How to implement password policies?

pinga123 · 11-24-2010, 11:23 PM

How would i ensure that whenever any user changes the password it should meet following.
1)It should be more than 7 Characters.
2)Atleast one Upper case character,digit and special character present.
3)Password is not same as username or dictionary word .
4)User should get email after changing his password(I have already setup mail account and tested the setup).

Code:

Distribution Detail
# lsb_release -a
LSB Version:    :core-3.1-ia32:core-3.1-noarch:graphics-3.1-ia32:graphics-3.1-noarch
Distributor ID: EnterpriseEnterpriseServer
Description:    Enterprise Linux Enterprise Linux Server release 5.2 (Carthage)
Release:        5.2
Codename:       Carthage
# uname -a
Linux OFSMUW-VMGR-51 2.6.18-92.el5PAE #1 SMP Fri May 23 22:26:05 EDT 2008 i686 i686 i386 GNU/Linux

JoshyJ · 11-24-2010, 11:41 PM

For numbers 1,2,3 you would need to look into Pam authentication. For Fedora the file you would need to edit is the /etc/pam.d/system-auth

Ehtetur · 11-24-2010, 11:53 PM

The module pam_passwdqc is used to configure the password settings..

Here's a site that gives you all the gory* details for setting up password policies.

*Actually, they're pretty simple to do. What's gory is Nick Nolte's mug shot on top of the page.

pinga123 · 11-25-2010, 12:05 AM

Quote:

Originally Posted by JoshyJ

For numbers 1,2,3 you would need to look into Pam authentication. For Fedora the file you would need to edit is the /etc/pam.d/system-auth

Here posting first few lines from /etc/pam.d/system-auth .
How would i make the changes permanent .

Code:

# cat /etc/pam.d/system-auth
#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.

JoshyJ · 11-25-2010, 01:07 AM

It is basically telling you if you ever run 'authconfig' command it will overwrite whatever you have edited. So what you would do is edit the file to what you want. But don't ever run 'authconfig'.

What I would do also just in case you do run 'authconfig' for whatever reason. Is just to create a copy of the file once you have edited it. So if you ever lose it you can use the backup copy.

Quote:

Originally Posted by pinga123

Here posting first few lines from /etc/pam.d/system-auth .
How would i make the changes permanent .

Code:

# cat /etc/pam.d/system-auth
#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.

pinga123 · 11-25-2010, 01:23 AM

Quote:

Originally Posted by Ehtetur

The module pam_passwdqc is used to configure the password settings..

Here's a site that gives you all the gory* details for setting up password policies.

*Actually, they're pretty simple to do. What's gory is Nick Nolte's mug shot on top of the page.

Here is what i have done according to the link.
I have opened the file made following changes restart the system.
Tried to change the password of root user with minimum 5 characters.
to my surprise i was able to change the password .
How this happened ?Do i need to run any command to force PAM authentication?
content from /etc/pam.d/system-auth (The one i have changed is highlighted in bold).

Quote:

# cat /etc/pam.d/system-auth
#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth required pam_env.so
auth sufficient pam_unix.so nullok try_first_pass
auth requisite pam_succeed_if.so uid >= 500 quiet
auth required pam_deny.so

account required pam_unix.so
account sufficient pam_succeed_if.so uid < 500 quiet
account required pam_permit.so

password requisite pam_cracklib.so try_first_pass retry=3
password sufficient pam_unix.so md5 shadow nullok try_first_pass use_authtok
password required pam_deny.so

session optional pam_keyinit.so revoke
session required pam_limits.so
session optional pam_mkhomedir.so
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session required pam_unix.so
password requisite /lib/security/$ISA/pam_cracklib.so retry=3 minlen=12 lcredit=1 ucredit=1 dcredit=1 ocredit=0

JoshyJ · 11-25-2010, 01:37 AM

Replace this line.

password requisite pam_cracklib.so try_first_pass retry=3

With this.

password requisite pam_cracklib.so retry=3 minlen=12 lcredit=1 ucredit=1 dcredit=1 ocredit=0

pinga123 · 11-25-2010, 04:22 AM

Quote:

Originally Posted by JoshyJ

Replace this line.

password requisite pam_cracklib.so try_first_pass retry=3

With this.

password requisite pam_cracklib.so retry=3 minlen=12 lcredit=1 ucredit=1 dcredit=1 ocredit=0

Did it but same problem BTW i m trying to change root's password does it make any difference?

JoshyJ · 11-26-2010, 03:35 AM

Yes sorry there is a difference. Root is allowed to change password even if it is a bad password. It will warn root but will still change.

Quote:

Originally Posted by pinga123

Did it but same problem BTW i m trying to change root's password does it make any difference?