment #13 from Tim Fechtner 2009-09-14 08:09:46 MDT --- So there are these issues: 1.) The spinbox in YaST allows min_length=0. But the spinbox should not allow number < 5 (simple UI issue) 2.)

It makes sense to check this also in pam-config.

3.) Enabling/disabling of password checks is buggy: It has an incorrect state after the installation and changes apply only if length was set to 5 befor. 4.) As described in comment #3 it is also not possible to use a password of the length of 5 characters (even if max_length is set to 5 in YaST before). Maybe the pam_cracklib requieres even 6 letters? In this case, issue 1 should requiere at least 6 letters. If not -> is this another issue? Should we split this bug into various? -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=535617 User urwald@gmx-topmail.de added comment http://bugzilla.novell.com/show_bug.cgi?id=535617#c15 --- Comment #15 from Tim Fechtner 2009-09-14 11:13:53 MDT --- (In reply to comment #14)

Yes, please open one for me for "2." Done. Bug 539053 has been opened and assigned to you.

About 4.) It looks like a max_length do not exist in cracklib. Sorry, me error. Should read min_length. (Yes, that's really what I mean: Also when the min_length is set to "5", I am not able to set a password with 5 letters through the "passwd" command. It complains that the password is too short. With 6 letters, it works.) http://bugzilla.novell.com/show_bug.cgi?id=539053

-- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=535617 User mc@novell.com added comment http://bugzilla.novell.com/show_bug.cgi?id=535617#c17 Michael Calmer changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |kukuk@novell.com --- Comment #17 from Michael Calmer 2009-09-15 05:45:21 MDT --- (In reply to comment #16)

So there stay the following issues:

1.) The spinbox in YaST allows min_length=0. But the spinbox should not allow number < 5 (simple UI issue)

Well, maybe we should not change this now. See comments below.

3.) As described in comment #3 it is also not possible to set a password of the length of 5 characters with the "passwd" command (even if min_length is set to 5 in YaST before). Maybe the pam_cracklib requieres even 6 letters? In this case, issue 1 (and bug 539053) should requiere at least 6 letters. If not -> is this another issue?

I had a deep look into the code. The following happens: pam_cracklib calls first cracklib library FascistCheck() to compare the new password against a dictionary. This function has a hard coded MINLEN of "6". Only if this function is passed, it calls its own strength checks where the "minlen" option come into play. I think I will discuss this with thorsten and maybe we decide to do some code changes in pam_cracklib. The problem is only, that we both are involved in other important projects now. Jiri: If you want to change "1.", than please check for number >= 6 . Or wait some weeks. Maybe we can provide other options. -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=535617 User kukuk@novell.com added comment http://bugzilla.novell.com/show_bug.cgi?id=535617#c19 --- Comment #19 from Thorsten Kukuk 2009-09-15 06:00:08 MDT --- I think pam_cracklib needs to be fixed, need to discuss that upstream. The check doesn't make sense for me. -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=535617 User jsuchome@novell.com added comment http://bugzilla.novell.com/show_bug.cgi?id=535617#c21 Jiří­ Suchomel changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jsuchome@novell.com AssignedTo|jsuchome@novell.com |kukuk@novell.com --- Comment #21 from Jiří­ Suchomel 2009-10-27 02:17:44 MDT --- (In reply to comment #19)

I think pam_cracklib needs to be fixed, need to discuss that upstream. The check doesn't make sense for me.

Please, tell me when pam_cracklib is fixed and when I should adapt YaST -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=535617 User coolo@novell.com added comment http://bugzilla.novell.com/show_bug.cgi?id=535617#c24 Stephan Kulow changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |NEW CC| |coolo@novell.com Info Provider|coolo@novell.com | --- Comment #24 from Stephan Kulow 2009-10-30 06:52:55 MDT --- I guess this never worked and about no one noticed. So I would not change that for 11.2 _now_ but for 11.3 -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=535617 User kukuk@novell.com added comment http://bugzilla.novell.com/show_bug.cgi?id=535617#c26 --- Comment #26 from Thorsten Kukuk 2009-10-31 04:50:22 MDT --- (In reply to comment #25)

...

