Just curious as to why 8 numbers are accepted as a password in linux (CentOS if it matters) and not 8 characters on a non-dictionary word.
It's 10 vs 26 per digit after all. (52 counting CaSe SeNsItIvE)
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.Sign up to join this community
It all depends on pam settings. If someone required at least 1 number in password it would match 8 digits but not 8 letters - it is very common requirement as people do choose highly secure password like name of wife ;) and name of wife + number have higher security.
It is not inherit property of Linux or unix and admin can easily change it.
Looking at obscure.c from the shadow-220.127.116.11 sources, we find:
/* * The scam is this - a password of only one character type * must be 8 letters long. Two types, 7, and so on. */
I expect that the design decision had a lot to do with the social engineering factor that forcing people to invent arbitrarily difficult passwords is a great way to have them tape it to their screen.
The password "goodness" measure is coded to do things like
#ifdef HAVE_LIBCRACK /* * Invoke Alec Muffett's cracklib routines. */
and other such measures if the system builder desires them. From this I conclude the authors very likely understood what they were doing when considering the issue broadly.