courierpassd(8) [debian man page]
COURIERPASSD(8) Authentication COURIERPASSD(8) NAME
courierpassd - change passwords from across the network using the Courier authentication library SYNOPSIS
courierpassd [-hV] [-s SERVICE] [--stderr] courierpassd -s, --service SERVICE courierpassd --stderr courierpassd -h, --help courierpassd -V, --version DESCRIPTION
courierpassd allows users to change their passwords from remote locations using the Courier authentication library. Usernames can be up to 64 characters long while passwords can be up to 128 characters long. courierpassd uses the poppassd protocol for obtaining authentication tokens from the network. courierpassd is intended to be run from a super-server such as tcpserver or xinetd. The service specified by the -s switch will depend on the particular authentication modules installed. Often 'login' will be appropriate but other possibilities include 'imap' and 'pop3'. This value defaults to 'login'. See the Courier documentation for a further explanation of this switch. The minimum uid that courierpassd will attempt to change a password for can be set at compile time using the configure option --with- minuid. courierpassd will refuse to change the password of a user whose uid is below this value. The default value is 100. This value should never be set to 0 as this would allow root's password to be changed from a remote location. A second configure option, --with-badpassdelay, can be used to set the delay in seconds that courierpassd sleeps after an unsuccessful password change attempt. This feature is designed to make brute force attacks against passwords harder to perform. The default value is 3. LOGGING
Logging is done to syslog by default or to stderr if the --stderr switch is used. courierpassd logs all password change attempts whether they are successful or not. courierpassd does certain checks on command line arguments so it is important to put --stderr first in the argument list if it is to be used in order for these checks to be logged properly. EXAMPLE CLIENT-SERVER CONVERSATION All messages passed between server and client are text based allowing a client session to be easily mimicked with telnet. Using telnet, changing a user's password would look like this: Connected to localhost.localdomain (127.0.0.1). Escape character is '^]'. 200 courierpassd 1.1.2 hello, who are you? user <username> 200 Your password please. pass <current password> 200 Your new password please. newpass <new password> 200 Password changed, thank-you. quit 200 Bye. Connection closed by foreign host. BUGS
If you've found a bug in courierpassd, please report it to freeware@arda.homeunix.net SEE ALSO
http://www.courier-mta.org/authlib/ http://echelon.pl/pubs/poppassd.html AUTHOR
courierpassd was written by Andrew St. Jean Courier authentication library was written by Sam Varshavchik poppassd was written by Pawel Krawczyk based on an ealier version written by John Norstad, Roy Smith and Daniel L. Leavitt GNU
/Linux 20 Jan 2005 COURIERPASSD(8)
Check Out this Related Man Page
pam_pwcheck(8) Reference Manual pam_pwcheck(8) NAME
pam_pwcheck - PAM module for password strength checking DESCRIPTION
The pam_pwcheck is a PAM module for password strength checking. It makes additional checks upon password changes, but does not perform the change itself. It only provides functionality for one PAM management group: password changing. This module works in the following manner: if enabled, it first calls the Cracklib routine to check the strength of the password; if crack likes the password, the module does an additional set of strength checks. These checks are: Palindrome Is the new password a palindrome of the old one? Case Change Only Is the new password the old one with only a change of case? Similar Is the new password too similar to old one? Simple Is the new password too short? Rotated Is the new password a rotated version of the old password? Already used Was the password used in the past? Previously used passwords are to be found in /etc/security/opasswd. OPTIONS
The following options may be passed to the module: cracklib=<path to dictionaries> Use cracklib library for password checks. This parameter also contains the path to the cracklib dictionaries. The default is /usr/lib/cracklib_dict. debug A lot of debug information is printed with syslog(3). maxlen=number Number of significant characters in the password for crypt(3). A value of zero suppresses this check. The default is 0. minlen=number The minimum number of characters in an acceptable password. A new password with fewer characters will be rejected. A value of zero suppresses this check. The default is 5. no_obscure_checks No additional checks will be performed before a new password is accepted. Since the checks performed are fairly simple, their usage is recommended. not_set_pass If this option is given, pam_pwcheck will not make the new password available for other modules. nullok Normally the account is disabled if no password is set or if the length of the password is zero. With this option you can allow the user to change his password for such accounts. This option does not overwrite a hardcoded default by the calling process. tries=number Maximum number of attempts to change a password if the new ones are rejected because they are too easy. use_authtok Set the new password to the one provided by the previously stacked password module. If this option is not set, pam_pwcheck will ask the user for the new password. use_first_pass By default pam_pwcheck tries to get the authentication token from a previous module. If no token is available, the user is asked for the old password. With this option, pam_pwcheck aborts with an error if no authentication token from a previous module is available. remember=XX Remember the last XX passwords and do not allow the user to reuse any of these for the next XX password changes. XX is a number between 1 and 400. enforce_for_root If this option is set, most of the password check rules are enforced for root, too. Never use this option if you don't know what you are doing, since it could be as result that root is no longer allowed to login at all. FILES
/etc/security/opasswd SEE ALSO
passwd(1), pam.conf(8), pam.d(8), pam(8), rpasswd(1), rpasswdd(8), rpc.yppasswdd(8), yppasswd(1) pam_pwcheck September 2008 pam_pwcheck(8)