Re: Profiles with Default Password -- MIDRANGE-L

Subject: Re: Profiles with Default Password
From: Charles Wilt <charles.wilt@xxxxxxxxx>
Date: Fri, 27 Aug 2010 13:11:45 -0400
List-archive: <http://archive.midrange.com/midrange-l>
List-help: <mailto:midrange-l-request@midrange.com?subject=help>
List-id: Midrange Systems Technical Discussion <midrange-l.midrange.com>
List-post: <mailto:midrange-l@midrange.com>
List-subscribe: <http://lists.midrange.com/mailman/listinfo/midrange-l>, <mailto:midrange-l-request@midrange.com?subject=subscribe>
List-unsubscribe: <http://lists.midrange.com/mailman/listinfo/midrange-l>, <mailto:midrange-l-request@midrange.com?subject=unsubscribe>

On Fri, Aug 27, 2010 at 12:05 PM, Alan Campin <alan0307d@xxxxxxxxx> wrote:

I stand corrected. Dangerous command.

Why is that? Ignorance is bliss?

On Fri, Aug 27, 2010 at 10:03 AM, Alan Campin <alan0307d@xxxxxxxxx> wrote:

As far as I know you cannot. That would mean getting a list of passwords
and the system is not going to get that for you no matter what.

No it doesn't.

You can't "get a list of passwords" from the system (ok assuming
you're gotten rid of the easily unencrypted MS LANMAN password store
by having your QPWDLVL at 1 or 3) That's the whole point of a one-way
hash.

What the system can do is take a the name of a user profile, hash it
and compare it to the encrypted password. If it's a match, then the
system can report that that profile has a default password.

HTH,
Charles

As an Amazon Associate we earn from qualifying purchases.

This mailing list archive is Copyright 1997-2025 by midrange.com and David Gibbs as a compilation work. Use of the archive is restricted to research of a business or technical nature. Any other uses are prohibited. Full details are available on our policy page. If you have questions about this, please contact [javascript protected email address].

Operating expenses for this site are earned using the Amazon Associate program and Google Adsense.