The sys admin's daily grind: pwquality
Strong Passwords

Regular password changes are a thing of the past: Strong passwords for each individual service provide more protection. Charly pimped his Ubuntu accordingly with a suitable PAM module.
Changing the password regularly, about every 60 or 90 days, is now considered obsolete. It is better to use a separate strong password for each service and each login. The requirement for how strong (i.e., how complicated) a password must be is something that – at least on your own systems – you can define yourself.
On my test machine with Ubuntu, I can use almost any simple password I want – that has to change. To make sure it does, I first have to install the pwquality PAM library:
$ sudo apt install libpam-pwquality
Then I have to add a line to the /etc/pam.d/common-password
configuration file. On Ubuntu 18.04 "Bionic Beaver," the default looks like this (this may be slightly different on other systems):
password [success=1 default=ignore] pam_unix.so obscure sha512
This line can remain as a fallback, but in front of it – and this is important – I need to insert the line from Listing 1. This is a single line, which I just wrapped for Listing 1 to improve readability. With the individual parameters (Table 1 breaks them down), the password requirements can be easily controlled.
Listing 1
Password Requirements
password requisite pam_pwquality.so \ retry=4 minlen=9 difok=4 lcredit=-2 \ ucredit=-2 dcredit=-1 ocredit=-1 \ reject_username enforce_for_root
Table 1
pwquality Parameters
Parameter |
Meaning |
retry |
Number of incorrect attempts |
minlen |
Minimum password length |
difok |
Number of characters that can match the old password |
lcredit |
Minimum number of lowercase letters |
ucredit |
Minimum number of uppercase letters |
dcredit |
Minimum number of numbers |
ocredit |
Minimum number of non-standard characters |
reject_username |
Password and username cannot be identical |
enforce_for_root |
Rules also apply for root |
After restarting the system, the new password rule takes effect. To test it, I changed the password of the user bob (Figure 1). In doing so, I intentionally entered a password that was too short in the first round and one that can be found in common dictionaries in the second. The system categorically rejected both – and that's the way it should be.
As my third attempt, I entered a new password that complied with the modified rules: Cm1.Sya-n
. This seems complicated, but it is mnemonic. It's the first letters and punctuation of the first words of Melville's Moby Dick [1], with a 1 instead of an I, because I need a digit according to the new password rule. The system accepted the password without complaint.
Infos
- "Call me Ishmael. Some years ago – never mind how long precisely …": http://www.online-literature.com/melville/mobydick/2/
Buy this article as PDF
(incl. VAT)
Buy Linux Magazine
Direct Download
Read full article as PDF:
Price $2.95
News
-
Kali Linux 2022.3 Released
From the creators of the most popular penetration testing distributions on the planet, comes a new release with some new tools and a community, real-time chat option.
-
The 14" Pinebook Pro Linux Laptop is Shipping
After a considerable delay, the 14" version of the Pinebook Pro laptop is, once again, available for purchase.
-
OpenMandriva Lx ROME Technical Preview Released
OpenMandriva’s rolling release distribution technical preview has been released for testing purposes and adds some of the latest/greatest software into the mix.
-
Linux Mint 21 is Now Available
The latest iteration of Linux Mint, codenamed Vanessa, has been released with a new upgrade tool and other fantastic features.
-
Firefox Adds Long-Anticipated Feature
Firefox 103 has arrived and it now includes a feature users have long awaited…sort of.
-
System76 Refreshes Their Popular Oryx Pro Laptop with a New CPU
The System76 Oryx Pro laptop has been relaunched with a 12th Gen CPU and more powerful graphics options.
-
Elive Has Released a New Beta
The Elive team is proud to announce the latest beta version (3.8.30) of its Enlightenment-centric Linux distribution.
-
Rocky Linux 9 Has Arrived
The latest iteration of Rocky Linux is now available and includes a host of new features and support for new architecture.
-
Slimbook Executive Linux Ultrabook Upgrading Their CPUs
The Spanish-based company, Slimbook, has made available their next generation Slimbook Executive Linux ultrabooks with a 12th Gen Intel Alder Lake CPU.
-
Fedora Linux is Coming to the Raspberry Pi 4
Thanks to significant work in the upstream, the upcoming release of Fedora 37 will introduce support for the Raspberry Pi 4.