topic Re: Password Complexity issue with password length in Application Development and Automation Discussions

Password Complexity issue with password length

Former Member — Wed, 10 Aug 2011 15:01:29 GMT

Hi there,

in the EarlyWatch Alert report of last week, in the security part, we had a red mark regarding the password complexity.

I followed the recommandation in the report and posted on this forum.

i've added different parameter to enforce the complexity

here are my parameter :

the server has been rebooted so all setting should be applied. the caps & number requirment works fine but the password lenght doesnt... it still minmum 7

Any idea why that particular setting isnt implemeted?

i'm working on SAP ECC 6.0

thanks for the help

Sébastien

Re: Password Complexity issue with password length

Former Member — Wed, 10 Aug 2011 15:12:52 GMT

Strange ...by any chance it is not distributed to all app servers? or is it same on all servers..

Re: Password Complexity issue with password length

Former Member — Wed, 10 Aug 2011 16:58:10 GMT


Strange ...by any chance it is not distributed to all app servers? or is it same on all servers..

That is also what I would check first.

Re: Password Complexity issue with password length

Former Member — Wed, 10 Aug 2011 21:16:21 GMT

Please check with Basis team the value has been updated in the file system or not ?

some times if the parameter value have space...or any errors while saving...it is not activated still it takes the old value

Re: Password Complexity issue with password length

Former Member — Fri, 12 Aug 2011 07:01:50 GMT

@Nisha : i've made the change on one server only, the test one.

ok while checking the parameters value as suggested by Hari, i found out that there was 3 different profile and that all of them where active...

i was working on the "default" one.

and in one of the other profile, i found the parameter : login/min_password_ln with another value, 7.

that's probably the reason of my issue. - i let you know

Edited by: Sébastien DE MYTTENAERE on Aug 12, 2011 9:03 AM

Re: Password Complexity issue with password length

Former Member — Fri, 12 Aug 2011 13:39:52 GMT

Hi,

You might have to check Default and Instance profiles.

Default profiles overrides Instance profiles and hence you have the issue. Make sure that you are not maintaining the parameters in both of these profiles.

Regards,

Raghu

Re: Password Complexity issue with password length

Former Member — Fri, 12 Aug 2011 23:30:23 GMT

Which kernel release are you on?

See http://wiki.sdn.sap.com/wiki/display/Security/Solved-Abilitytoassignsecuritypoliciestospecific+users

The UI is only delieverd later with 7.30. But if you changed profiles from the OS then it migh have taken effect already (the default profile is over written by the security policy).

Cheers,

Julius

Re: Password Complexity issue with password length

Wolfgang_Janzen — Sat, 13 Aug 2011 09:20:51 GMT


Which kernel release are you on?
> 
> See http://wiki.sdn.sap.com/wiki/display/Security/Solved-Abilitytoassignsecuritypoliciestospecific+users
> 
> The UI is only delieverd later with 7.30. But if you changed profiles from the OS then it migh have taken effect already (the default profile is over written by the security policy).
> 
> Cheers,
> Julius

Sorry, Julius but that information is wrong.

The start release is 7.03 / 7.31 (SAP_BASIS component).

Cheers, Wolfgang

Re: Password Complexity issue with password length

Former Member — Sat, 13 Aug 2011 22:52:21 GMT

Thanks for the application release infos Wolfgang!

We still dont know how the login/password_downwards_compatibility is set here (and login/min_password_specials is not set).

Perhaps if the complexity is sufficient with a special character then the length is relaxed per special character or if downward compatible then 2 identical special characters are treated as one in the length for the compliance_to_current_policy check (which we also do not know is active)?

We also do not know the user type.

Cheers,

Julius

Re: Password Complexity issue with password length

koehntopp — Mon, 15 Aug 2011 14:48:39 GMT

Wait a minute - Julius has something WRONG?

SCNR

Frank.

Re: Password Complexity issue with password length

Former Member — Mon, 15 Aug 2011 17:51:21 GMT

Yeah, I am panicing here and hoping that a bug in SAP's release naming convensions can be blamed for it

Cheers,

Julius

Re: Password Complexity issue with password length

Former Member — Wed, 17 Aug 2011 15:22:25 GMT

Hello everyone,

i'm happy to let you know that my problem of password lenght issue is solved.

it was as i though and mentionned by Raghu Boddu i had 2 different profiles where the parameter login/min_password_lng was set. Once with 7 as value, once with 8.

In the default profile it was 8 and 7 in the instance profile.

in my specifi case, it was the instance profile that overrides the default profile.

i've have change the value set on the instance profil. That's how i've fixed the issue.

thanks for the help

Sebastien