I don't know if this is normal, but the thing is, let's say I have a  Solaris user called gloaiza and its password is password2getinI'm logging into the server with PuTTY, I just put 192.168.224.100 and it prompts a windows asking for an user, so I type gloaiza, then it asks for a password and let's say I type password2geti by mistake, and it worked! I'm IN the server!Is that normal? It also works if I put something like password2getin2.I'm not a native English speaker, so, in case there's something you can't understand please ask meOS: Oracle Solaris 10 1/13
Solaris let me in with different password with the same 8 first characters
solaris;password
The operating system stores a hash of the password in /etc/shadow (or, historically, /etc/passwd; or a different location on some other Unix variants). Historically, the first widespread password hash was a DES-based scheme which had the limitation that it only took into account the first 8 characters of the password. In addition, a password hashing algorithm needs to be slow; the DES-based scheme was somewhat slow when it was invented but is insufficient by today's standards.Since then, better algorithms have been devised. But Solaris 10 defaults to the historical DES-based scheme. Solaris 11 defaults to an algorithm based on iterated SHA-256 which is up to modern standards.Unless you need historical compatibility with ancient systems, switch to the iterated SHA-256 scheme. Edit the file /etc/security/policy.conf and change the CRYPT_DEFAULT setting to 5 which stands for crypt_sha256. You may also want to set CRYPT_ALGORITHMS_ALLOW and CRYPT_ALGORITHMS_DEPRECATE.Once you've changed the configuration, run passwd to change your password. This will update the password hash with the currently configured scheme.