After reading all the documentation, we should remove the min length option from YaST2. Hm, I think that it is a valid usecase that a user wants to have shorter (or even empty) passwords.

Correct. But in that case, you don't want to use pam_cracklib. -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=535617 Jiří­ Suchomel changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |ASSIGNED AssignedTo|jsuchome@novell.com |bnc-team-screening@forge.pr | |ovo.novell.com Target Milestone|--- |Future 11.3 -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=535617 http://bugzilla.novell.com/show_bug.cgi?id=535617#c31 --- Comment #31 from Jiří­ Suchomel 2009-12-03 06:58:59 UTC --- I vote for user manual, than there are man pages... -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=535617 http://bugzilla.novell.com/show_bug.cgi?id=535617#c33 Jiří­ Suchomel changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |NEEDINFO Info Provider| |kukuk@novell.com --- Comment #33 from Jiří­ Suchomel 2009-12-03 07:25:37 UTC --- (In reply to comment #32)

(In reply to comment #31)

...

I vote for user manual, than there are man pages...

?????

Michael Calmer wrote that the text is from the manual page, he refered even to it.

I mean, let's describe the behavior in user's manual, and for the expert options, we have a manual pages. What's the problem?

The question was, if we let the min length option in YaST2, if we can add this text to the help page of the YaST2 module, so that customers know for what the option is good and how it works.

If we exclude setting such option from YaST, I see no point in mentioning it in YaST help text. If we should include anything of current support in YaST, than please specify what. But if it is close to option 3 from Michael's comment 28, please create a feature request for it. -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=535617 http://bugzilla.novell.com/show_bug.cgi?id=535617#c35 --- Comment #35 from Jiří­ Suchomel 2009-12-03 12:25:20 UTC --- We have found out, that current support for minlen that is offered by YaST is actually not working. So, the current one has to be removed from YaST anyway. Now, we have the option to not configure minlen in YaST at all or configure only partially, or configure fully. Michael raised a question, where should the correct way of usage be documented: I'm aswering, in user's manual and for the expert options we have the man pages. YaST is not documentation tool and it should only document what does it support: here you are right. The question is, what should YaST support. Again, if YaST should support this: --cracklib-dcredit=<value> --cracklib-ucredit=<value> --cracklib-lcredit=<value> --cracklib-ocredit=<value> --cracklib-minclass=<value> please make a feature request. -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=535617 http://bugzilla.novell.com/show_bug.cgi?id=535617#c36 Jiří­ Suchomel changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |NEEDINFO Info Provider| |mc@novell.com --- Comment #36 from Jiří­ Suchomel 2009-12-16 10:09:05 UTC --- Ouch. Now I start to understand, that the "2) document how the minlen option of pam_cracklib is working." really means, that current minlen option is working, but not the easy way user would expect. So "documenting" could really be in YaST help text and YaST hadling of current minlen could stay as it is. Michael, could you propose an updated help text than? -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=535617 http://bugzilla.novell.com/show_bug.cgi?id=535617#c38 Jiří­ Suchomel changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution| |FIXED --- Comment #38 from Jiří­ Suchomel 2009-12-21 14:12:55 UTC --- Thanks, I added the help text to yast2-security-2.19.0. I hope now we can close this bug. -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=535617 http://bugzilla.novell.com/show_bug.cgi?id=535617#c40 --- Comment #40 from Jiří­ Suchomel 2009-12-22 10:40:22 UTC --- (In reply to comment #39)

Reffering at the original bug report:

- Is there now a working way to disable the password checking? (Password with 0 letters)

Michael?

- Is the minimum value of the spinbox for password length set to 5?

Yes, however I don't know it this is correct value. -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.