4

We would like to prevent users from using words such as the organisation name or their username as part of the password. The default behaviour of pam_cracklib when given a dictionary seems to be to disallow any passwords that are the words contained in the dictionary, as follows:

password  required  pam_cracklib.so dictpath=/usr/share/cracklib/pw_dict

This gives the following behaviour:

passwd username
Changing password for username.
New password: salesperson
BAD PASSWORD: it is based on a dictionary word.
^C

however, simply repeating the word passes:

passwd username
Changing password for username.
New password: salespersonsalesperson
Retype new password: salespersonsalesperson
Password changed.

Is there any way to modify the password policy to prevent this?

Thanks in advance.

2
  • I assume you're not allowed to have a developer add functionality to pam_cracklib? Or post a bounty to the pam_cracklib maintainers to add a feature? Mar 22, 2014 at 21:37
  • I ended up finding a solution in the shame of the pam_passwd+ module which enables you to have a list of regular expressions that are not allowed in passwords, among other things. Mar 24, 2014 at 7:35

1 Answer 1

1

I'm fairly certain pam_cracklib can't check against repeat words (unless you created a dictionary of doubled words). I think you'll find more success in setting complexity requirements (the "credits" system in pam_cracklib) than just checking against dictionary words. See man pam_cracklib for details.

1
  • Yeah, it's just that I'm tasked to few certain words from passwords altogether. It needn't be the entire dictionary, but I was under the impression that adding the words to the dictionary would do the trick. Apparently that isn't the case. It prevents simple derivatives (such as salesperson1) but it doesn't ban the word outright. Mar 21, 2014 at 13:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .