Change password policy

sunhui · 08-01-2006, 01:18 AM

When I force the user to change the password , the user will prompt the message (BAD PASSWORD: it is based on a dictionary word) , I understand this is a security reason to probit simple password , but if I want to disable this restriction ( that means the linux system allow any dictionary word ) , what can I do ? thx.

Sailesh · 08-01-2006, 01:39 AM

I think u need to change cracklib in sytem-auth file.
But better take backup before doing it.

Its not my advice.. I read it somewhere... Check where the file is present and modify...

jschiwal · 08-01-2006, 02:49 AM

You should provide more information on which distro you are using. Does your system use PAM for authentication?

If so, look in the file /etc/security/pam_pwcheck.conf. It may have it's own manpage. Also, your distro may have GUI configuration for something like Users & Security where you can set it there.

Code:

# pam_pwcheck config file
#
# This file contains options for the pam_pwcheck.so module.
#
# At first, pam_pwcheck will read this file and then uses the local
# options.
#
# Please read the pam_pwcheck.8 manual page for a list of valid
# options.
#
# Example:
#  password:    nullok cracklib remember=8
#
password:       remember=6 minlen=6 cracklib nullok

The pam_pwcheck.so module may be used on one of the files in /etc/pam.d/.

sunhui · 08-01-2006, 04:06 AM

Quote:

Originally Posted by Sailesh

I think u need to change cracklib in sytem-auth file.
But better take backup before doing it.

Its not my advice.. I read it somewhere... Check where the file is present and modify...

If remove this line , the system will allow any kind of password that means all insecure password eg. too short , too simple , similiar password are allowed , if I only want to disable the restriction (BAD PASSWORD: it is based on a dictionary word) , what can I do ? thx

jschiwal · 08-01-2006, 04:51 AM

Maybe you could change the dictionary path that cracklib uses. However doing away with this restriction is a very bad idea. It would open up your computer to a simple dictionary attack.

sunhui · 08-01-2006, 09:26 PM

I would like to have one more requirement , the default password length is at least 7 characters, if I want to change the default setting , that the system accept the password length is 6 characters , what can i do ? thx

jschiwal · 08-02-2006, 02:26 AM

Change the minlength setting in /etc/security/pam_pwcheck

Code:

# pam_pwcheck config file
#
# This file contains options for the pam_pwcheck.so module.
#
# At first, pam_pwcheck will read this file and then uses the local
# options.
#
# Please read the pam_pwcheck.8 manual page for a list of valid
# options.
#
# Example:
#  password:    nullok cracklib remember=8
#
password:       remember=6 minlen=6 cracklib nullok

sunhui · 08-02-2006, 08:54 PM

thx reply ,

the password length is Ok now , thx for help.

I would like to ask again , now my system accept the numerics only or characters only password , for example , the password can be 741852 ( all numerics ) or poiuyt ( all characters ) , if I want to control the password MUST have BOTH characters AND numerics , what can I do ? thx