Pam cracklib

lastmod 2020-11-18created 2020-11-185 edits

Password complexity policy

• How do I enforce a password complexity policy?

Password complexity is enforced by the pam_cracklib module. To change the password policy of the local system, you need to edit the /etc/pam.d/common-password file.

Add the following line to the file (before the PAM module mainly used for authentication, or either way, as seen in the example in the pam_unix.so man page) and save the file.

password requisite pam_cracklib.so ucredit=-1 lcredit=-1 dcredit=-1  ocredit=-1

This statement implements the following password requirements.

• retry=N: number of retries when password entry fails
• difok=N: comparison with the old password. Default 10 (50%)
• minlen=N: minimum password length including credits
• dcredit=N: credit value given to digits. Default 1
• ucredit=N: credit value given to English uppercase letters
• lcredit=N: credit value given to English lowercase letters
• ocredit=N: other characters excluding digits and English upper/lowercase letters. (! , @ # $ % etc.)

Giving a value of -1 to an item means the corresponding character must be included. That is, with dcredit=-1, the password must contain a digit.

See also

• Linux PAM
• InformationSecurity:CheckList:Unix - security checklist for Unix-like systems.

Favorite site

• Setting up stronger password policy rules in Linux
• Nalaneun Mulgogi :: Configuring password usage rule complexity
• Key PAM modules ( cracklib.so , wheel.so , tally.so , tally2.so )
• One Step Ahead Igloo Security - Understanding Linux PAM modules