Hi David,

On the first look, I believe it can only happen if the supplied password is not of required length which is 10 in this case.

The error 

3004-603 Your password must have:
        a minimum of 10 characters in length.
root's New password:

comes only in this case. Can you please double check it.

Also - which version of AIX are you running ?  
( AIX 5.2 was 8 char password , while 5.3 supported longer )

Hi David,

On the first look, I believe it can only happen if the supplied password is not of required length which is 10 in this case.

The error 

3004-603 Your password must have:
        a minimum of 10 characters in length.
root's New password:

comes only in this case. Can you please double check it.

My response was crafted with AI assistance, tailored to provide detailed and actionable guidance for your query.

If you're unable to log into your AIX system due to the root password expiration and the password length restriction. The issue may be related to both the password length policy and the algorithm configuration (pwd_algorithm).

Steps to Change the Root Password and Resolve the Login Issue

1. Access the AIX System via Single-User Mode (Maintenance Mode)

If you can't log in normally, you need to access the system in single-user mode to reset the password or make necessary changes.

• Reboot the system.
• During the system startup, press 1 (or F1 for some systems) when prompted to enter Maintenance Mode.
• Once you are in single-user mode, you will have root access without needing to log in.

2. Reset the Root Password in Maintenance Mode

• Once in single-user mode, you can reset the root password:

  bash Copy code
  passwd root

• Set a new root password and ensure it meets the required criteria (minimum length of 10 characters, with at least one alphabetic character, one digit, and one special character).

3. Verify the Password Policies in /etc/security/login.cfg

If you're still experiencing issues with the password length, it could be due to the password policy settings in the /etc/security/login.cfg file.

• Check the current password policies:

  bash Copy code
  cat /etc/security/login.cfg

  Look for the minlen and minage settings, which govern password length and aging.

• If necessary, modify the password length by running:

  bash Copy code
  vi /etc/security/login.cfg

  Look for the minlen parameter and set it to 10:

  makefile Copy code
  minlen = 10

  Ensure that other settings such as maxrepeats, minalpha, minlower, minupper, etc., are also in line with your desired password policies.

4. Run the chsec Command for Password Algorithm (Optional)

You mentioned the command chsec -f /etc/security/login.cfg -s usw -a "pwd_algorithm=ssha256". This command changes the password algorithm to ssha256, which is more secure than the default method.

To execute this change, do the following:

• Once logged into single-user mode, run the following command:

  bash Copy code
  chsec -f /etc/security/login.cfg -s usw -a "pwd_algorithm=ssha256"

This sets the password algorithm to ssha256, ensuring stronger password hashing. However, this should not prevent you from resetting your root password if your system has been running on another algorithm previously.

5. Ensure Password Requirements Are Met

The error messages you've seen suggest a conflict between the password policy and your entered password. When creating the new password, ensure:

• The password is at least 10 characters long.
• It contains at least one lowercase letter, one numeric digit, and one special character.
• Avoid having more than 8 repeated characters.
• Ensure you follow the exact password rules defined in /etc/security/login.cfg.

6. Restart the System

Once the password is updated and the policies are correct, you can reboot the system to access it normally.

bash Copy code
reboot

Summary of Steps:

1. Boot into Single-User Mode.
2. Reset the root password in single-user mode using passwd root.
3. Verify the password policies in /etc/security/login.cfg and ensure the minlen is set to 10.
4. Optionally, run the chsec command to set the SSHA256 password algorithm if necessary.
5. Ensure the password meets all policy requirements.
6. Reboot the system and attempt to log in again.

Should I tell you that the answer is wrong?

My response was crafted with AI assistance, tailored to provide detailed and actionable guidance for your query.

If you're unable to log into your AIX system due to the root password expiration and the password length restriction. The issue may be related to both the password length policy and the algorithm configuration (pwd_algorithm).

Steps to Change the Root Password and Resolve the Login Issue

1. Access the AIX System via Single-User Mode (Maintenance Mode)

If you can't log in normally, you need to access the system in single-user mode to reset the password or make necessary changes.

• Reboot the system.
• During the system startup, press 1 (or F1 for some systems) when prompted to enter Maintenance Mode.
• Once you are in single-user mode, you will have root access without needing to log in.

2. Reset the Root Password in Maintenance Mode

• Once in single-user mode, you can reset the root password:

  bash Copy code
  passwd root

• Set a new root password and ensure it meets the required criteria (minimum length of 10 characters, with at least one alphabetic character, one digit, and one special character).

3. Verify the Password Policies in /etc/security/login.cfg

If you're still experiencing issues with the password length, it could be due to the password policy settings in the /etc/security/login.cfg file.

• Check the current password policies:

  bash Copy code
  cat /etc/security/login.cfg

  Look for the minlen and minage settings, which govern password length and aging.

• If necessary, modify the password length by running:

  bash Copy code
  vi /etc/security/login.cfg

  Look for the minlen parameter and set it to 10:

  makefile Copy code
  minlen = 10

  Ensure that other settings such as maxrepeats, minalpha, minlower, minupper, etc., are also in line with your desired password policies.

4. Run the chsec Command for Password Algorithm (Optional)

You mentioned the command chsec -f /etc/security/login.cfg -s usw -a "pwd_algorithm=ssha256". This command changes the password algorithm to ssha256, which is more secure than the default method.

To execute this change, do the following:

• Once logged into single-user mode, run the following command:

  bash Copy code
  chsec -f /etc/security/login.cfg -s usw -a "pwd_algorithm=ssha256"

This sets the password algorithm to ssha256, ensuring stronger password hashing. However, this should not prevent you from resetting your root password if your system has been running on another algorithm previously.

5. Ensure Password Requirements Are Met

The error messages you've seen suggest a conflict between the password policy and your entered password. When creating the new password, ensure:

• The password is at least 10 characters long.
• It contains at least one lowercase letter, one numeric digit, and one special character.
• Avoid having more than 8 repeated characters.
• Ensure you follow the exact password rules defined in /etc/security/login.cfg.

6. Restart the System

Once the password is updated and the policies are correct, you can reboot the system to access it normally.

bash Copy code
reboot

Summary of Steps:

1. Boot into Single-User Mode.
2. Reset the root password in single-user mode using passwd root.
3. Verify the password policies in /etc/security/login.cfg and ensure the minlen is set to 10.
4. Optionally, run the chsec command to set the SSHA256 password algorithm if necessary.
5. Ensure the password meets all policy requirements.
6. Reboot the system and attempt to log in again.

Hi Dai David,

I saw, that you already mentioned AIX Security: Change maximum length of user name, group name, or password, where item "4)" of the second part "Password maximum length" exactly describes your problem. You doubted the importance of a new password algorithm, while the grey box (and the note) before the displayed error-message describes the reason. you see your result (with 15 instead of 10) and why you should not use the default DES/crypt algorithm: "The crypt function only uses the first 8 characters of a password."  I believe, that the algorithm immediately encrypts the password while entering and only returns which rules were not fulfilled. 

Did you already gain access to the system again?

Merry Xmas

------------------------------
AN
------------------------------