Skip Menu |

Download (untitled) / with headers
text/plain 1.9KiB
From Fri Apr 11 11:11:27 1997
Received: from MIT.EDU (PACIFIC-CARRIER-ANNEX.MIT.EDU []) by rt-11.MIT.EDU (8.7.5/8.7.3) with SMTP id LAA04575 for <bugs@RT-11.MIT.EDU>; Fri, 11 Apr 1997 11:11:26 -0400
Received: from by MIT.EDU with SMTP
id AA16162; Fri, 11 Apr 97 10:11:04 EST
Received: (from kessler@localhost)
by (8.8.5/8.8.5) id KAA11357
for; Fri, 11 Apr 1997 10:11:24 -0500 (EST)
Message-Id: <>
Date: Fri, 11 Apr 1997 10:11:24 -0500 (EST)
From: William Kessler <>
To: krb5-bugs@MIT.EDU
Subject: password length limited to 8 chars with insecure telnet

Show quoted text
>Number: 416
>Category: telnet
>Synopsis: non-secure telnet limited to 8 char passwords
>Confidential: no
>Severity: non-critical
>Priority: medium
>Responsible: hartmans
>State: open
>Class: sw-bug
>Submitter-Id: unknown
>Arrival-Date: Fri Apr 11 11:12:00 EDT 1997
>Originator: William Kessler
William K. Kessler voice: +1 317 570 3063 fax: +1 317 570 3297
AT&T email:
6612 E. 75th St.
Indianapolis, IN 46250
Show quoted text
>Release: 1.0
X86 FreeBSD 2.1+
System: FreeBSD 2.1-STABLE FreeBSD 2.1-STABLE #1: Mon Apr 22 11:18:58 EST 1996 i386

Show quoted text

A non-secure telnet to a system deamon /usr/local/sbin/telnetd -a none
will not accept users with passwords longer than 8 characters.
Show quoted text

Locally create an account with a password longer than 8 characters and no KDC entries.
Then telnet to that machine and try an insecure login using that user id/password.
The attempt will fail while login accounts with 8 character passwords will work.
Show quoted text

Have users select shorter passwords if access from insecure client is required.

Show quoted text
X-send-pr-version: 3.99