How to change password requirements

utahnix · 05-17-2007, 10:04 PM

I want to change the password requirements for system users. I would like to know how to (a) tighten password restrictions, and (b) loosen password restrictions (i.e. disable password complexity checks).

I know in Windows, you do this by changing the local security policy. But I have no clue how to do this on Linux.

jschiwal · 05-17-2007, 11:28 PM

Yast2 -> Security and Users -> Local Security -> Custom -> Password Settings.

Also look at "man pam_cracklib". There you can fine tune the complexity that passwords require.

utahnix · 06-01-2007, 05:56 PM

Okay...

I've seen that stuff in Yast, but Yast is distro specific, and I prefer to know how to do things in Linux without the distro-specific commands. I don't like being tied to tools that don't exist on most or all other distros.

I'll check out the man pages you have specified...

kah00na · 05-01-2008, 12:28 PM

Look in /etc/login.defs. Maybe that is what you're looking for.

utahnix · 05-01-2008, 01:24 PM

That helps (good to know), but I would like to edit password complexity requirements. My /etc/login.defs doesn't have anything about password complexity.

Is that something that can be added to this file? This is something I know nothing about (never edited login.defs before)

DotHQ · 05-01-2008, 02:16 PM

Are you using the PAM security module?
cat /etc/pam.d/system-auth

that file will have many of the rules for pwords.
You'll see pam cracklibs and such for pword strength etc.

chage sets how often a user has to change the pword and prevents them from changing it to soon.

sshd_config controls ssh sesions only but you can prevent root logins and set max tries and stuff like that in there. (/etc/ssh/sshd_config or it might be /usr/local/etc/sshd_config

utahnix · 05-01-2008, 03:17 PM

I've played around with sshd_config, and yes, I've already restricted root logins

Concerning pam... I've fiddled with pam, but not much. In this instance, however, I haven't touched anything. It's using the default authentication that comes with SLES/openSUSE.

My passwd file in /etc/pam.d contains the following:

#%PAM-1.0
auth include common-auth
account include common-account
password include common-password
session include common-session