The sys admin's daily grind: pwquality
Strong Passwords

Regular password changes are a thing of the past: Strong passwords for each individual service provide more protection. Charly pimped his Ubuntu accordingly with a suitable PAM module.
Changing the password regularly, about every 60 or 90 days, is now considered obsolete. It is better to use a separate strong password for each service and each login. The requirement for how strong (i.e., how complicated) a password must be is something that – at least on your own systems – you can define yourself.
On my test machine with Ubuntu, I can use almost any simple password I want – that has to change. To make sure it does, I first have to install the pwquality PAM library:
$ sudo apt install libpam-pwquality
Then I have to add a line to the /etc/pam.d/common-password
configuration file. On Ubuntu 18.04 "Bionic Beaver," the default looks like this (this may be slightly different on other systems):
password [success=1 default=ignore] pam_unix.so obscure sha512
This line can remain as a fallback, but in front of it – and this is important – I need to insert the line from Listing 1. This is a single line, which I just wrapped for Listing 1 to improve readability. With the individual parameters (Table 1 breaks them down), the password requirements can be easily controlled.
Listing 1
Password Requirements
password requisite pam_pwquality.so \ retry=4 minlen=9 difok=4 lcredit=-2 \ ucredit=-2 dcredit=-1 ocredit=-1 \ reject_username enforce_for_root
Table 1
pwquality Parameters
Parameter |
Meaning |
retry |
Number of incorrect attempts |
minlen |
Minimum password length |
difok |
Number of characters that can match the old password |
lcredit |
Minimum number of lowercase letters |
ucredit |
Minimum number of uppercase letters |
dcredit |
Minimum number of numbers |
ocredit |
Minimum number of non-standard characters |
reject_username |
Password and username cannot be identical |
enforce_for_root |
Rules also apply for root |
After restarting the system, the new password rule takes effect. To test it, I changed the password of the user bob (Figure 1). In doing so, I intentionally entered a password that was too short in the first round and one that can be found in common dictionaries in the second. The system categorically rejected both – and that's the way it should be.
As my third attempt, I entered a new password that complied with the modified rules: Cm1.Sya-n
. This seems complicated, but it is mnemonic. It's the first letters and punctuation of the first words of Melville's Moby Dick [1], with a 1 instead of an I, because I need a digit according to the new password rule. The system accepted the password without complaint.
Infos
- "Call me Ishmael. Some years ago – never mind how long precisely …": http://www.online-literature.com/melville/mobydick/2/
Buy this article as PDF
(incl. VAT)
Buy Linux Magazine
Direct Download
Read full article as PDF:
Price $2.95
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters
Find SysAdmin Jobs
News
-
Ubuntu Flatpak Remix Adds Flatpak Support Preinstalled
If you're looking for a version of Ubuntu that includes Flatpak support out of the box, there's one clear option.
-
Gnome 44 Release Candidate Now Available
The Gnome 44 release candidate has officially arrived and adds a few changes into the mix.
-
Flathub Vying to Become the Standard Linux App Store
If the Flathub team has any say in the matter, their product will become the default tool for installing Linux apps in 2023.
-
Debian 12 to Ship with KDE Plasma 5.27
The Debian development team has shifted to the latest version of KDE for their testing branch.
-
Planet Computers Launches ARM-based Linux Desktop PCs
The firm that originally released a line of mobile keyboards has taken a different direction and has developed a new line of out-of-the-box mini Linux desktop computers.
-
Ubuntu No Longer Shipping with Flatpak
In a move that probably won’t come as a shock to many, Ubuntu and all of its official spins will no longer ship with Flatpak installed.
-
openSUSE Leap 15.5 Beta Now Available
The final version of the Leap 15 series of openSUSE is available for beta testing and offers only new software versions.
-
Linux Kernel 6.2 Released with New Hardware Support
Find out what's new in the most recent release from Linus Torvalds and the Linux kernel team.
-
Kubuntu Focus Team Releases New Mini Desktop
The team behind Kubuntu Focus has released a new NX GEN 2 mini desktop PC powered by Linux.
-
KDE Plasma 5.27 Slated for a Valentine's Day Release
The next version of the KDE Plasma desktop is prepped and ready with numerous improvements and plenty of bug fixes.