Per user message before system prompts for password

ltrinh · 08-30-2011, 06:47 PM

Hello there,
My first question in the forum.

The problem I am trying to solve is displaying the password restriction (like password length, dcredit, etc. from PAM) when user password is expired. Ideally, if I could modify the password prompt, that would be perfect. I think that's impossible without recompiling some codes.

My 2nd thought would be putting password restriction in the 'login text' such as /etc/issue or /etc/motd. This would impact everyone.

Is there a way to display some text when user logs in before the password (or change of password) is prompted?

TIA.

Larry

anomie · 08-30-2011, 07:49 PM

I think you're asking for a dialog that would provide "password rules" at change time. (Right?)

If so, consider the pam_passwdqc module as a replacement for pam_cracklib. It should be available in your distro's repository. Its dialog is similar to:

Code:

A valid password should be a mix of upper and lower case letters,
digits and other characters.  You can use a 10 character long
password with characters from at least 3 of these 4 classes.
Characters that form a common pattern are discarded by the check.
A passphrase should be of at least 3 words, 15 to 40 characters
long and contain enough different characters.

ltrinh · 08-30-2011, 08:00 PM

Quote:

Originally Posted by anomie

I think you're asking for a dialog that would provide "password rules" at change time. (Right?)

If so, consider the pam_passwdqc module as a replacement for pam_cracklib. It should be available in your distro's repository. Its dialog is similar to:

Code:

A valid password should be a mix of upper and lower case letters,
digits and other characters.  You can use a 10 character long
password with characters from at least 3 of these 4 classes.
Characters that form a common pattern are discarded by the check.
A passphrase should be of at least 3 words, 15 to 40 characters
long and contain enough different characters.

Thanks anomie. I'll give it a shot.

ltrinh · 09-01-2011, 03:00 PM

Quote:

Originally Posted by ltrinh

Thanks anomie. I'll give it a shot.

I had to download the pam_passwdqc rpm, but it works.

Thanks a bunch.

anomie · 09-01-2011, 03:16 PM

Yes, it's a great module. Just curious - what OS / version? (I'm wondering why it was not available in your distro's repositories.)

Reuti · 09-01-2011, 03:58 PM

There is also pam_echo to display text (man pam_echo).

ltrinh · 09-01-2011, 04:25 PM

Quote:

Originally Posted by anomie

Yes, it's a great module. Just curious - what OS / version? (I'm wondering why it was not available in your distro's repositories.)

I was available but we never install (prm -i) it.

Now I have follow up questions, for pam_cracklib.so, I can specify minimum number of lower-case, upper-case, etc. How do I do that with pam_passwdqc? It seems that you cannot control per character class individually. Thoughts?

anomie · 09-01-2011, 05:57 PM

Documentation is in the pam_passwdqc(5) manpages, and here:

http://www.openwall.com/passwdqc/README.shtml

Yes, what you're saying is correct. You specify minimum lengths for passwords that contain n different character classes. (And/or minimum length for a passphrase.) You do not control the number of times each character class occurs in a password, exactly. Note that various weak password checks are performed, though.

I'd argue that this is a wiser approach, as your set of criteria (and, thus, the set of passwords that are usable) isn't as limited. This means a larger set of possible passwords - for both end users and those who would build password dictionaries.

ltrinh · 09-01-2011, 06:29 PM

Quote:

Originally Posted by anomie

Documentation is in the pam_passwdqc(5) manpages, and here:

http://www.openwall.com/passwdqc/README.shtml

Yes, what you're saying is correct. You specify minimum lengths for passwords that contain n different character classes. (And/or minimum length for a passphrase.) You do not control the number of times each character class occurs in a password, exactly. Note that various weak password checks are performed, though.

I'd argue that this is a wiser approach, as your set of criteria (and, thus, the set of passwords that are usable) isn't as limited. This means a larger set of possible passwords - for both end users and those who would build password dictionaries.

Anomie, thank for you help. One of the requirement we have is able to specify the minimum number of character class.

anomie · 09-01-2011, 09:26 PM

If you need to specify the minimum number of character classes, then pam_passwdqc can do it. If you need to specify the number of occurrences that must appear within each character class, then it's back to pam_cracklib, unfortunately.

In that case, you may be looking at Reuti's suggestion of pam_echo.

ltrinh · 09-02-2011, 12:03 AM

Quote:

Originally Posted by anomie

If you need to specify the minimum number of character classes, then pam_passwdqc can do it. If you need to specify the number of occurrences that must appear within each character class, then it's back to pam_cracklib, unfortunately.

In that case, you may be looking at Reuti's suggestion of pam_echo.

Thanks anomie and reuti. I'll look into pam_echo.