> I noticed that when I put in a password such as <test1> a person can login
> with the password <test2> or any other number at the end. Is the
> encryption not able to tell the difference between numbers? The encrypted
> passwords even look the same in the password file. Is this a bug?
This is really strange. Encryption only works on ASCII characters and does
not distinguish between letters and digits. When I try to reporoduce that,
the system distinguishes well between "test1" and "test2". The first gives
encrypted "dGVzdDE=" and the second gives "dGVzdDI=", note the different "E"
and "I". So I have no clue right now what is wrong in your installation. If
running under Linux, you can compile elogd after adding "-DHAVE_CRYPT" and "-
lcrypt" to the Makefile to use the standard Linux crypt() function, but I
would rather like to understand what is wrong in your case.
- Stefan |