Table of Contents
Ubuntu - PAM - pam_passwdqc
libpam_ passwdqc is a PAM module that tests passwords to make sure they are not too weak during password change.
It adds additional password entropy assistance to the standard security system.
The cracklib module doesn't enforce password strength checking on the “root”.
To enforce password checking for all accounts including the root user the passwdqc PAM module can be used instead of cracklib module.
Create the PAM configuration file for passwdqc
Create a PAM configuration file for passwdqc by issuing the following command:
sudo vi /usr/share/pam-configs/passwdqc
and populate it with the following:
- /usr/share/pam-configs/passwdqc
Name: passwdqc password strength checking Default: yes Priority: 1024 Conflicts: cracklib [maybe?] Password-Type: Primary Password: requisite pam_passwdqc.so min=disabled,10,8,8,8 similar=deny enforce=users ask_oldauthtok check_oldauthtok
Now issue the command:
sudo pam-auth-update
and ensure that the passwdqc password strength checking is enabled.
WARNING: Enabling the PAM passwdqc module will disable the PAM cracklib module.
Set the password strength policy
Issue the following command:
sudo vi /etc/pam.d/common-password
and populate it with the following:
- /etc/pam.d/common-password
password requisite pam_passwdqc.so min=disabled,10,8,8,8 max=40 similar=deny enforce=users ask_oldauthtok check_oldauthtok password [success=1 default=ignore] pam_unix.so obscure use_authtok try_first_pass sha512 # here's the fallback if no module succeeds password requisite pam_deny.so # prime the stack with a positive return value if there isn't one already; # this avoids us returning an error just because nothing sets a success code # since the modules above will each just jump around password required pam_permit.so
By default, Ubuntu requires a minimum password length of 4 characters, as well as some basic entropy checks. These values are controlled in the file /etc/pam.d/common-password.
The pam_passwdqc manpage provides a lot of information, but the above essentially disallows passwords from any single character class, enforces a minimum length of 10 characters for a password from any two character classes, a minimum length of 8 characters for a passphrase, a minimum length of 8 characters for a password from any three character classes, and a minimum length of 8 characters from four character classes. The four character classes are made up of, digits, lower-case letters, upper-case letters, and other characters (such as '!' and '_') respectively. The above also enforces no passwords longer than 40 characters. The other options are clearly outlined in the pam_passwdqc man pages.
Each option can be customized to suit your environment. The above is actually less strict than the recommended default setting of “min=disabled,24,12,8,7” which can create some extremely difficult-to-crack passwords.
pam_passwdqc has no strange requirements, so even if your distribution does not provide it in packaged form, installing and compiling from source should cause no problems whatsoever.
The hashed passwords use a randomly generated salt.
Examples
password requisite pam_passwdqc.so min=disabled,12,8,6,5 max=40 passphrase=3 match=4 similar=deny random=42 enforce=everyone retry=3