Linux System Administration Recipes A Problem-Solution Approach

CHAPTER 6 ■ SECURING YOUR SYSTEMSaddpol -minclasses 3 -maxlife 90 days -minlength 12 -history 5 adminpolicyaddpol -minclasses 2 -maxlife 180 days -minlength 8 -history 5 userpolicyTo apply this policy to an existing user, user1, use the following:modify_principal -policy userpolicy user1To use a policy when creating a user, admin1, use the following:add_principal -policy adminpolicy admin1If no policy is specified, the default policy will be used.You can also do this via various PAM modules if you’re using an /etc/passwd-based system (seeRecipe 6-9). (However, it’s a much better idea to use Kerberos! See Chapter 2.)■ Note You can also try making helpful suggestions to your users. For example, you could suggest that they usephrases instead of words (modern systems should be able to handle arbitrarily long passwords) or the initial lettersof a phrase or song lyric, with a few numbers or punctuation marks thrown in.6-9. Setting and Enforcing Password Policy withpam_cracklibIf you’re using the standard /etc/passwd and /etc/shadow login rather than Kerberos or anothercentralized system (see the preceding recipe for Kerberos password policy), you can use the PAMmodule pam_cracklib to enforce both length and complexity of passwords. This module works byapplying a set of rules, covering length and complexity, when a user changes their password.For length, it uses a single option, minlen (measured in days).For complexity, it has the options dcredit, ucredit, lcredit, and ocredit, which refer to thecharacter classes’ digit, uppercase character, lowercase character, and other character, respectively. Avalue of –1 for one of these values means “require one character of this type,” and a value of 1 means“give 1 credit for this type.” The credit system involves giving “length credits” for using nonlowercasecharacters (this means that you can have a shorter password than the minimum length if it usesnonlowercase characters as well as lowercase characters). However, this can be confusing for users (andreduces the security of the password), so it’s better and more straightforward just to require (by settingthe value to –1) certain types of character.Try adding the following line in /etc/pam.d/common-password in Debian-type distros or/etc/pam.d/system-auth in RedHat-type distros:password requisite pam_cracklib.so retry=3 minlen=10 difok=3 dcredit=-1 ucredit=-1 lcredit=-1The retry value sets a maximum of three attempts at getting an acceptable password. Users canalways rerun passwd to try again; this doesn’t lock you out after three attempts. minlen sets a tencharacterminimum length. difok=3 requires a minimum of three characters different from the last146Download at WoweBook.Com