From owner-freebsd-security  Mon Dec 16 10:24:37 1996
Return-Path: <owner-security>
Received: (from root@localhost)
          by freefall.freebsd.org (8.8.4/8.8.4) id KAA22777
          for security-outgoing; Mon, 16 Dec 1996 10:24:37 -0800 (PST)
Received: from passer.osg.gov.bc.ca (0@passer.osg.gov.bc.ca [142.32.110.29])
          by freefall.freebsd.org (8.8.4/8.8.4) with ESMTP id KAA22751;
          Mon, 16 Dec 1996 10:24:25 -0800 (PST)
Received: from localhost (15005@localhost [127.0.0.1]) by passer.osg.gov.bc.ca (8.8.4/8.6.10) with SMTP id KAA19084; Mon, 16 Dec 1996 10:19:58 -0800 (PST)
From: Cy Schubert - ITSD Open Systems Group <cschuber@uumail.gov.bc.ca>
Message-Id: <199612161819.KAA19084@passer.osg.gov.bc.ca>
X-Authentication-Warning: passer.osg.gov.bc.ca: 15005@localhost [127.0.0.1] didn't use HELO protocol
Reply-to: cschuber@uumail.gov.bc.ca
X-Mailer: MH
X-Sender: cschuber
To: Terry Lambert <terry@lambert.org>
cc: rb@gid.co.uk (Bob Bishop), proff@iq.org, security@FreeBSD.ORG,
        hackers@FreeBSD.ORG
Subject: Re: vulnerability in new pw suite 
In-reply-to: Your message of "Sun, 15 Dec 96 13:39:04 MST."
             <199612152039.NAA23837@phaeton.artisoft.com> 
Date: Mon, 16 Dec 96 10:19:57 -0800
X-Mts: smtp
Sender: owner-security@FreeBSD.ORG
X-Loop: FreeBSD.org
Precedence: bulk

DEC UNIX, with C2 security enabled, allows the user to decide whether to use
a system generated password or a user picked password.  One could take this
concept one step further than DEC has done and have it controlled by a
configuration file with either global or per-user defaults.

passer$ passwd
Old password:
Last successful password change for cschuber: Mon Dec  2 07:06:07 1996
Last unsuccessful password change for cschuber: Fri Mar  1 08:03:27 1996

Do you want (choose one letter only):

        Pronounceable passwords generated for you (g)
        A string of characters generated for you (c)
        A string of letters generated for you (l) ?
        To pick your password (p) ?


Enter choice here (q to quit): q
Password not changed: user aborted program.

passer$ 

Just my $0.02 worth. 



Regards,                       Phone:  (250)387-8437
Cy Schubert                    OV/VM:  BCSC02(CSCHUBER)
Open Systems Support          BITNET:  CSCHUBER@BCSC02.BITNET
ITSD                        Internet:  cschuber@uumail.gov.bc.ca
                                       cschuber@bcsc02.gov.bc.ca

		"Quit spooling around, JES do it."