LINUX PASSWORD POLICY

Table of Contents

• 1 Password strength:
• 2 Password duration:
  • 2.1 chage
• 3 Password repeat history:
• 4 Login attempts:
  • 4.1 pam_tally2

1 Password strength:

1. check pam module pam_cracklib.so in /lib/security
2. edit /etc/pam.d/system-auth
   • password requisite pam_cracklib.so try_first_pass retry=3 minlen=8 dcredit=-1 ucredit=-1 lcredit=-1 ocredit=-1

     retry	attempts to pick new password
     minlen	min password length
     ucredit	upper case -1 means at least 1
     lcredit	lower case
     ocredit	special character
     dcredit	digit

2 Password duration:

• For new accounts default settings are in /etc/login.defs
• Settings for current accounts are in /etc/shadow but we edit by command chage

2.1 chage

chage -l [user]	check settings for user
chage -E "YYYY-MM-DD" [user]	set date when account expire, -1 means never
chage -M [nr] [user]	set maximum number of days between password change from last password change, -1 means never expire
chage -d "YYYY-MM-DD" [user]	set last password change
chage -W [nr] [user]	number of days of warning before password expires
chage -i [nr] [user]	set password inactive, when account is blocked after password expire

3 Password repeat history:

• edit /etc/pam.d/system-auth
  • password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok remember=2

    remember

    number of password in history file /etc/security/opasswd

  
  

4 Login attempts:

• check pam module pam_tally2.so in /lib/security
• edit /etc/pam.d/system-auth
  • auth required pam_tally2.so deny=3 unlock_time=60 lock_time=5

    deny	number of attempts to log without deny
    unlock_time	time in sec when next login attempt perform
    lock_time	time in sec when delay every failed login attempt

  • all logs about login attempts are in /var/log/tallylog but we edit by command pam_tally2

4.1 pam_tally2

pam_tally2 -u [user]	check failed login attempts
pam_tally2 -r -u [user]	reset failed login attempts