5
votes
Accepted
Do password expiry rules reducing the security of the system?
Your CTO is more right, but it's a more complex issue. NIST ( https://csrc.nist.gov/ ) is probably the "industry best practices" reference.
When it comes to passwords length, not complexity or ...
- 66
5
votes
Accepted
Apply New Password Policy via GPO Gradually
My first answer was utter nonsense, sorry. Here we go:
If you are on Windows 2008 or higher (as you should), you can use Fine-Grained Password Policies.
Using the "new" Active Directory ...
- 5,300
4
votes
How to use PAM to manage lockout policy for ssh public key authentication methods
The problem is that you're trying to enforce these policies inside of the auth stack.
auth required pam_env.so
auth required pam_faildelay.so delay=2000000
auth ...
- 33.1k
4
votes
The password on this account cannot be changed at this time?
The minimum password age only affect the users ability to "change" their own password. It does not affect admins or account operators from being able to "reset" someone else's password. The "must ...
- 4,573
4
votes
How does "your new password must differ at least n characters from the previous" work when only hash codes are stored?
You're right. If passwords are stored as hash, there's absolutely no way for the operating systems to know how the new password differs from the old one.
The policy check is done from the tool and it ...
- 83
4
votes
Accepted
Sudo: cannot setup user to avoid being asked for password
Probably after your line there's something like:
%sudo ALL=(ALL:ALL) ALL
or similar (i.e. %admin, %wheel, etc.).
Because:
When multiple entries match for a user, they are applied in order. ...
- 2,529
3
votes
Accepted
bad password count in different sites
The default is for a bad password detected on a local DC to be submitted to the PDCe to check for recent password changes. The PDCe keeps track and locks out the account when the threshold is ...
- 46
3
votes
Accepted
If user passwords are set to automatically expire within a Windows domain, does this have an impact on the force password change checkbox within ADUC?
This checkbox is mostly unrelated to any password expiration policy. The effect of checking that box is setting the pwdlastset attribute to 0; which effectively manually expires a password, and ...
- 1,878
3
votes
If user passwords are set to automatically expire within a Windows domain, does this have an impact on the force password change checkbox within ADUC?
It's usually impractical to use the ADUC GUI to query an AD of any relevant size: Using Powershell to find accounts whose passwords are too old provides actionable output across entire OUs or even the ...
- 5,099
3
votes
Accepted
OpenLDAP password policy for a group
If you mean by group, groupOfNames or similar the response is unfortunately no.
From:
man slapo-ppolicy
Every account that should be subject to password policy control should
have a ...
2
votes
Block RSA authentication when password is expired
If you have enrolled the client into FreeIPA, its PAM stack would be configured to use SSSD daemon. PAM module in question is pam_sss, which talks to SSSD daemon to perform the check. SSSD knows about ...
- 1,130
2
votes
Unable to update the password. The value provided for the new password does not meet the length, complexity, or history requirements of the domain
Domain controllers ignore password, lockout, or Kerberos policy settings defined at an organizational unit, such as the Domain Controllers OU.
You should define legacy password policies in the ...
- 36.8k
2
votes
Accepted
Unable to update the password. The value provided for the new password does not meet the length, complexity, or history requirements of the domain
Although I change the minimum password age in the password policy but I still had to change the minimum password age to 0:00:00 in the ADSI Editor for the DC i'm in.
@JimB and @Craig620, your help ...
- 131
2
votes
How to increase time for password-protected screensaver
Since your question is tagged with Group Policy, I am thinking you mean this:
It is a per-user setting, so make sure you link the GPO to an OU that contains the user accounts (as opposed to computer ...
- 55.9k
2
votes
Accepted
How does "your new password must differ at least n characters from the previous" work when only hash codes are stored?
Such policies are usually implemented by applying them when asking for the old password.
Another option would be to brute-force the old one. When you input your new one, a modern computer has no ...
- 1,713
2
votes
Why am I not seeing the user lockout message?
in auth section is silent for pam_failock which prevents to display message about lockout (because this can help to identify existing accounts). If you want to display message, you need to use
auth ...
- 1,368
2
votes
How to use PAM to manage lockout policy for ssh public key authentication methods
I'm pretty sure that you won't be able to use PAM in this capacity. If the user does not have the ssh private key that corresponds to the ssh public key on the server, then they will not be able to ...
- 596
2
votes
Cannot find Passfilt.dll on 2008 DC
There isn't a separate password filter dll included with Windows. If you want password complexity functionality that is different from the default, you need to build/register your own custom dll. Or ...
- 36.8k
2
votes
ppolicy with pam_ldap - pwdReset has no effect when logging in from Ubuntu
I ran into this as well -- my particular problem was that while some third-party applications (Okta in our case) looks for pwdReset, the pam_ldap plugin does not.
After taking a look at the source ...
- 5,690
1
vote
How do you enforce a custom password policy on LUKS FDE (Ubuntu 22)?
It looks like cryptosetup makes use of libpwquality which is different to the PAM files you were looking at. It's config file is usually found at /etc/security/pwquality.conf.
And the man page is here
- 1,645
1
vote
Ansible: how to run subsequent task for only newly created users?
Use getent and create the list of present users
- name: Get all users
getent:
database: passwd
- name: Set present users
set_fact:
present_users: "{{ ...
- 5,638
1
vote
Password history in Active Directory
Q1 - no, enabling history will not see passwords that have been used before enabling it.
1
vote
Password history in Active Directory
As with all password changes, a password that is used during an administrative password reset is included in the password history of an account, as long as Active Directory is configured to enforce ...
- 1,878
1
vote
Do password expiry rules reducing the security of the system?
As usual, it is not easy.
Currently (the situation was probably different when the question was asked initially) the time needed to brute force a "bad" password (for example a single ...
- 11
1
vote
Do password expiry rules reducing the security of the system?
Yes, it increases security risks if you don't force passwords to expire.
As your CTO said, because we have bad habits, passwords will eventually leak one way or another, e.g. type the password in the ...
- 119
1
vote
How does "your new password must differ at least n characters from the previous" work when only hash codes are stored?
And is the consequence that if a root user changes someone else's password, the "number of different characters" policy simply cannot be applied here?
The administrative user can usually manipulate ...
- 80.3k
1
vote
Accepted
Openldap setting up olcOverlay: ppolicy
Understanding of Step 3: Makes a database and uses ppolicy overlay. Makes ou=Policies in my domain dc=example,dc=com. I am unable to explore ou=Policies in Apache Directory Studio even though I ...
- 296
1
vote
Why isn't pwdReset automatically set when pwdMustChange is true?
OpenLDAP doesn't because of the documentation. The OpenLDAP documentation you quoted explicitly states that it isn't automatic and must be set by an administrator:
This attribute is not set due to ...
- 1,020
1
vote
Forcing a password change on OpenBSD
According to login.conf (5), the default grace period for an expired (aka "dead") password is 0. Unless that value is set in /etc/login.conf, a user cannot login to change her password if the current ...
- 465
Only top scored, non community-wiki answers of a minimum length are eligible