#724628 cracklib-runtime: cracklib-check dictionary tests fail for non-ascii words with numbers

Package:
cracklib-runtime
Source:
cracklib2
Description:
runtime support for password checker library cracklib2
Submitter:
Tore Ferner
Date:
2013-09-27 11:27:04 UTC
Severity:
normal
#724628#5
Date:
2013-09-25 22:27:16 UTC
From:
To:
Dear Maintainer,

To reproduce for utf8 based word lists:

  $ sudo aptitude install wspanish wamerican

This one is rightly denied:

  $ sudo cracklib-check # By the way, why is root access necessary?
  blithely
  blithely: it is based on a dictionary word
  blithely3
  blithely3: it is based on a dictionary word

but aarónica3 should also be denied:

  aarónica
  aarónica: it is based on a dictionary word
  aarónica3
  aarónica3: OK

just as this one is:

  aarónica=
  aarónica=: it is based on a dictionary word

In addition too short passwords are accepted:

  årchk
  årchk: OK
  archk
  archk: it is too short
  åòÉü
  åòÉü: OK

These possibly constitute a security risk since such bad passwords are
popular...


Best regards,
Tore
#724628#10
Date:
2013-09-27 10:45:55 UTC
From:
To:
Running reportbug as root does not provide any more information, instead of this error message it just says '-- no debconf information'.
If you need further information, please let me know.

In the error message above: "Ikke tilgang" = "Permission denied".
The permissions of /etc/logcheck/ignore.d.paranoid/ is: drwxr-s--- 2 root logcheck

The file /etc/logcheck/ignore.d.paranoid/cracklib-runtime had permissions

   -rw-r--r-- 1 root root

after installation. Running 'sudo dpkg-reconfigure logcheck logcheck-database' changed it to the same as all the other files there:

   -rw-r--r-- 1 root logcheck

Best regards,
Tore