In configuring a new system today (Juniper Space, Linux-based Network Management platform), I came across a bizarre password requirement that I'm curious about.  Upon logging into the web UI with the default credentials, I was prompted to change the password, which is good, and I went to do, but my randomly generated password was rejected because the last character was a number.  This struck me as all the more strange, given that the password I provided for the command line interface ended in a number, and it was accepted.



In my experience, password requirements like this generally have some underlying reasoning behind them, like Q and Z not being present on old telephone keypads, or legacy systems compatibility or just plain poor systems/policies/whatever. I'm having a much more difficult time explaining this particular policy with any of those explanations, though.

Does anyone have any insight into the reasoning behind a password policy that would prohibit a numeric last character?

It's likely an effort to discourage passwords that fit common formats or character masks.  If a password policy requires use of a number many people will chose to put their number at the end of a word or words.  Here are a couple examples from corporate environments:


NetSPI Top Password Masks for 2015
2015 Trustwave Global Security Report - password masks


Attackers like this user habit because it makes their hybrid password cracking or guessing attacks easier.  They can focus on combining word lists with numbers added to the end rather than a more time consuming brute force approach.

So some organizations implement a policy like this in an attempt to improve security by getting users to put their numbers is a less predictable place.  It sounds like in your situation they're not combining this with any other complexity checking and instead rejecting all passwords that end in a number, regardless of how random they are otherwise.  That's not a very good way to implement this type of checking, but they're not alone in taking this approach.
