#1095 webmin login faiure due to long (> 8 char) password length
Tonight I installed webmin-1.080-1 on two machines at
my home, and I believe I have found a bug. (Apologies
if I missed it: I searched through the documentation
without finding any reference to this one, and I did
not see it in the bug tracking system...)
I use LONG (15 characters on one machine, 14 on the
other) passwords on these machines. However in both
cases (one machine is redhat 9.0 and the other is
rh7.3), I had to reset passwords (linux/unix passwd
command) to SHORT passwords (8 characters worked)
before I could successfully log in on either system.
If this is an intentional design choice, some
reconsideration (or at least a little warning to the
users) might be in order: webmin is an excellent
product (I have used earlier versions on my 7.3 box for
a long time) and requiring short passwords.
Logged In: YES
user_id=764394
I sumbitted this last night anonymously (couldn't get the
setup account screen to download properly for some reason...)
Anyway I was able to duplicate the problem successfully this
morning on 2 other machines -- one running 9 and the other
8.0, and both were of clean builds of webmin-1.080-1, so I
suspec that my seeing it on my two machines at home last
night was not a fluke.
Logged In: YES
user_id=129364
Because webmin usually uses the standard Unix crypt()
encryption function, only the first 8 characters of
passwords will be actually used in the comparison when
logging in. However, this shouldn't prevent longer passwords
from working ..
I presume that you installed the RPM version of webmin,
which creates a 'root' webmin login with the same password
as the Unix 'root' user?
If so, is your system using MD5 or crypt password encryption?
Logged In: YES
user_id=764394
(Answering email from Jamie Cameron 2003-04-29
> presume that you installed the RPM version of webmin,
> which creates a 'root' webmin login with the same password
> as the Unix 'root' user?
> If so, is your system using MD5 or crypt password encryption?
Actually I installed the .src.rpm (I'm at work and cannot
tell you from where I downloaded it until I get home, if
that matters) and built the installable rpm locally.
I use MD5 password encryption on all machines, both at home
and at the office.
Thanks.
Logged In: YES
user_id=129364
Make sure you are running the latest (1.080) version of
webmin from www.webmin.com, rather than one of the other
packages created by a distribution vendor, like Mandrake.
If that still doesn't help, you should try setting up PAM
authentication by installing the Authen::PAM perl module and
creating an /etc/pam.d/webmin file containing :
#%PAM-1.0
auth required pam_unix.so nullok
account required pam_unix.so
session required pam_unix.so
Logged In: YES
user_id=764394
Actually, the latest version on your web page is 1.080-1 and
that is what I *am* running: after getting home and
checking, the rpm I am using iis/was the source rpm from
your webisite which I downloaded on 04/20:
webmin-1.080-1.src.rpm
which I then built via the command
> rpmbuild -ba webmin-1.080.spec
So it doesn't look like a problem with the creator of the
RPM package (from here, anyway).
The question is how do I get this version of webmin to
understand md5 passwords...
Logged In: YES
user_id=129364
The best way to get MD5 support is to configure webmin to
use PAM, as I mentioned below ..
Currently it uses the crypt() function, which on some Linux
systems will automatically do MD5 encryption when
necessary, but probably isn't as reliable.