Using PAM, strong passwords with pam_passwdqc and the "similar" keyword

m_a_zorel · 10-16-2012, 09:39 AM

My first foray into the world of Linux and PAM.

The man page description appears "vague" with respect to the "similar" keyword, ie: Whether a new password is allowed to be similar to the old one. The passwords are considered to be similar when there is a sufficiently long common substring and the new password with the substring removed would be weak.

How "similar" IS "similar" allowed to be?

Anyone. Thx.

neonsignal · 11-02-2012, 05:20 AM

It looks for long common substrings between the old and new password, removes them from the new password, and then checks if what is left over passes the strength rules.

So for example, merely tacking '1234' on the end of the password will fail. Or changing 'abcdefghijklmnop' to 'abcdefghXijklmnop'.