From:	CRDGW2::CRDGW2::MRGATE::"SMTP::CRVAX.SRI.COM::RELAY-INFO-VAX"  2-JUN-1989 18:37
To:	MRGATE::"ARISIA::EVERHART"
Subj:	Re: password problems

Received: From KL.SRI.COM by CRVAX.SRI.COM with TCP; Fri,  2 JUN 89 14:31:49 PDT
Received: from ucbvax.Berkeley.EDU by KL.SRI.COM with TCP; Fri, 2 Jun 89 14:09:42 PDT
Received: by ucbvax.Berkeley.EDU (5.61/1.36)
	id AA00610; Fri, 2 Jun 89 14:00:49 -0700
Received: from USENET by ucbvax.Berkeley.EDU with netnews
	for info-vax@kl.sri.com (info-vax@kl.sri.com)
	(contact usenet@ucbvax.Berkeley.EDU if you have questions)
Date: 2 Jun 89 06:30:21 GMT
From: munnari!vuwcomp!windy!gpwd!gpwrdcs@uunet.uu.net  (Don Stokes, Govt Print, Wellington)
Organization: Government Printing Office, Wellington, New Zealand
Subject: Re: password problems
Message-Id: <565@gp.govt.nz>
References: <140@admdev.cut.oz>, <928@maestro.htsa.aha.nl>
Sender: info-vax-request@kl.sri.com
To: info-vax@kl.sri.com

In article <928@maestro.htsa.aha.nl>, janhe@maestro.htsa.aha.nl (Jan Hellings) writes:
> In our computer VAX11/750 VMS 4.7 we have a problem that users choose a 
> password equal to their username.
> I would be very pleased if anyone can tell me if there exists a program 
> to check if there is such ash... on my system.

There is.  Or was.  Part of the VMS 4.7 upgrade included a check on all 
|d|i|g|i|t|a|l| supplied accounts, ie SYSTEM, FIELD, SYSTEST, USERn (on 
MicroVAXes anyway).  The program is called VMS$SECUREPWD.  I pulled the 
command file that drives it to bits, and after a bit of playing around, 
came up with a procedure to allow me to check if I suspect that an 
account has an insecure password.  This is reproduced below.  I also have 
a procedure that checks passwords against the name in the UAF, the 
username, account and a few other keywords relating to applications, but 
it is a bit too much of a mess to waste net bandwidth on.....

--------------------------------Cut-here--------------------------------
$! HACK.COM - Allow checking of suspected insecure passwords
$! 
$               !
$               ! Some symbols - note CHECK command.
$               !
$       ask       := read sys$command/error=finish/prompt=
$       say       := write SYS$OUTPUT
$       check     := $SYS$MANAGER:VMS$SECUREPWD check
$       authorize := $AUTHORIZE
$               !
$               ! Ask username to check, do a quick check as to the 
$               ! existance and status of the a/c.
$               !
$ outer_loop:
$       ask "Username: " username/end=finish
$       if username .eqs. "" then goto finish
$       check 'username'
$       if .not. $STATUS then goto outer_loop
$       if VMS$SECURE .eqs. "VALID" then goto ac_ok
$       say "Account is ''VMS$SECURE'"
$       if VMS$SECURE .eqs. "DISUSER" then goto ac_ok
$       goto outer_loop
$ ac_ok:
$       authorize show/brief 'username'
$               !
$               ! Ask for password to test
$               ! Check password with VMS$SECUREPWD.
$               ! /EXCLUDE qualifier specifiers passwords that are 
$               ! considered weak.
$               !
$ inner_loop:
$       ask "Password(s): " password/end=outer_loop
$       if password .eqs. "" then goto outer_loop
$       check 'username'/exclude=('password')
$       if VMS$SECURE .nes. "WEAK" then goto inner_loop
$       say "Password is valid"
$       goto outer_loop
$ finish:
$       exit
--------------------------------Cut-here--------------------------------

Hope that helps - you need to dig the program out of the distribution 
tape - it isn't left lying around after the upgrade.

Don Stokes, Systems Programmer    /  /   Domain:                  don@gp.govt.nz
Government Printing Office,      /GP/   PSImail:          PSI%0530147000028::DON
Wellington, New Zealand         /  /   UUCP:  ...!munnari!vuwcomp!windy!gpwd!don
--------------------------------------------------------------------------------
Documentation is useless. It indicates you haven't been working. 

