RE: password security

["Neil Palmer" <neilp@xxxxxxxxxxx>]

I would suggest that the user, on CHGPWD screen, tried to enter an all 
numeric password.  They got the error message and used F1 help, which told 
them to put the 'Q' in front.  Then they just told you they didn't do 
that.  Did you witness this with your own eyes, or is this another case of 
users not telling the truth, the whole truth, and nothing but the truth ? 
:-)

...Neil





"Mark A. Manske" <mmanske@minter-weisman.com>
Sent by: owner-midrange-l@midrange.com
2001/01/25 10:30
Please respond to MIDRANGE-L

 
        To:     <MIDRANGE-L@midrange.com>
        cc: 
        Subject:        RE: password security


Hmm, thanks for that information; however;

it does not answer the question of how the user did this,
he did NOT put a Q in front, he also, did NOT as others had mentioned
type letters that looked like numbers - and as qsecofr
I cannot do what this user can do, nor can I do this same
thing as myself.  It also does not matter how I try to change
the password (chgpwd/chgusrprf/edtusrprf).

Also, we have one other user who has been able to do this
using chgpwd, NO Q preceding as the security manual states - 

This user also has secadmin auth, but does not have allobj,
but the first user that made this happen does have allobj due
to the wonder of a canned package that we have been unable 
to limit the way it processes yet - I'm still working on them
on this-like most software vendors..

So since it really is ALL numeric, and there is NO preceding Q and 
no preceding alphabetic character, how can these only two users
be doing this and as myself it will not work that way 
(with a Q I can-but they do not use it)
- my concern: is our security "working"???

as stated previously, V4R4, most recent cumm/hyper/DB/blah..blah..blah.. 

TIA

Mark A. Manske
[mailto:mmanske@minter-weisman.com]
Sr. Project Lead
Minter-Weisman


-----Original Message-----
From: owner-midrange-l@midrange.com
[mailto:owner-midrange-l@midrange.com]On Behalf Of Joseph D. Giusto
Sent: Wednesday, January 24, 2001 3:13 PM
To: 'MIDRANGE-L@midrange.com'
Subject: RE: password security


Put a Q in front of the number and you can log in using just the number.




+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---