Feature/bug in password handling

Thread View: comp.dcom.sys.cisco

3 messages

[T] Back to Threads [V] Tree View [G] Group Articles

3 total messages Started by Hank Nussbacher Mon, 10 Sep 1990 13:31

#659

Author: Hank Nussbacher
Date: Mon, 10 Sep 1990 13:31

13 lines
886 bytes

I am not sure if this a feature or a bug, but the cisco configure processor
preserves trailing blanks.  This causes the nasty problem of a password
typed in as "XYZ " appearing as XYZ but actually needing "XYZ " to work
(note the trailing blank).
 
Users are warned to watch their trailing blanks when updating their
passwords.
 
This makes for an excellent security feature (have the hackers guessing
how many trailing blanks exist) but I would prefer that this feature be
removed in a future release.
 
Hank

Re: Feature/bug in password handling

#656

Author: Doug McCallum
Date: Mon, 10 Sep 1990 20:02

19 lines
1393 bytes

In article <25934@boulder.Colorado.EDU> HANK@TAUNIVM.BITNET (Hank Nussbacher) writes:
>I am not sure if this a feature or a bug, but the cisco configure processor
>preserves trailing blanks.  This causes the nasty problem of a password
>typed in as "XYZ " appearing as XYZ but actually needing "XYZ " to work
>(note the trailing blank).

A minor related complaint is that the "enable-password" command doesn't need
to be entered as a complete name.  "enable" is sufficient.  I got caught
by this when enabling CLNS via the terminal configuration and transposed
"clns enable" to "enable clns".  It took a while to figure out what I did.
It makes for great fun trying to figure out what happened when you can't
become enabled and the new password was written to NVRAM.

I think the enable-password should be required to be typed in completely
to avoid catching people by surprise.

Doug McCallum
Interactive Systems Corp.
dougm@ico.isc.com

Re: Feature/bug in password handling

#665

Author: Pierre Fortin
Date: Tue, 11 Sep 1990 07:21

42 lines
2302 bytes

In article <1990Sep10.200259.400@ico.isc.com>, dougm@ico.isc.com (Doug McCallum) writes:
> In article <25934@boulder.Colorado.EDU> HANK@TAUNIVM.BITNET (Hank Nussbacher) writes:
> >I am not sure if this a feature or a bug, but the cisco configure processor
> >preserves trailing blanks.  This causes the nasty problem of a password
> >typed in as "XYZ " appearing as XYZ but actually needing "XYZ " to work
> >(note the trailing blank).

I would like to side with the "bug" group, but I can't remember the answer
we got on this one when we received our first "baby" router about a year ago.
In our case, we created the config file on an IBM mainframe with fixed-length
records (padded with spaces).  The problem was discovered when we created the
config file on a Sun and it worked.

> 
> A minor related complaint is that the "enable-password" command doesn't need
> to be entered as a complete name.  "enable" is sufficient.  I got caught
> by this when enabling CLNS via the terminal configuration and transposed
> "clns enable" to "enable clns".  It took a while to figure out what I did.
> It makes for great fun trying to figure out what happened when you can't
> become enabled and the new password was written to NVRAM.

In our case, one of our remote sites was trying to reconfigure the device
connected to the console port and inadvertently caused "enable xxxx" (where
xxxx was some command for the terminal which I forget).  Fortunaetly, the 
person who did this managed to recall what he did after some probing 
questions.  

> 
> I think the enable-password should be required to be typed in completely
> to avoid catching people by surprise.

I agree!

> 
> Doug McCallum
> Interactive Systems Corp.
> dougm@ico.isc.com

Pierre Fortin
fortinp@bnr.ca

Yeah I know; still no signature...

Thread Navigation

This is a paginated view of messages in the thread with full content displayed inline.

Messages are displayed in chronological order, with the original post highlighted in green.

Use pagination controls to navigate through all messages in large threads.

Back to All Threads