We have a requirement to vary the minimum password criteria by the group to which a user belongs.
For example a standard user should have a password with a minimum length of 12 and containing a mix of characters whereas an administrator should have a password with a minimum length of 14 etc.
It would seem that the pam_cracklib.so line is the one to use but the exact method seems to be unclear.
We actually have three requirements normal user, admin, service user.
I think the below lines show the area of pam that requires changing. If anyone has tried this any information or help would be gratefully received.
A google search does show up some hints but none for RHEL6 which is what we are using.
So I've just done my first install of Solaris. I installed it on an x86 system and am now in the processing of figuring out what I need to do to 'harden' it. I've got the Security kit downloaded (jass) but I am not sure what to do with the .tar file.
I can't seem to find any easy steps to... (6 Replies)
What do we need to do to harden a freshly installed solaris OS? like disable telnet, no ftp for root etc...What all services you need to stop? How to check what ports are open? etc etc....please provide all tips that come to your mind...thanks:) (5 Replies)
Here's the issue. Currently when I run passwd -f "username" on any account, when I try to login with said account I don't get prompted to change my password I just keep getting prompted to input a password. (Of course this works just fine with telnet)Is there something i need to add to... (7 Replies)
Pam Module sending a cannot get password enry after certain period in /var/adm/message.
pam_login_limit(auth): Cannot get Password entry for user 'dbsnmp'
What is dbsnmp? Also if account is locked does pam module checks for this locked account at regular interval and keeps on posting... (2 Replies)
Hi, on a lab computer another user (who is a sudoer) changed my password without my permission. I'm pretty positive it was her, though I can't conclusively prove it. I had my friend, who is another sudoer on the machine, fix it and make me a sudoer now too.
So everything is fine, but I want... (0 Replies)
I am dealing with an FTP server and I have implemented password hardening on the server. The thing is that, it applies to SSH connection.
I forcefully expired password of a user so that he can change password at next login. But the user logged in to the server through FTP and he wasn't asked to... (4 Replies)
We've got a FTP server that's open to the public network and its running on Suse SUSE Linux Enterprise Server 11 (x86_64) SP2
Now, since it's an FTP server I can't disable that service, but how else do I harden this server from attacks from outside?
I am thinking of disabling the firewall and... (3 Replies)
Hello All,
I have Sun DSEE7 (11g) on Solaris 10.
I have run idsconfig and initialized ldap client with profile created using idsconfig.
My ldap authentication works. Here is my pam.conf
# Authentication management
#
# login service (explicit because of pam_dial_auth)
#
login ... (3 Replies)
Hi,
I use a software which can create account on many system or application.
One of resource which is managed by this soft his a server SUSE Linux Enterprise Server 10 (x86_64). patch level 3.
This application which is an IBM application use ssh to launch command to create account in... (3 Replies)
Does anyone have any experience hardening the c-icap.conf file? Here is the default config file, it has a lot of options; sorry about how long it is. I have removed some entries that were not needed as well, but it is still so long :D. Any help is much appreciated as I have never dealt with ICAP.
... (0 Replies)
Discussion started by: savigabi
0 Replies
LEARN ABOUT CENTOS
pam_pwhistory
PAM_PWHISTORY(8) Linux-PAM Manual PAM_PWHISTORY(8)NAME
pam_pwhistory - PAM module to remember last passwords
SYNOPSIS
pam_pwhistory.so [debug] [use_authtok] [enforce_for_root] [remember=N] [retry=N] [authtok_type=STRING]
DESCRIPTION
This module saves the last passwords for each user in order to force password change history and keep the user from alternating between the
same password too frequently.
This module does not work together with kerberos. In general, it does not make much sense to use this module in conjunction with NIS or
LDAP, since the old passwords are stored on the local machine and are not available on another machine for password history checking.
OPTIONS
debug
Turns on debugging via syslog(3).
use_authtok
When password changing enforce the module to use the new password provided by a previously stacked password module (this is used in the
example of the stacking of the pam_cracklib module documented below).
enforce_for_root
If this option is set, the check is enforced for root, too.
remember=N
The last N passwords for each user are saved in /etc/security/opasswd. The default is 10. Value of 0 makes the module to keep the
existing contents of the opasswd file unchanged.
retry=N
Prompt user at most N times before returning with error. The default is 1.
authtok_type=STRING
See pam_get_authtok(3) for more details.
MODULE TYPES PROVIDED
Only the password module type is provided.
RETURN VALUES
PAM_AUTHTOK_ERR
No new password was entered, the user aborted password change or new password couldn't be set.
PAM_IGNORE
Password history was disabled.
PAM_MAXTRIES
Password was rejected too often.
PAM_USER_UNKNOWN
User is not known to system.
EXAMPLES
An example password section would be:
#%PAM-1.0
password required pam_pwhistory.so
password required pam_unix.so use_authtok
In combination with pam_cracklib:
#%PAM-1.0
password required pam_cracklib.so retry=3
password required pam_pwhistory.so use_authtok
password required pam_unix.so use_authtok
FILES
/etc/security/opasswd
File with password history
SEE ALSO pam.conf(5), pam.d(5), pam(8)pam_get_authtok(3)AUTHOR
pam_pwhistory was written by Thorsten Kukuk <kukuk@thkukuk.de>
Linux-PAM Manual 09/19/2013 PAM_PWHISTORY(8)