1

I've been trying to configure my server for security, but I have no idea what I'm doing. I'm following various guides to the best of my ability - one of them being the following: http://wiki.centos.org/HowTos/OS_Protection

After making changes and logging out, my passwords no longer work when attempting to log back in. These are the two changes that I suspect may be causing the issue:

1) I changed the password protection from md5 to sha512 with the following code:

authconfig --passalgo=sha512 --update


2) I changed /etc/pam.d/system-auth to look like this:

touch /var/log/tallylog
cat << 'EOF' > /etc/pam.d/system-auth
#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth        required      pam_env.so
auth        sufficient    pam_unix.so nullok try_first_pass
auth        requisite     pam_succeed_if.so uid >= 500 quiet
auth        required      pam_deny.so
auth        required      pam_tally2.so deny=3 onerr=fail unlock_time=60

account     required      pam_unix.so
account     sufficient    pam_succeed_if.so uid < 500 quiet
account     required      pam_permit.so
account     required      pam_tally2.so per_user

password    requisite     pam_cracklib.so try_first_pass retry=3 minlen=9 lcredit=-2 ucredit=-2     dcredit=-2 ocredit=-2
password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok remember=10
password    required      pam_deny.so

session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     required      pam_unix.so
EOF

How can I fix this? Am I going to need to reinstall CentOS and start from scratch?

2 Answers 2

1

You'll need to reboot into single user mode.

Follow the instructions at:- http://www.centos.org/docs/5/html/Installation_Guide-en-US/s1-rescuemode-booting-single.html

That should put you on as root. Then you simply passwd all the user passwords you need.

2
  • I'm accessing the system remotely via SSH (I purchased the server space from a hosting company), so I don't get the chance to see the GRUB screen as instructed in your link. Also, one of the changes made because of the article I linked in the OP mandates a password for single-user mode. The code used is as follows: echo "~~:S:wait:/sbin/sulogin" >> /etc/inittab.
    – Nick
    Apr 4, 2011 at 8:32
  • 1
    Okay, well chat to the hosting compnay to see if they can reset the password for you otherwise it looks like it's going to be a reinstall.
    – Decado
    Apr 4, 2011 at 9:42
0

The passwords that already exist in /etc/shadow will have been created using MD5. You will need to recreate them now that you have changed the hashing scheme.

1
  • How do I do this if I can't log in? I should clarify - I can't log in with root either.
    – Nick
    Apr 4, 2011 at 8:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .