Set Password Rules2011/04/27 |
| Set Password Policy to let users Comply rules.
|
|
| [1] | Set number of days for password Expiration. Users must change their password within the days. This setting impact only when creating a user, not impact to exisiting users. If set to exisiting users, run the command "chage -M (days) (user)". |
|
[root@dlp ~]# vi /etc/login.defs # line 17: set 60 for Password Expiration PASS_MAX_DAYS 60
|
| [2] | Set Minimum number of days available of password. Users must use their password at least this days after changing it. This setting impact only when creating a user, not impact to exisiting users. If set to exisiting users, run the command "chage -m (days) (user)". |
|
[root@dlp ~]# vi /etc/login.defs # line 18: set 2 for Minimum number of days available PASS_MIN_DAYS 2
|
| [3] | Set number of days for warnings before expiration. This setting impact only when creating a user, not impact to exisiting users. If set to exisiting users, run the command "chage -W (days) (user)". |
|
[root@dlp ~]# vi /etc/login.defs # line 20: set 7 for number of days for warnings PASS_WARN_AGE 7
|
| [4] | Limit using a password that was used in past. Users can not set the same password within the generation. |
|
[root@dlp ~]# vi /etc/pam.d/system-auth # near line 16: prohibit to use the same password for 5 generation in past password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok \ remember=5 |
| [5] | Set minimum password length. Users can not set thier password length less than set this parameter. ( minlen=N ) This setting linkages to other settings, so it need to set other settings like below. |
|
[root@dlp ~]# vi /etc/pam.d/system-auth # near line 15: set 8 for minimum password length password requisite pam_cracklib.so try_first_pass retry=3 type= \ minlen=8 dcredit=0 ucredit=0 lcredit=0 ocredit=0 |
| [6] | In addition to the setting above, Set dcredit that forces users to include numbers in their password. ( dcredit=-N ) |
|
[root@dlp ~]# vi /etc/pam.d/system-auth # near line 15: require to include 2 numbers in users password password requisite pam_cracklib.so try_first_pass retry=3 type= \ minlen=8 dcredit=-2 ucredit=0 lcredit=0 ocredit=0 |
| [7] | In addition to the setting above, Set ucredit that forces users to include Capital characters in their password. ( ucredit=-N ) |
|
[root@dlp ~]# vi /etc/pam.d/system-auth # near line 15: require to include 1 capital character password requisite pam_cracklib.so try_first_pass retry=3 type= \ minlen=8 dcredit=-2 ucredit=-1 lcredit=0 ocredit=0 |
| [8] | In addition to the setting above, Set lcredit that forces users to include Lower cases in their password. ( lcredit=-N ) |
|
[root@dlp ~]# vi /etc/pam.d/system-auth # near line 15: require to include 1 Lower case password requisite pam_cracklib.so try_first_pass retry=3 type= \ minlen=8 dcredit=-2 ucredit=-1 lcredit=-1 ocredit=0 |
| [9] | In addition to the setting above, Set ocredit that forces users to include Symbols in their password. ( ocredit=-N ) |
|
[root@dlp ~]# vi /etc/pam.d/system-auth # near line 15: require to include 1 Symbol password requisite pam_cracklib.so try_first_pass retry=3 type= \ minlen=8 dcredit=-2 ucredit=-1 lcredit=-1 ocredit=-1 |
| [10] | Set difok that forces more than N words in password before change are different from the one after change. ( difok=N ) |
|
[root@dlp ~]# vi /etc/pam.d/system-auth # near line 15: require at least 3 words are different from before change password requisite pam_cracklib.so try_first_pass retry=3 type=
difok=3 |
| [11] | Set number of login failure. Users' account will be locked after failing to login without a break. |
|
[root@dlp ~]# vi /etc/pam.d/system-auth # add like follows ( this example sets login failure for 5 times. ( deny=5 ) ) #%PAM-1.0 # This file is auto-generated. # User changes will be destroyed the next time authconfig is run. auth required pam_env.so auth required pam_tally2.so deny=5 auth sufficient pam_fprintd.so auth sufficient pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 500 quiet auth required pam_deny.so account required pam_unix.so account required pam_tally2.so account sufficient pam_localuser.so account sufficient pam_succeed_if.so uid < 500 quiet account required pam_permit.so # make sure the number of failure of login about a user [root@dlp ~]# pam_tally2 -u fermi Login Failures Latest failure From fermi 7 04/27/11 13:10:26 ttyS0 # unlock a locked user [root@dlp ~]# pam_tally2 -r -u fermi |
| [12] | Change password encryption algorithm. This setting impact only when creating a user, not impact to exisiting users. If set to exisiting users, run the command "chage -d 0 (user)" and let us change their password forcely on next login. |
|
# make sure current algorithm [root@dlp ~]# authconfig --test | grep hashing password hashing algorithm is md5 # chnage algorithm to sha512 [root@dlp ~]# authconfig --passalgo=sha512 --update [root@dlp ~]# authconfig --test | grep hashing password hashing algorithm is sha512 |