We have Ubuntu 14.04.3 LTS on our lab PCs in my college. I have noticed a serious bug today.
I can skip the last few characters of my password and still log in smoothly. For example, if my password is
a1b2c3d4e5f6g7h8, I can type
a1b2c3d4e and still log in. Many other people have also noticed this bug.
Note that the password cannot be bypassed entirely - the maximum I have been able to skip is 7 characters. If I try to skip any more, the message "Invalid password, please try again" appears. Also note that any random permutation of a substring of the password does not work.
This also happens if I lock the screen manually and enter the password again. The same bug is present while using
ssh and well, googling and searching Stack Overflow did not help.
My question is - how do I fix this bug, if I can fix it at all? Our sysadm won't be available before Monday, and this is really troubling me.
IMPORTANT: Note that none of the students' accounts are in the sudoers list, only sysadm has root access. Also, the following shows up when I
ssh into my own account:
Welcome to Ubuntu 14.04.3 LTS (GNU/Linux 3.13.0-65-generic i686) * Documentation: https://help.ubuntu.com/ 543 packages can be updated. 350 updates are security updates. New release '16.04.1 LTS' available. Run 'do-release-upgrade' to upgrade to it.
UPDATE: It looks like the important issue is not the number of characters omitted at the end, but the fact that it is possible to login with the first eight or more characters of the password.