Solaris

@DonC & MadeInGermany......We (us UK boys) jumped to that conclusion too but having looked it up, it appears PASSLENGTH sets the minimum password length, not the maximum length. Hence my removing my post#7 because I thought I was wrong. So the result was that we were looking for something else. Are we wrong? We've all seen edits of passwd and shadow files prevent logins so I was wondering whether to call for the contents of /etc/passwd and /etc/shadow to be posted just to check the format. Repeat, we concluded that the setting of PASSLENGTH was not the cause. Anyway, thanks to you both for joining this thread; I think this is still a mystery, and needs heavy expertise like yours to solve.

---------- Post updated at 10:09 AM ---------- Previous update was at 09:50 AM ----------

I found this on OTN:
https://community.oracle.com/thread/...art=0&tstart=0

Is this system definitely Solaris 10???? Or could it be Solaris 8 or 9?

It has been a couple of decades since I did any serious sys admin work and I've obviously not kept up with recent changes. So, as the next wild speculation, could there be a plug-in authentication module (PAM) installed that is only looking at the 1st six characters of a password for some users?

Please post the content of:

Code:

/etc/security/policy.conf

It seems like this weird behaviour is not unknown:
.InsecureSystem.: Solaris 10: Password Fail
You learn something new every day!!!!

Also, see this Oracle doc page:
Synopsis - man pages section 4: File Formats
Seems that if you don't DEPRICATE the previous algorithm it continues to get used for password changes. Only new accounts set up use the new algorithm.

I can fix the problem by changing the data in the file /etc/security/policy.conf from CRYPT_DEFAULT=__unix__ to CRYPT_DEFAULT=md5 and reset all users password. Thank you so much for your help.