|
Set Password Rules
2016/01/20 |
|
Set Password Rules for security reasons.
|
|
| [1] | Install password quality checking library. |
|
root@dlp:~# apt-get -y install libpam-pwquality
|
| [2] | Set number of days for password Expiration. Users must change their password within the days. This setting impacts only when creating a user, not impacts to exisiting users. If set to exisiting users, run the command "chage -M (days) (user)". |
|
root@dlp:~#
vi /etc/login.defs # line 160: set 60 for Password Expiration PASS_MAX_DAYS 60
|
| [3] | Set minimum number of days available of password. Users must use their password at least this days after changing it. This setting impacts only when creating a user, not impacts to exisiting users. If set to exisiting users, run the command "chage -m (days) (user)". |
|
root@dlp:~#
vi /etc/login.defs # line 161: set 2 for Minimum number of days available PASS_MIN_DAYS 2
|
| [4] | Set number of days for warnings before expiration. This setting impacts only when creating a user, not impacts to exisiting users. If set to exisiting users, run the command "chage -W (days) (user)". |
|
root@dlp:~#
vi /etc/login.defs # line 162: set 7 for number of days for warnings PASS_WARN_AGE 7
|
| [5] | Limit using a password that was used in past. Users can not set the same password within the generation. |
|
root@dlp:~#
vi /etc/pam.d/common-password # line 26: prohibit to use the same password for 5 generation in past
password [success=1 default=ignore] pam_unix.so obscure use_authtok \
try_first_pass sha512 remember=5
|
| [6] | Set minimum password length. Users can not set thier password length less than this parameter. |
|
root@dlp:~#
vi /etc/pam.d/common-password # line 25: set 8 for minimum password length
password requisite pam_pwquality.so retry=3 minlen=8
|
| [7] | Set minimum number of required classes of characters for the new password. (kinds ⇒ UpperCase / LowerCase / Digits / Others) |
|
root@dlp:~#
vi /etc/pam.d/common-password # line 25: set 2 for minimum number of required classes of characters
password requisite pam_pwquality.so retry=3 minclass=2
|
| [8] | Set maximum number of allowed consecutive same characters in the new password. |
|
root@dlp:~#
vi /etc/pam.d/common-password # line 25: set 2 for maximum number of allowed consecutive same characters
password requisite pam_pwquality.so retry=3 maxrepeat=2
|
| [9] | Set maximum number of allowed consecutive characters of the same class in the new password. |
|
root@dlp:~#
vi /etc/pam.d/common-password # line 25: set 4 for maximum number of allowed consecutive characters of the same class
password requisite pam_pwquality.so retry=3 maxclassrepeat=4
|
| [10] | Require at least one lowercase character in the new password. |
|
root@dlp:~#
vi /etc/pam.d/common-password # line 25: set like follows
password requisite pam_pwquality.so retry=3 lcredit=-1
|
| [11] | Require at least one uppercase character in the new password. |
|
root@dlp:~#
vi /etc/pam.d/common-password # line 25: set like follows
password requisite pam_pwquality.so retry=3 ucredit=-1
|
| [12] | Require at least one digit in the new password. |
|
root@dlp:~#
vi /etc/pam.d/common-password # line 25: set like follows
password requisite pam_pwquality.so retry=3 dcredit=-1
|
| [13] | Require at least one other character in the new password. |
|
root@dlp:~#
vi /etc/pam.d/common-password # line 25: set like follows
password requisite pam_pwquality.so retry=3 ocredit=-1
|
| [14] | Set maximum length of monotonic character sequences in the new password. (ex ⇒ '12345', 'fedcb') |
|
root@dlp:~#
vi /etc/pam.d/common-password # line 25: set like follows
password requisite pam_pwquality.so retry=3 maxsequence=3
|
| [15] | Set number of characters in the new password that must not be present in the old password. |
|
root@dlp:~#
vi /etc/pam.d/common-password # line 25: set like follows
password requisite pam_pwquality.so retry=3 difok=5
|
| [16] | Check whether the words longer than 3 characters from the GECOS field of the user's passwd entry are contained in the new password. |
|
root@dlp:~#
vi /etc/pam.d/common-password # line 25: set like follows
password requisite pam_pwquality.so retry=3 gecoscheck=1
|
| [17] | Set hash/crypt algorithm for new passwords. (default is sha512) |
|
root@dlp:~#
vi /etc/pam.d/common-password # line 26: set to sha512 (for others, md5 or bigcrypt and so on)
password [success=1 default=ignore] pam_unix.so obscure use_authtok \
try_first_pass sha512
|