Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I just logged into my Linux machine on the account ender on two passwords. Both passwords work! How is it possible?

I'm using latest Ubuntu 9.10.

share|improve this question

migrated from stackoverflow.com Feb 4 '10 at 20:16

This question came from our site for professional and enthusiast programmers.

    
Do you see something in /var/log/auth.log about both of them? What does it say? –  ℝaphink Feb 4 '10 at 20:21
2  
What is account 'ender' ? What were the two passwords (if we can know) -- otherwise, how different are they, what are the md5 like? From where did you log on (tty, vty, sty, su, su - .... ) ? What's the line like in /etc/shadow ? –  Trevoke Feb 4 '10 at 20:23
    
Ender has sudoer ALL. I logged in from Putty, simple. The line is like this (with letters changed) .... ender:7.P22C5bQli72:14549:0:99999:7::: –  Alex Feb 4 '10 at 20:30
    
So you logged in via SSH ? What kind of authentication scheme are you using for SSH ? Maybe it allows incoming connections from your username at your local IP ? SSH authentication isn't a topic I know very well, I prefer locking it down more than opening it up. –  Trevoke Feb 4 '10 at 20:37
    
Yep, it's SSH. Other passwords don't work. just those 2 :) –  Alex Feb 4 '10 at 20:39

1 Answer 1

up vote 12 down vote accepted

Are both passwords more than 8 characters long? Some password backends respect only the first 8 characters of a password...

share|improve this answer
    
I'd completely forgotten about that! I wonder if Ubuntu's SSH server is old enough to fizzle there. –  Trevoke Feb 4 '10 at 20:43
    
It is not the SSH server but rather the hash function used. –  grawity Feb 4 '10 at 21:10
    
Yes,they're both more than 8 characters, and they both start with the same 8 characters. –  Alex Feb 4 '10 at 21:17
    
Wow, you're right. I tried other passwords that start with the same 8 chars, and it works. –  Alex Feb 4 '10 at 21:18
    
Hah. I did that once with Solaris...I thought I was being SO secure, and it turned out that my hilariously long 32 character password was only 8 characters long. –  Satanicpuppy Feb 4 '10 at 22:12

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.