Help With Password Complexity and pam_passwdqc

dagvaktin · 09-19-2013, 03:15 AM

Hi,

I've been experimenting with pam_passwdqc in an attempt to enforce some password policies but cannot quite seem to get it to work for me.

I basically want passwords with a minimum length of 12 chars using a combination of at least 3 out of 4 from a list of lowercase, uppercase, numbers and other characters.

From reading up on manpages, trawling through the internet and lots of trial and error, this is what I came up with for /etc/pam.d/system-auth :

Code:

password    requisite	   pam_passwdqc.so min=disabled,disabled,disabled,12,12 max=30 match=0 random=0 retry=3 enforce=everyone
password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok
password    required      pam_deny.so

The problem I have is that from what I can tell, the following 2 passwords should work but don't :

SeeBeh!Cheem
SeeBeh!Ch33m

Both give the same result :

Code:

A valid password should be a mix of upper and lower case letters,
digits, and other characters.  You can use a 12 character long
password with characters from at least 3 of these 4 classes.
An upper case letter that begins the password and a digit that
ends it do not count towards the number of character classes used,
unless disable_firstupper_lastdigit_check option is enabled.

Enter new password:
Weak password: not enough different characters or classes.

I've probably gone through nearly every parameter there is for this and am beginning to tear my hair out.

If anyone has any clue about this, I would be most grateful.

Thanks,
Sean

Habitual · 09-19-2013, 08:46 PM

Try escaping ! or not using it at all.
It is generally a train-wreck waiting to happen.

Code:

SeeBeh\!Cheem
SeeBeh\!Ch33m

Just an idea.

dagvaktin · 09-20-2013, 01:35 AM

Quote:

Originally Posted by Habitual

Try escaping ! or not using it at all.
It is generally a train-wreck waiting to happen.

Code:

SeeBeh\!Cheem
SeeBeh\!Ch33m

Just an idea.

Thanks but I don't think that works.

Tried escaping the ! as you suggested, but got the same result. I also tried using *,@,+ and [ in place of the exclamation mark (!) but all of them produced the same error each time.

Habitual · 09-20-2013, 10:14 AM

Bummer.
http://www.linuxquestions.org/questi...lexity-483084/
and/or
http://www.cyberciti.biz/faq/rhel-fe...ality-control/
should offer some further guidance, if not someone else here.

Sorry I couldn't help.

jpollard · 09-20-2013, 10:30 AM

Try "SeeBeh@!Cheem+"

I bet it wants 3 characters of each class... The example has 3 upper case, 8 lower case, but only 1 special character (the !).

dagvaktin · 09-23-2013, 02:00 AM

Thanks to all who posted suggestions and help here. I eventually solved the problem but in order to do so, I used pam_cracklib.so instead. This requires a little explanation :

Originally, I tried using pam_cracklib.so but discovered that it apparently only worked for non-root users. That was a problem because password policy enforcement for root was something I needed. So I turned to pam_passwdqc.so as that was supposed to support password complexity for root.

Having gone around in circles and basically strangled myself trying to get pam_passwdqc.so to work, I found out today that the enforcement of password complexity for root is actually supported in the latest version of pam_cracklib.so. So feeling like a twit, I managed to get what I wanted working using pam_cracklib.so in the end.

I am posting my solution here, in case anybody else wants to get this to work. Sort of makes the pain I went through sort of worth it

.

This is for CENTOS 6/RHEL6 and provides :

- a minimum password length of 12 characters
- password complexity - 3 out of 4 character types of (lowercase, uppercase, numerical digits, other symbols)
- the ability to remember the last 5 passwords entered
- policies are enforce for root

Code:

password    required      pam_cracklib.so retry=3 minlen=12 difok=3 minclass=3 lcredit=0 ucredit=0 dcredit=0 ocredit=0 enforce_for_root
password    required      pam_pwhistory.so use_authtok remember=3 enforce_for_root use_authtok
password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok
password    required      pam_deny.so

Note that the version of PAM you are running should be at least 1.1.1-13. Previous versions apparently have some bugs that prevent the enforcement of the policies on root. See here for more details on that :

http://rhn.redhat.com/errata/RHSA-2013-0521.html

Thanks again,
Sean