IJ28872: PWDCK CAN REPORT INVALID PASSWORD AND BAD LINE ON LSHA PASSWORD

APAR status

• Closed as program error.

Error description

• On systems using Loadable Password Algorithm Model (LSHA)
  in pwdalg.cfg, running the "pwdck" command returns an
  error for corresponding LSHA password entries in
  /etc/security/passwd.
  
  Here are two examples of entries in pwdalg.cfg for which
  running "pwdck" returns invalid results:
  
  5:
          lpa_module = /usr/lib/security/lsha
          lpa_options = algorithm=sha256,prefix_dollar,
  rounds=656000,salt_len=16
  
  6:
          lpa_module = /usr/lib/security/lsha
          lpa_options = algorithm=sha512,prefix_dollar,
  rounds=656000,salt_len=16
  
  "pwdck" output:
  The user "XX" has an invalid password attribute.
  Bad line found in /etc/security/passwd:
  "     password = $6$rounds=656000$<..encrypted passwd..>"
  
  Running "pwdck -y" erroneously removes the entire
  attribute line from /etc/security/passwd due to an
  additional "=" character on the line.
  

Local fix

Problem summary

• On systems using Loadable Password Algorithm Model (LSHA)
  in pwdalg.cfg, running the "pwdck" command returns an
  error for corresponding LSHA password entries in
  /etc/security/passwd.
  
  Here are two examples of entries in pwdalg.cfg for which
  running "pwdck" returns invalid results:
  
  5:
          lpa_module = /usr/lib/security/lsha
  5:      lpa_options = algorithm=sha256,prefix_dollar,
          lpa_module = /usr/lib/security/lsha
          lpa_options = algorithm=sha256,prefix_dollar,
  rounds=656000,salt_len=16
          lpa_module = /usr/lib/security/lsha
  6:      lpa_options = algorithm=sha512,prefix_dollar,
          lpa_module = /usr/lib/security/lsha
          lpa_options = algorithm=sha512,prefix_dollar,
  "pwdck" output:
  The user "XX" has an invalid password attribute.
  rounds=656000,salt_len=16curity/passwd:
        password = $6$rounds=656000$<..encrypted passwd..>"
  "pwdck" output:
  The user "XX" has an invalid password attribute.e
  Bad line found in /etc/security/passwd:d due to an
  "     password = $6$rounds=656000$<..encrypted passwd..>"
  
  Running "pwdck -y" erroneously removes the entire
  attribute line from /etc/security/passwd due to an
  additional "=" character on the line.
  

Problem conclusion

• Modify pwdck to allow for LSHA password entries in
  /etc/security/passwd that have two "=" characters, such
  as:
  
  password = $5$rounds=656000$<..encrypted_password..>
  password = $6$rounds=656000$<..encrypted_password..>
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

  IJ32465 IJ32615 IJ33724

Fix information

• Fixed component name

  AIX V7.2

• Fixed component ID

  5765CD200

Applicable component levels