Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am configuring password rules in linux system(RedHat Enterprise linux 5). By google, I found that using pam_cracklib will make simple check automatically. That is, pam_cracklib will automatically check if the new password is the reverse one of the previous password. If yes, it will reject the new password.

However, I tried a new password just the reverse of the previous one, the new password can take effective! That is, pam_cracklib will allow the new password(reverse of the previous one). Here is my configuration:

/etc/pam.d/system-auth:
password    required    pam_cracklib.so try_first_pass retry=3  minlen=6 

Could anyone tell me if there is something wrong with my configuration? Or there are some bugs with pam_cracklib?

Thanks a lot!

share|improve this question
    
Did you try to change the password as root or as a regular user? root can override all kinds of restrictions in many situations. –  Janne Pikkarainen Sep 28 '10 at 7:20
    
Janne, I change password as a regular user, not root.So I am surprised why pam_cracklib doesn't take effective. –  zhaojing Sep 28 '10 at 7:40
    
adding "obscure" to pam_cracklib will have similar effect –  Hubert Kario Aug 16 '11 at 21:12
add comment

1 Answer

up vote 0 down vote accepted

You can't use try_first_pass with cracklib. It should check whatever the password is a palindrome or rotation of old password by default.

What's more, other modules (probably pam_unix.so or pam_ldap.so) in the stack must use the use_authok flag or they will be allowed to ask the user for password if previous module didn't accept the provided password.

In short, try:

password    required    pam_cracklib.so retry=3  minlen=6
password    required    pam_unix.so use_authok nullok md5

The nullok flag tells the module it's OK to change password from an empty one (the usual method of forcing a password change in UNIX systems), you can remove it if you don't use this functionality.

share|improve this answer
    
Hubert, thanks a lot for your detailed infos. –  zhaojing Sep 30 '10 at 2:45
    
But It seems the method you proposed still can't solve the problem. –  zhaojing Sep 30 '10 at 2:45
    
For example, if I first set passwd:1qaz2wsx, the second I set passwd:xsw2zaq1. It works. So the rotation checking seems doesn't take effective. –  zhaojing Sep 30 '10 at 2:46
    
The palindrome is just for a new password (you can't have a "qwertrewq" password). Rotation checks only for simple word rotation, as when you start a word in the middle and add the start to the end: so with old password "password", the new password can't be "sswordpa" or "wordpass". As such, I don't think you should worry about this combination, it's rather obscure. Anyway, you may be interested in discussion in serverfault.com/questions/4221/…. –  Hubert Kario Sep 30 '10 at 8:02
    
Hobert, thanks a lot for your help and your suggested webpage. –  zhaojing Sep 30 '10 at 8:40
show 6 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.