LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 04-21-2010, 06:16 PM   #1
Nabana
LQ Newbie
 
Registered: Apr 2010
Posts: 3

Rep: Reputation: 0
Help -- PAM password restrictions don't seem to be working


I set some restrictions in /etc/pam.d/system-auth, but they don't seem to be affecting anything.

/etc/pam.d/passwd:
Code:
password    required     pam_cracklib.so   retry=3 minlen=8
password    required     pam_unix.so       md5 shadow use_authtok
/etc/pam.d/system-auth:
Code:
auth        required      pam_env.so
auth        sufficient    pam_unix.so likeauth nullok 
auth        required      pam_deny.so

account     required      pam_unix.so

password    required      pam_cracklib.so try_first_pass retry=3 ucredit=-1 lcredit=-1 dcredit=-1 ocredit=-1 minlen=8
password    sufficient    pam_unix.so try_first_pass use_authtok nullok md5 shadow remember=5
password    required      pam_deny.so

session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     required      pam_unix.so
So even if I give a password that's less than 8 chars (which minlen=8) should prevent, it still takes it. The other uppercase/lowercase/digit/special character rules don't seem to do anything either.

Console:
Code:
admin1@box1$ passwd
Changing password for admin1
(current) UNIX password: 
New UNIX password: 
Retype new UNIX password: 
passwd: password updated successfully

/var/log/secure doesn't seem to show much except for "password changed for user":

Code:
Apr 21 22:10:49 passwd[1134]: pam_unix(passwd:chauthtok): username [admin1] obtained
Apr 21 22:10:59 passwd[1134]: pam_unix(passwd:chauthtok): username [admin1] obtained
Apr 21 22:10:59 passwd[1134]: pam_unix(passwd:chauthtok): password changed for admin1

Any ideas?
 
Old 04-21-2010, 06:35 PM   #2
anomie
Senior Member
 
Registered: Nov 2004
Location: Texas
Distribution: RHEL, Scientific Linux, Debian, Fedora
Posts: 3,935
Blog Entries: 5

Rep: Reputation: Disabled
For your consideration: my comments on pam_cracklib vs. pam_passwdqc.

That said, what OS / version is this? Your /etc/pam.d/passwd config looks odd. On RHEL, for example, by default it should read -
Code:
...
password include system-auth
- rather than invoking pam_cracklib there and in the system-auth config.
 
Old 04-21-2010, 06:53 PM   #3
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,331
Blog Entries: 55

Rep: Reputation: 3529Reputation: 3529Reputation: 3529Reputation: 3529Reputation: 3529Reputation: 3529Reputation: 3529Reputation: 3529Reputation: 3529Reputation: 3529Reputation: 3529
...and adding /usr/share/doc/pam-${VERSION}/txts/README.pam_cracklib to that: minlen=N The minimum acceptable size for the new password (plus one if credits are not disabled which is the default).. So in your case, since credits are not disabled, minlen is actually $[${minlen}+1], right?
 
Old 04-29-2010, 02:17 PM   #4
Nabana
LQ Newbie
 
Registered: Apr 2010
Posts: 3

Original Poster
Rep: Reputation: 0
I put the rules in pam.d/passwd instead of system-auth, and it works as expected. Not sure why it was originally set up like this, but that did the trick.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
pam time restrictions not working !!? kingston Linux - Newbie 17 09-02-2010 08:10 PM
using pam to override file access restrictions gearoid_murphy Linux - General 7 08-26-2009 04:43 AM
Get pam time restrictions working for linux samba domain login. v2ueha6 Linux - Newbie 1 12-20-2008 04:40 AM
Password restrictions Corrado Linux - Security 3 07-06-2006 10:00 PM
password restrictions Dr Gutiemouth Linux - Security 1 11-04-2004 02:39 PM


All times are GMT -5. The time now is 08:59 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration